question

Kks-9125 avatar image
0 Votes"
Kks-9125 asked PRADEEPCHEEKATLA-MSFT commented

one of the test.db folder in a test container of datalake has been deleted and is there any way to know the user details who has deleted

we have test.db in test container of a datalake . Some one has deleted that db so wanted to know the user details or any databricks script that deleted the folder.

azure-data-lake-storage
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

1 Answer

PRADEEPCHEEKATLA-MSFT avatar image
0 Votes"
PRADEEPCHEEKATLA-MSFT answered PRADEEPCHEEKATLA-MSFT commented

Hello @Kks-9125,

Welcome to the Microsoft Q&A platform.

You can get the user details who has deleted Azure Data Lake Container using Azure Activity log.

The Activity log is a platform log in Azure that provides insight into subscription-level events. This includes such information as when a resource is modified or when a virtual machine is started. You can view the Activity log in the Azure portal or retrieve entries with PowerShell and CLI.

Through Azure Portal:

132661-image.png

Through Log Analytics workspace => Logs:

 AzureActivity 
 | where OperationNameValue contains "MICROSOFT.STORAGE/STORAGEACCOUNTS/BLOBSERVICES/CONTAINERS/DELETE"

132645-image.png

Hope this will help. Please let us know if any further queries.


  • Please don't forget to click on 130616-image.png or upvote 130671-image.png button whenever the information provided helps you. Original posters help the community find answers faster by identifying the correct answer. Here is how

  • Want a reminder to come back and check responses? Here is how to subscribe to a notification

  • If you are interested in joining the VM program and help shape the future of Q&A: Here is how you can be part of Q&A Volunteer Moderators


image.png (120.1 KiB)
image.png (207.0 KiB)
· 3
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

@PRADEEPCHEEKATLA-MSFT

test.db is a folder and not a container . i already checked the activity log and i can see only the below values on the date when test.db was deleted

List Storage Account Keys
Returns Storage Account SAS token
Update Storage Account Create

0 Votes 0 ·

Hello @Kks-9125,

You can try this kusto query to find out the deleted files and folders in a container:

To get this details, make sure to enable the diagnostics settings for the storage account:

133087-image.png

 StorageBlobLogs 
 | where OperationName contains "DeleteFile"

133131-image.png

Hope this will help. Please let us know if any further queries.


1 Vote 1 ·
image.png (101.2 KiB)
image.png (145.1 KiB)

Hello @Kks-9125,

Just checking in to see if the above answer helped. If this answers your query, do click Accept Answer and Up-Vote for the same. And, if you have any further query do let us know.

0 Votes 0 ·