Skip to content

Commit 155608a

Browse files
Merge pull request #248598 from davidsmatlak/ds-ghi-113631
Adds links to ARG tables
2 parents 6c4de5b + a5f553f commit 155608a

File tree

1 file changed

+13
-14
lines changed

1 file changed

+13
-14
lines changed

articles/governance/resource-graph/how-to/get-resource-changes.md

Lines changed: 13 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,20 @@
11
---
2-
title: Get resource changes
2+
title: Get resource configuration changes
33
description: Get resource configuration changes at scale
4-
ms.date: 06/16/2022
4+
ms.date: 08/17/2023
55
ms.topic: how-to
66
---
77

88
# Get resource configuration changes
99

1010
Resources change through the course of daily use, reconfiguration, and even redeployment. Most change is by design, but sometimes it isn't. You can:
1111

12-
- Find when changes were detected on an Azure Resource Manager property
13-
- View property change details
14-
- Query changes at scale across your subscriptions, management group, or tenant
12+
- Find when changes were detected on an Azure Resource Manager property.
13+
- View property change details.
14+
- Query changes at scale across your subscriptions, management group, or tenant.
1515

1616
This article shows how to query resource configuration changes through Resource Graph.
1717

18-
1918
## Prerequisites
2019

2120
- To enable Azure PowerShell to query Azure Resource Graph, [add the module](../first-query-powershell.md#add-the-resource-graph-module).
@@ -64,19 +63,19 @@ Each change resource has the following properties:
6463
| `targetResourceId` | The resourceID of the resource on which the change occurred. |
6564
|---|---|
6665
| `targetResourceType` | The resource type of the resource on which the change occurred. |
67-
| `changeType` | Describes the type of change detected for the entire change record. Values are: Create, Update, and Delete. The **changes** property dictionary is only included when `changeType` is _Update_. For the delete case, the change resource will still be maintained as an extension of the deleted resource for 14 days, even if the entire Resource group has been deleted. The change resource won't block deletions or impact any existing delete behavior. |
66+
| `changeType` | Describes the type of change detected for the entire change record. Values are: Create, Update, and Delete. The **changes** property dictionary is only included when `changeType` is _Update_. For the delete case, the change resource is maintained as an extension of the deleted resource for 14 days, even if the entire resource group was deleted. The change resource doesn't block deletions or affect any existing delete behavior. |
6867
| `changes` | Dictionary of the resource properties (with property name as the key) that were updated as part of the change: |
6968
| `propertyChangeType` | This property is deprecated and can be derived as follows `previousValue` being empty indicates Insert, empty `newValue` indicates Remove, when both are present, it's Update.|
7069
| `previousValue` | The value of the resource property in the previous snapshot. Value is empty when `changeType` is _Insert_. |
71-
| `newValue` | The value of the resource property in the new snapshot. This property will be empty (absent) when `changeType` is _Remove_. |
72-
| `changeCategory` | This property was optional and has been deprecated, this field will no longer be available|
70+
| `newValue` | The value of the resource property in the new snapshot. This property is empty (absent) when `changeType` is _Remove_. |
71+
| `changeCategory` | This property was optional and has been deprecated, this field is no longer available. |
7372
| `changeAttributes` | Array of metadata related to the change: |
7473
| `changesCount` | The number of properties changed as part of this change record. |
75-
| `correlationId` | Contains the ID for tracking related events. Each deployment has a correlation ID, and all actions in a single template will share the same correlation ID. |
74+
| `correlationId` | Contains the ID for tracking related events. Each deployment has a correlation ID, and all actions in a single template share the same correlation ID. |
7675
| `timestamp` | The datetime of when the change was detected. |
7776
| `previousResourceSnapshotId` | Contains the ID of the resource snapshot that was used as the previous state of the resource. |
7877
| `newResourceSnapshotId` | Contains the ID of the resource snapshot that was used as the new state of the resource. |
79-
| `isTruncated` | When the number of property changes reaches beyond a certain number they're truncated and this property becomes present. |
78+
| `isTruncated` | When the number of property changes reaches beyond a certain number, they're truncated and this property becomes present. |
8079

8180
## Get change events using Resource Graph
8281

@@ -259,11 +258,11 @@ resourcechanges 
259258

260259
### Best practices
261260

262-
- Query for change events during a specific window of time and evaluate the change details. This query works best during incident management to understand _potentially_ related changes.
261+
- Query for change events during a specific window of time and evaluate the change details. This query works best during incident management to understand _potentially_ related changes.
263262
- Keep a Configuration Management Database (CMDB) up to date. Instead of refreshing all resources and their full property sets on a scheduled frequency, only get what changed.
264263
- Understand what other properties may have been changed when a resource changed compliance state. Evaluation of these extra properties can provide insights into other properties that may need to be managed via an Azure Policy definition.
265-
- The order of query commands is important. In this example, the `order by` must come before the `limit` command. This command order first orders the query results by the change time and then limits them to ensure that you get the five most recent results.
266-
- Resource configuration changes supports changes to resource types from the [Resources table](../reference/supported-tables-resources.md#resources), `resourcecontainers` and `healthresources` table in Resource Graph. Changes are queryable for 14 days. For longer retention, you can [integrate your Resource Graph query with Azure Logic Apps](../tutorials/logic-app-calling-arg.md) and export query results to any of the Azure data stores (such as [Log Analytics](../../../azure-monitor/logs/log-analytics-overview.md) for your desired retention.
264+
- The order of query commands is important. In this example, the `order by` must come before the `limit` command. This command orders the query results by the change time and then limits them to ensure that you get the five most recent results.
265+
- Resource configuration changes support changes to resource types from the Resource Graph tables [resources](../reference/supported-tables-resources.md#resources), [resourcecontainers](../reference/supported-tables-resources.md#resourcecontainers), and [healthresources](../reference/supported-tables-resources.md#healthresources). Changes are queryable for 14 days. For longer retention, you can [integrate your Resource Graph query with Azure Logic Apps](../tutorials/logic-app-calling-arg.md) and export query results to any of the Azure data stores like [Log Analytics](../../../azure-monitor/logs/log-analytics-overview.md) for your desired retention.
267266

268267
## Next steps
269268

0 commit comments

Comments
 (0)