Why Azure Advisor stopped telling how many days disks have been detached

Hello Anil Kumar,

Greetings! Welcome to Microsoft Q&A Platform.

Azure Advisor no longer natively provides the exact timestamp for when a disk was detached. However, you can use Azure Activity Logs to trace back to when a disk was detached. The Activity Log contains events related to all the operations on your resources, including when disks are detached from virtual machines.

Logic:

When the disk is unattached there is an activity log created with Action Create / Update disk. You can view this in the Activity log of the disk.

Note: For all the unattached disks there was final **Create or Update ** Event like below around the same time when the disk was unattached.

So, once we identify the disks that are unattached (managed by eq null). We can query activity log of the unattached disks for the for say X days. if there are no logs created in the X days - we can safely assume the disk was unattached prior to those X days. If you find events/logs during the period X days - then the disk was unattached recently.

Implementation:

You can manually do this in the portal. Identify the disks by following this article (https://video2.skills-academy.com/en-us/azure/virtual-machines/disks-find-unattached-portal#unmanaged-disks-find-and-delete-unattached-disks)

Filter for the Timespan for an unattached disk

Alternatively, if you are looking for options to delete disks that have been unattached you can refer through the article:

• https://video2.skills-academy.com/en-us/azure/virtual-machines/windows/find-unattached-disks (Powershell) reference thread.
• https://video2.skills-academy.com/en-us/azure/virtual-machines/disks-find-unattached-portal (Portal)

However, the above will not help in identifying the days for which it has been unattached.

If you have more number of detached disks in Azure and want to identify them easily and not manually, try the below snippet that makes use of the REST API to get the log activity which does the above activity programmatically.

Note: try Get-Azlog commandlet which did not return the results - possibility that it is making use of the Stable version of the API. This action is achievable only in the preview version of the API - per checking.

#Got the token by running Connect-AzAccount and running the below code. But you can use a better approach  
$token = (Get-AzAccessToken).Token  
  
$subscriptionid = "<YourSUBSID>"  
  
#Getting all the disks in your Subscription  
$disks = Invoke-RestMethod -Method Get -Uri "https://management.azure.com/subscriptions/$subscriptionid/providers/Microsoft.Compute/disks?api-version=2020-12-01" -Headers @{"Authorization"="Bearer $token"}  
  
#Getting the unattached disks from the above list   
$unattacheddisks = $disks.value |  ? {$_.managedBy -eq $null }  
  
foreach ($disk in $unattacheddisks)  
{  
$resourceid = $disk.id  
  
#eventTimestamp is between 2021-05-09 to 2021-06-09  - You can generate a time stamp dynamically for smaller or a larger time span.   
$filter = "eventTimestamp ge '2021-05-09T17:59:08Z' and eventTimestamp le '2021-06-09T17:59:08Z' and eventChannels eq 'Admin, Operation' and resourceId eq '$resourceid' and levels eq 'Critical,Error,Warning,Informational'"  
  
#Getting the Activity logs.This is the  preview API  
$log= Invoke-RestMethod -Uri "https://management.azure.com/subscriptions/  $subscriptionid/providers/microsoft.insights/eventtypes/management/values?api-version=2017-03-01-preview&`$filter=$filter"  -Headers @{"Authorization"="Bearer $token"}  
  
#if there is no log returned - no activity  
if($log.value.Count -eq 0 )  
{  
Write-Host $disk.name + " : - There is no activitiy in 30 days" -ForegroundColor Yello  
}  
else  
{  
Write-Host $disk.name + " : - There is  activitiy in 30 days" -ForegroundColor Green  
}  
}

Output :

Hope this answer helps! Please let us know if you have any further queries. I’m happy to assist you further.

Please "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.