Shulou(Shulou.com)06/03 Report--

This article takes azure as an example to analyze the method of using powershell script to view the user's operation record. Read the complete article, I believe that you have a certain understanding of the use of powershell scripts.

Let's take a look at the contents of the code, which is actually very simple.

Param ([parameter (Mandatory = $false)] [Int] $MaxRecords = 100000, [parameter (Mandatory = $true)] [string] $User) function Write-DateTimeMessage {param ([parameter (Mandatory = $false)] [switch] $Warning, [parameter (Mandatory = $true)] [string] $Message [parameter (Mandatory = $false)] [string] $ForegroundColor) if ($Warning) {Write-Warning ($(Get-Date-UFormat'% Y/%m/%d% HV% MV% S') + "*" + $Message)} else {if ($ForegroundColor) {Write-Host ($(Get-Date-UFormat'% Y /) % m Write-Host% d% UFormat% MRV% S') + "*" + $Message)-ForegroundColor $ForegroundColor} else {Write-Host ($(Get-Date-UFormat'% Y/%m/%d% HV% MV% S') + "*" + $Message)}} [pscustomobject []] $UserObjects = $null$Subscriptions = Get-AzureRmSubscriptionforeach ($subscription in $Subscriptions) ) {"" Querying Subscription: "$SubscriptionID = $Subscription.Id $SubscriptionName = $Subscription.Name Select-AzureRmSubscription-SubscriptionId $SubscriptionID-InformationAction SilentlyContinue Write-DateTimeMessage-Message" Retrieving logs Please wait... "$logs = Get-AzureRmLog-ResourceProvider Microsoft.Compute-StartTime (Get-Date). AddDays (- 90)-Maxrecord $MaxRecords foreach ($log in $logs) {if ($log.caller-eq $User) {$UserObject = New-Object-TypeName psobject $UserObject | Add-Member-MemberType NoteProperty-Name SubscriptionName-Value $SubscriptionName $UserObject | Add-Member-MemberType NoteProperty-Name SubscriptionID-Value $SubscriptionID $UserObject | Add- Member-MemberType NoteProperty-Name ResourceGroup-Value $log.ResourceGroupName $UserObject | Add-Member-MemberType NoteProperty-Name Caller-Value $log.caller $UserObject | Add-Member-MemberType NoteProperty-Name Operation-Value $log.OperationName.Value $UserObject | Add-Member-MemberType NoteProperty-Name ResourceId-Value $log.ResourceId $UserObject | Add-Member-MemberType NoteProperty-Name Time-Value $log.EventTimestamp $UserObjects + = $UserObject}} $OutputPath = Join-Path -Path ([Environment]:: GetFolderPath ("Desktop")-ChildPath ("AzureUserAction-" + $(Get-Date-Format "yyyyMMdd-HHmmss") + ".csv") if ($null-ne $UserObjects) {$UserObjects | Export-Csv-NoTypeInformation-LiteralPath $OutputPath Write-DateTimeMessage-Message "Please check $OutputPath"-Warning} else {Write-DateTimeMessage "Didn't get information Please check "- warning}

Let's try to run the script Get-AzureUserActionLog.ps1-User "xxx@xxx.partner.onmschina.cn". The purpose of-User is that we can filter out specific users based on this parameter.

After the execution of the script, you can see a csv file on the desktop, which records the query log.

As a reminder, due to the limitations of the Azure background, this can only query the log within the last 90 days.

After reading this article, have you learned to use the powershell script to view the user's action record? If you want to learn more skills or want to know more about it, you are welcome to follow the industry information channel. Thank you for reading.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.