How to identify Deallocated virtual machines in powershell and trigger automate using Logic app

Accepted answer

MayankBargali-MSFT 69,421 Reputation points

2023-06-12T06:35:40.15+00:00
@Anonymous Thanks for reaching out.

To identify deallocated virtual machines in PowerShell, you can use the Get-AzVM cmdlet and filter the results based on the PowerState property. Here's an example command that you can use:

Get-AzVM | Where-Object {$_.PowerState -eq 'VM deallocated'}

This command will return a list of all virtual machines that are deallocated.

To trigger an automation using Azure Logic Apps when a virtual machine is deallocated, you can use the Azure Event Grid trigger in Logic Apps. Here are the steps to configure the trigger:

For more details and steps, please refer to this document and you need to add the condition for deallocate event i.e. "Microsoft.Compute/virtualMachines/deallocate/action" so in Step 4 d. here please replace Microsoft.Compute/virtualMachines/write with Microsoft.Compute/virtualMachines/deallocate/action condition.

When a virtual machine is deallocated, Azure Event Grid will send a notification to the Logic App, which will trigger the automation and you can further integrate your workflow.

Hope the above helps. Feel free to get back to me if you need any assistance.

Please "Accept Answer" if the answer is helpful so that it can help others in the community.
Please sign in to rate this answer.
Anonymous

2023-06-12T11:13:31.3266667+00:00

Thank you Mayank,

The code you mentioned this wont retrieve with EventTimeStamp

Required Date and Time,

Please send the code with EventTimeStamp.

MayankBargali-MSFT 69,421 Reputation points

2023-06-14T06:45:59.5766667+00:00

@Anonymous Can you try out this :

Get-AzVM | Where-Object {$_.PowerState -eq 'VM deallocated'} | Select-Object Name, ResourceGroupName, PowerState, @{Name='DeallocatedTime'; Expression={$_.Extensions.Statuses.Time | Where-Object {$_.Code -eq 'PowerState/deallocated'} | Select-Object -ExpandProperty EventTimeStamp}}

Anonymous

2023-06-14T11:35:22.45+00:00

Hi Mayank,

Get-AzVM | Where-Object {$.PowerState -eq 'VM deallocated'} | Select-Object Name, ResourceGroupName, PowerState, @{Name='DeallocatedTime'; Expression={$.Extensions.Statuses.Time | Where-Object {$_.Code -eq 'PowerState/deallocated'} | Select-Object -ExpandProperty EventTimeStamp}}

This code has not generating output.

MayankBargali-MSFT 69,421 Reputation points

2023-06-15T05:20:25.95+00:00

Santosh Savakar Are you looking for deallocated VM time? I don't see that the deallocation time is retrieved with any of the commands. Please confirm and I will try to find out if there is any workaround.

MayankBargali-MSFT 69,421 Reputation points

2023-06-15T05:57:20.9766667+00:00

@Anonymous You can leverage the below script to first get the list of VM's that are in deallocated state and leverage AzLog command to check the logs to get the deallocated time. The deallocated time will only be available in the activity logs when the operation was performed.

The below script will write the details of all the VM's that are in deallocated state along with the timeframe when the operation was performed. As the retention period is 90 days so data will be available for the last 90 days only. If eventTimestamp is not retrieved then it means that the operation was performed more than 90 days for that deallocated VM. Please modify the below as per your requirement.

$vms = Get-AzVM -Status | Where-Object {$_.PowerState -eq 'VM deallocated'} foreach ($vm in $vms) { $logs = Get-AzLog -ResourceId $vm.Id -StartTime (Get-Date).AddDays(-90) | Where-Object {$_.OperationName.LocalizedValue -eq 'Deallocate Virtual Machine' -and $_.Status.Value -eq 'Succeeded' } | Select-Object Id, @{Name='Status'; Expression={$_.Status.Value}}, eventTimestamp Write-Output "Virtual machine $($vm.Name) was deallocated at $($logs.eventTimestamp)" }

Anonymous

2023-06-15T17:45:02.8833333+00:00

Hi Mayank,

The script is not working properly, the deallocated is not there

Required date and time.

Anonymous

2023-06-19T13:06:11.6333333+00:00

Is it necessary to enable Diagnostic settings in order to get all virtual machine statuses (Deallocated, Running, etc.)

MayankBargali-MSFT 69,421 Reputation points

2023-06-21T06:06:36.54+00:00

@Anonymous As I mentioned in my previous comment If eventTimestamp is not retrieved then it means that the operation was performed more than 90 days for that deallocated VM therefore if the logs are not present it will not return any date and time. This means that the VM was deallocated more than 90 days. Yes but I will confirm with the Azure VM experts if this is not the case.

Anonymous

2023-06-22T17:36:02.65+00:00

Hi Mayank,

I am using this script to get the Hostpool virtual machines' HeartbeatTime, but it does not give me the virtual machine's name. Despite mentioning vmName, I couldn't get it in the output.

could you please review code and paste here revised code?

# Connect to Azure Connect-AzAccount # Set the subscription context Set-AzContext -SubscriptionId "<subscription ID>" # Specify the host pool details $resourceGroupName = "<resourceGroupName>" $hostPoolName = "<hostPoolName>" # Get the host pool $hostPool = Get-AzWvdHostPool -ResourceGroupName $resourceGroupName -Name $hostPoolName # Get the session hosts within the host pool $sessionHosts = Get-AzWvdSessionHost -ResourceGroupName $resourceGroupName -HostPoolName $hostPoolName # Iterate over the session hosts and retrieve their status and event timestamp foreach ($sessionHost in $sessionHosts) { $sessionHostName = $sessionHost.SessionHostName $status = $sessionHost.Status $eventTimestamp = $sessionHost.LastHeartBeat # Get the virtual machine name from the session host properties $vmName = $sessionHost.Properties.osProfile.name # Get the computer name of the virtual machine $vm = Get-AzVM -ResourceGroupName $resourceGroupName -Name $vmName $computerName = $vm.OSProfile.ComputerName Write-Host "Virtual Machine Name: $vmName, Computer Name: $computerName, Session Host: $sessionHostName, Status: $status, Last Event Timestamp: $eventTimestamp" }

Richard Duane Wolford Jr 206 Reputation points

2024-01-15T05:35:18.5266667+00:00

I know this is an older thread, but it is required to use the -status flag with Get-AzVM or there won't be a PowerState property.
Sign in to comment

Share via

How to identify Deallocated virtual machines in powershell and trigger automate using Logic app

0 additional answers