Get-AzureRmLog maxevents not honored

[johndehavilland]

Running into a mismatch of behavior with the Get-AzureRmLog cmd and the documentation.

If I run Get-AzureRmLog it seems to return 200 events regardless whether I specify a higher -MaxEvents property. According to the docs, the default is 1000 but that does not seem to be the case.

 PS C:\WINDOWS\system32> $events = Get-AzureRmLog -MaxEvents 1000
WARNING: Deprecation: The field EventChannels from the EventData object is being deprecated since it now returns a constant value (Admin,Operation)

PS C:\WINDOWS\system32> $events.count
200

PS C:\WINDOWS\system32> 
PS C:\WINDOWS\system32> $events = Get-AzureRmLog -StartTime (Get-Date).AddDays(-5)
WARNING: Deprecation: The field EventChannels from the EventData object is being deprecated since it now returns a constant value (Admin,Operation)

PS C:\WINDOWS\system32> $events.count
200

It also seems to, by default just return a days worth of events not an hour like the documentation suggests.

[markcowl]

@gucalder can you take a look?

[johndehavilland]

any updates?

[gucalder]

I am checking the code and, initially, I cannot find any issue with it. I am still testing and will let you know when I am done with the investigation.
That being said, the second all is subset of the first call. The first call will use Now - 7 days as start date and Now as end date. The second call will use Now - 5 days as start date and Now as end date. I do not know if the subscription being queried only had 200 events in the last 5--7 days. MaxEvents is upper bound, if there are less than 1000 (in this case) records, they will be returned regardless of number.

Please try a query like this for the same time period: $events = Get-AzureRmLog -MaxEvents 50
If you still get 200 or even some number other than 50 (knowing that there are 200), then the cmdlet is failing. BTW: this is the kind of tests I am doing now.

I am also checking for the possibility of a regression/bug in the backend, i.e. it is returning only chunks of 200 records and no continuation token. I am also asking around to figure out if there has changed lately. The cmdlet does not do anything to the records returned by the backend, it only follows the continuation token until the there are no more records or the maxEvents is reached, whatever happens first.

Can I have the link to the documentation. There might be some errors there too. This documents are written manually, there might be several versions of them, and there have been changes through time, perhaps we did not update all the places correctly.

[johndehavilland]

so I downloaded the csv of the last week from the portal and in there I see 697 events for the past week. If i run Get-AzureRmEvent I only see 200 events. If I look the timestamp seems to be from 3:07am to 1:07pm.

Running Get-AzureRmLog -MaxEvents 50 returns just 50.

Get-AzureRmLog documentation link.

[gucalder]

The back end is returning the data in 200 record pages.
I found the bug in the cmdlet code. I'll fix it ASAP.
Thanks.

[cormacpayne]

@johndehavilland this fix can be found in version 4.2.0 of Azure PowerShell