Azure Log Analytics - Data Factory - track Linked Service creation-CodePudding

I'm trying to figure out when a Linked Service was added to a Data Factory instance.

We capture all logs and metrics in Log Analytics but so far nothing seems to show when a Linked Service was created.

The closest I've got is querying the Azure Activity table for this ADF querying for Linked Services/Write and the specific Linked service as shown below:

| where OperationNameValue == "MICROSOFT.DATAFACTORY/FACTORIES/LINKEDSERVICES/WRITE
| where Properties contains "Name of my link service"

This is not telling me the info I need, which is to know when this linked service was created. Doing a distinct search on the OperationNameValue does not yield anything else related to Linked Services. Perhaps the data I'm looking for is somewhere else?

Thanks for any help you may provide.

CodePudding user response：

To test this, I have created a ADF, linked service with blob storage and exported the activity logs to one of the log analytics workspaces. Using the below KQL query I am able to pull the linked service creation time and followed by the caller who has created it.

AzureActivity
| where OperationNameValue contains "MICROSOFT.DATAFACTORY/FACTORIES/LINKEDSERVICES/WRITE" and ActivityStatusValue contains "Success"
| extend linkedservicename=tostring(Properties_d["resource"])
| where linkedservicename contains "<pass specific linked servicename>"
| project EventSubmissionTimestamp,_ResourceId,Caller

Here is the sample output for reference:

Alternatively, you can use the below PowerShell cmdlet as well to pull creation time of linked service.

Get-AzActivityLog -StartTime (get-date).AddDays(-90) -EndTime (get-date)| Where-Object {$_.Authorization.Action -like "MICROSOFT.DATAFACTORY/FACTORIES/LINKEDSERVICES/WRITE" -and $_.Status -like "Succeeded" } | Select EventTimestamp,SubmissionTimestamp,Caller,ResourceId| ConvertTo-Json

Here is the sample output of reference: