Re: Logs for who did what

Wimo · ‎02-04-2010

If perform a task, say deleting a datacenter object, in the Tasks tab it says what was done and who did it. But where is that actually logged on the VC server, or is it?

vpwd logs say only something like this: -- BEGIN task-45596 -- datacenter-104617 -- vim.ManagedEntity.destroy -- 6F0E0FAD-642F-40B7-B9DF-D9359958F089

Wimo · ‎02-04-2010

Looks like someone else started a thread on this same subject just hours ago (Vcenter Logs). The only answer so far is from Troy, and he seems to be pointing to the very logs which I am saying contain no user detail. So is there in fact no way of telling who did what, once the info disappears from the GUI? The auditors are going to love that!

hicksj · ‎02-04-2010

Those tasks are logged in the database. While they are sometimes hidden from view in the client since the client only displays the events for a short period, they should be able to be mined out of the database.

I run a weekly report (using viperltoolkit) that emails me events that occured, of type:

DrsVmMigratedEvent

VmMigratedEvent

VmCloneEvent

VmPoweredOnEvent

VmRemovedEvent

VmCreatedEvent

RoleUpdatedEvent

RoleRemovedEvent

RoleEvent

RoleAddedEvent

PermissionRemovedEvent

PermissionUpdatedEvent

PermissionEvent

PermissionAddedEvent

I dumped everything from $eventmanager_view->description->eventInfo to get a list of all the event types that were logged. I'm sure something similar could be run directly against the database as well.

The report script I'm using was written by Shawn Kearney: http://communities.vmware.com/servlet/JiveServlet/download/821751-4447/vmeventmgr.pl