Identifying unused VMs

[StageCoach20111]

What is the simplest and cheapest way to indentify VMs that have been sitting in your environment taking up space but that users have abandoned?  For example, a user leaves the company with his VM turned on and noone ever uses it again.  It could sit there forever potentially taking up RAM and disk space.  You want to create a report that lists VMs like this.  You don't have to go and track down users.

1.  Is there a way using PowerCLI or information available just in vCenter server to report on memory, CPU, network, storage usage, etc. in such a way as to identify unused VMs?  Or using a free program?  In some cases there could still be services and daemons running - a web server that isn't being hit, an antivirus program that is running it's update and scan schedules, etc.  That makes it more complicated for your report to identify an "unused" VM.   A common characteristic that would be an authoritative indicator of unuse in this case is that no one has logged in to the operating system either through Remote Desktop, ssh, or through vSphere Client for 60 days, but vCenter isn't tracking those events - unless VMware tools can be configured to capture login events and report that info back into vCenter Server?

2.  If this isn't possible and third party paid software is required, what is the cheapest solution and what logic is employed to try to identify with certainty an "unused" VM without contacting the owner?

(Scheduling automatic removal of VMs after a certain time period won't work in this use case).

[Troy_Clavell]

There is a great free appliance that VMTurbo has out that may be something worth looking into

[idle-jam]

vmware vcenter capacity iq has that feature but then it is not free like above ..

[AndreTheGiant]

A little more complicated could be make a script to watch the modified date of vmdk files and generate a report.

Andre

[bulletprooffool]

This may help :

http://www.lucd.info/2009/12/02/raiders-of-the-lost-vmx/

[AureusStone]

For Windows you can run the free utility from Microsoft called "EventComb" and search for the event for either logging in with terminal services or unlocking.

I don't know the event codes off hand, but if you go down this path and have issues working it out let me know and I will see if I can find my old configs.

[sergeadam]

I've been known to b partial to shutting it down and waiting to see if anybody calls. :smileymischief:

[petedr]

Thats always a last resort we have done before, turn it off and see who complains if you are unsure about a VMs user especially in test/dev environments,

[bryansemple]

Unused VMs - VMs that are running, but doing no useful work, are  Zombie's.   Besides an entire organization dedicated to them (www.zombievm.org), these zombie's can be tough to detect.

What we have found,   is that Zombie's tend to operate below these thresholds:

The threshold serves as a starting point, then a lack of deviation over a time period helps to narrow them down further.  The problem, is that even once identified as potential Zombie's, you still need a blood test to check them before blowing them away. This can be by either examining the processes running, or contacting the owner.   Some of the potential Zombies will actual be living VMs in which case you will want to exclude these from future analysis so they don't keep showing up on the potential Zombie list.

You can build scripts to do this.  VKernel makes a module to do this that is not free, but you can try it for 30 days to do a clean up of your Zombies during the trial up to 8 sockets.