# Read-only Azure exports, 2026-11-01

Exported at 2026-11-01 ~03:05Z with `_tools/azure_probe/azlite.py` (`blob-get`, `la-export`, `activity-log`) under
admin@saifbrand.com, after a device-code sign-in. Nothing was started, written or changed in Azure: the VM stayed
deallocated (`vm-status` before the exports: "Provisioning succeeded", "VM deallocated").

| File | Source | What it shows |
|---|---|---|
| `cumulative-usage.json` | Blob `scraper-test/probe/cumulative-usage.json`, byte for byte | 2 executions, 1 + 3 = **4 Oxylabs jobs of 15**; 11 left |
| `log-analytics-shifullahscraper-events.json` | workspace `shif1021-logs` (customerId 3068ae2d-60a8-4bdd-b4f5-3396f9e9d4d8), the query in the file | the complete API answer, every column, untruncated: **18 rows** from Source ShifullahScraper, 2026-10-22 to 2026-10-30 |
| `log-analytics-shifullahscraper-events.csv` | same rows as CSV | |
| `log-analytics-table-summary.*` | `search *` summarized by table, 2026-10-20 to 2026-11-01 | Event 91, Heartbeat 296, Usage 18 rows; last row 2026-10-30T03:37Z (the VM has been off since) |
| `activity-log-vm.json` | Azure Activity Log for `shif1021-vm`, 2026-10-20 to 2026-11-01 | 230 management events. `claims` and `httpRequest` (sign-in token claims, client IP addresses) were removed; nothing else changed |
| `activity-log-vm-summary.csv` | from the file above | the 48 succeeded start / deallocate / runCommand / write operations with time and caller |

The 18 ShifullahScraper events:

| UTC | Event | Meaning |
|---|---|---|
| 10-22 02:54 | 999 | event source created (setup check) |
| 10-22 03:00 – 10-23 11:23 | 1000 / 1003 | earlier direct-site attempts (before Oxylabs). Each 1003 appears as two identical rows (every column equal, same TimeGenerated); the workspace holds both and the export keeps them as they are |
| 10-27 03:08:54 / 03:08:56 / 03:08:57 | 1200 / 1201 / 1100 | probe v2.2.13: start, end (exit 2, Oxylabs HTTP 401 on job 1), evidence uploaded (7 files, read-back OK) |
| 10-30 03:31:15 / 03:31:25 / 03:31:27 | 1200 / 1201 / 1100 | probe v2.2.14: start, end (exit 2, 15002 then 400), evidence uploaded (11 files, read-back OK) |

VM operations around the probes (from `activity-log-vm-summary.csv`):

| UTC | Operation | Caller |
|---|---|---|
| 10-27 03:05:12 | start | admin@saifbrand.com |
| 10-27 03:09:13 | runCommand (the probe session) | admin@saifbrand.com |
| 10-27 05:00:29 | deallocate | the auto-shutdown schedule (a631e391-…), ~1 h 51 min after the session; reported on Oct 28 |
| 10-28 03:03:39 | deallocate | admin@saifbrand.com (confirmation on an already deallocated VM) |
| 10-29 00:02 – 00:10 | start, 3 × runCommand, deallocate | the holder's account |
| 10-30 03:08:32 / 03:10:33 / 03:17:04 | start, runCommand, deallocate | attempt 1 (session script stopped before the probe, 0 jobs) |
| 10-30 03:19:02 / 03:19:59 / 03:26:33 | start, runCommand, deallocate | attempt 2 (stopped before the probe, 0 jobs) |
| 10-30 03:30:04 / 03:31:31 / 03:38:30 | start, runCommand, deallocate | attempt 3 (the probe: 3 jobs) |

No VM start since 2026-10-30T03:38:30Z.