VMware Cloud Community
virtualdive
VMware Employee
VMware Employee
Jump to solution

To find out VM activities

Hi All,

There was a VM powered down but I need to know who powered down it. When checked in the Tasks/Events in vCenter there is no userID given. Is there any way to find out who powered down the VM. It was powered down 3 days back.

The Task says "VM was powered down in this host" but no UserID.....I checked in the vCenter logs too but no joy.

Can someone suggest please?

Thanks

Nicky

Regards,

'V'
thevshish.blogspot.in
vExpert-2014-2021
Reply
0 Kudos
1 Solution

Accepted Solutions
npeter
Expert
Expert
Jump to solution

It could be that the VM was shutdown inside from the guest. In that case you won't see any vCenter logs. Please chack your system logs to if this is the case.

-nObLe

View solution in original post

Reply
0 Kudos
5 Replies
AndreTheGiant
Immortal
Immortal
Jump to solution

Under vCenter task you will see the user (initiated by...).

Andre

Andre | http://about.me/amauro | http://vinfrastructure.it/ | @Andrea_Mauro
virtualdive
VMware Employee
VMware Employee
Jump to solution

Thanks Andre,

It is not showing anything over there. Could it be possible the VM is powered ON or OFF by DRS?

Thanks

Regards,

'V'
thevshish.blogspot.in
vExpert-2014-2021
Reply
0 Kudos
npeter
Expert
Expert
Jump to solution

It could be that the VM was shutdown inside from the guest. In that case you won't see any vCenter logs. Please chack your system logs to if this is the case.

-nObLe
Reply
0 Kudos
bulletprooffool
Champion
Champion
Jump to solution

Have you had a look in your windows logs?

If the OS was shut down from within the OS via RDP etc, VMWare would have no way of intrecepting the request.

If not 'shut down' at least look for the logs where all the services are shutting themselves down and then the security logs to determine who was last logged on.

Unfortunately though . . various tools do allow users to send remote shutdowns to Windows hosts . . .

good luck

One day I will virtualise myself . . .
Reply
0 Kudos
AndreTheGiant
Immortal
Immortal
Jump to solution

It is not showing anything over there. Could it be possible the VM is powered ON or OFF by DRS?

No. Neither DRS or DPM will power off a VM.

As written it's probably a guest user operation.

Andre

Andre | http://about.me/amauro | http://vinfrastructure.it/ | @Andrea_Mauro
Reply
0 Kudos