Determine when / how a VM was deleted

[schmidwi]

I have a user of my ESX environment (vSphere4) that cannot find a VM. I have looked and cannot find it in any inventory. This leads me to believe it was deleted either by myself, another administrator, or the VM owner or someone else with permission to delete.

Is there anyway to determine when / how the VM was deleted? Is this information in the logs somewhere? Would it be in vCenter logs, ESX logs, or where would I be able to find this? HOw far back would the logs go?

Thanks.

[vmroyale]

Hello.

Check the Tasks & Events tab in vCenter. First, go to the Edit -> Client Settings dialog and click the Lists tab and change Page Size to 1000.

Good Luck!

[lamw]

Here's a script that can assist with this, assuming the data is still there -

This script just looks at the events as already suggested

=========================================================================

William Lam

VMware vExpert 2009

VMware ESX/ESXi scripts and resources at:

Twitter: @lamw

VMware Code Central - Scripts/Sample code for Developers and Administrators

VMware Developer Community

If you find this information useful, please award points for "correct" or "helpful".

[hamistao]

I am not able to access the said script, probably bacause it has been so long that the endpoint was updated. If you see this and by some miracle remember the script, i would appreciate it a lot if you could send it to me.

[jsm79]

That script was posted 13 years ago. With the changes to vSphere since then, it may not even work anymore...

[lamw]

Please see https://williamlam.com/2021/01/quick-tip-how-to-retrieve-deleted-vm-history.html

While vSphere has had many updates, the underlying API for this particular area (also for many) hasn't changed for over 2 decades 

The beauty of backwards compatibility 😉

[jsm79]

Good to know, William! And btw, I've used your website many times. It has proven to be a valuable resource. Most recently the "Quick Tip - Automating ESXi 8.0 install using allowLegacyCPU=true" article. So thanks again!