SOLVED

WVD Log Analytics (classic) How to find out if someone deleted a wvd server from host pool

%3CLINGO-SUB%20id%3D%22lingo-sub-1753270%22%20slang%3D%22en-US%22%3EWVD%20Log%20Analytics%20(classic)%20How%20to%20find%20out%20if%20someone%20deleted%20a%20wvd%20server%20from%20host%20pool%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1753270%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWe've%20lost%20one%20server%20from%20the%20host%20pool%20randomly%20and%20I'm%20trying%20to%20look%20up%20log%20analytics%20data%20to%20find%20out%20_if_%20an%20admin%20has%20misclicked%20delete%20in%20the%20management%20portal%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI've%20tried%20different%20queries%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CDIV%3E%3CDIV%3E%3CSPAN%3EWVDActivityV1_CL%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Ewhere%3C%2FSPAN%3E%3CSPAN%3E%20Type_s%20%3D%3D%20%3C%2FSPAN%3E%3CSPAN%3E%22Management%22%3C%2FSPAN%3E%20%3CSPAN%3Eand%3C%2FSPAN%3E%3CSPAN%3E%20ObjectsDeleted_s%20!%3D%20%3C%2FSPAN%3E%3CSPAN%3E0%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3EAlso%20method_s%20%3D%3D%20%22delete%22%20or%20%22remove%22%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3Ealso%20route_s%20%3D%3D%20%22delete%22%20or%20%22remove%22%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3EWhat%20would%20be%20the%20log%20information%20generated%20with%20a%20server%20delete%20from%20pool%20(in%20the%20classic%20wvd%20management%20portal)%3F%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3EI%20cannot%20find%20any%20documentation%20on%20the%20classic%20wvd%20log%20analytics%20syntax.%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3EBest%20Regards%3C%2FDIV%3E%3CDIV%3EA%20T%3C%2FDIV%3E%3C%2FDIV%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1772107%22%20slang%3D%22en-US%22%3ERe%3A%20WVD%20Log%20Analytics%20(classic)%20How%20to%20find%20out%20if%20someone%20deleted%20a%20wvd%20server%20from%20host%20pool%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1772107%22%20slang%3D%22en-US%22%3Efor%20Type%20should%20be%20%22Management%22%2C%20method%20should%20be%20%22Remove%22.%20Try%20to%20use%20'contains'%20instead%20of%20'%3D%3D'%20as%20it%20may%20be%20case%20sensitive.%3C%2FLINGO-BODY%3E
Highlighted
Visitor

Hi,

 

We've lost one server from the host pool randomly and I'm trying to look up log analytics data to find out _if_ an admin has misclicked delete in the management portal:

 

I've tried different queries:

 

WVDActivityV1_CL
| where Type_s == "Management" and ObjectsDeleted_s != 0
 
Also method_s == "delete" or "remove"
 
also route_s == "delete" or "remove"
 
 
What would be the log information generated with a server delete from pool (in the classic wvd management portal)?
 
I cannot find any documentation on the classic wvd log analytics syntax.
 
 
Best Regards
A T
1 Reply
Highlighted
Best Response confirmed by ATWVD (Visitor)
Solution
for Type should be "Management", method should be "Remove". Try to use 'contains' instead of '==' as it may be case sensitive.