Who made the VM

[jpetschl]

Hello,

Is there or is there not a simple way to find out who in our environment made a specific VM or not? If so, how?

Thanks

[Alex_Romeo]

Hi,

You can understand it from the authentication log file and from the date and time of creation of the VM (date of the vmdk file), analyzing these two data, you can understand who is logged in.

Suppose, however, that if you used administrator@vsphere.local (vCenter) or root (Esxi) user authentication ... it could have been anyone who used that account.

To work around this problem, you need to create accounts per person or use your personal Active Directory account (with the necessary configurations). In this case from the log files, you can see exactly who did and what.

If it can be useful:

https://www.virtuallyghetto.com/2017/06/auditinglogging-vcenter-server-authentication-authorization-...

--------------

ESXi Log File Locations

Authentication

/var/log/auth.log

Contains all events related to authentication for the local system.

VMkernel	/var/log/vmkernel.log	Records activities related to virtual machines and ESXi.
VMkernel warnings	/var/log/vmkwarning.log	Records activities related to virtual machines.

ARomeo

[Alex_Romeo]

Hi,

doing research I found this post by LucD that is right for you:

Get VM's creation date

ARomeo

[IRIX201110141]

Yes, i have a modified Script which search for the VM Created task trough the vCenter events and fill a custom form with that information. If nothing was found it use some Quest AD commandlets to query the windows AD about the computer object (as a fallback).

Iam pretty sure it is based on some of LucD​​ scripts.

Regards,
Joerg