How to discover who deleted a cluster in Azure portal

Learn how to discover who deleted an Azure Databricks cluster.

Written by Adam Pavlacka

Last published at: October 3rd, 2023

If a cluster in your workspace has disappeared or been deleted, you can identify which user deleted it by running a query in the Log Analytics workspaces service in the Azure portal.



If you do not have an analytics workspace set up, you must configure Diagnostic Logging in Azure Databricks before you continue.

  1. Load the Log Analytics workspaces service in the Azure portal.
  2. Click the name of your workspace.
  3. Click Logs.
  4. Look for the following text: Type your query here or click one of the example queries to start.
  5. Enter the following query:
    | where ActionName == "permanentDelete"
         and Response contains "\"statusCode\":200"
         and RequestParams contains "\"cluster_id\":\"0210-024915-bore731\""  // Add cluster_id filter if cluster id is known
         and TimeGenerated between(datetime("2020-01-25 00:00:00") .. datetime("2020-01-28 00:00:00"))  // Add timestamp (in UTC) filter to narrow down the result.
    | extend id = parse_json(Identity)
    | extend requestParams = parse_json(RequestParams)
    | project,clusterId = requestParams.cluster_id, SourceIPAddress, EventTime=TimeGenerated
  6. Edit the cluster_id as required.
  7. Edit the datetime values to filter on a specific time range.
  8. Click Run to execute the query.

The results (if any) display below the query box.

If you are still unable to find who deleted the cluster, create a support case with Microsoft Support. Provide details such as the workspace id and the time range of the event (including your time zone). Microsoft Support will review the corresponding backend activity logs.

Was this article helpful?