Track user VM shutdown

[mancio]

Hi all.

this morning someone in our datacenter did a shutdown of all VMs in a HA/DR cluster.

I've looked in vcenter events/task and I've found that the command was issued by domain\administrator. Several users use this account.

I've found the remote session ip in vcenter/mob, but I'm unable to match information to find from which IP address has been issued the shutdown command..

How can I find this information?

What I need to know is:

- what command has been issued

- where has it been issued from

- from what IP has been issued the command?

Matteo

[vNEX · Accepted solution]

Hi,

hope this helps:

VMware KB: Determining why a virtual machine was powered off or restarted

http://www.virtuallyghetto.com/2010/12/how-to-identify-origin-of-vsphere-login.html

Get complete vCenter session info - LucD notes

VMware KB: Determining if a High Availability Virtual Machine Monitoring event caused a virtual mach...

Regards,

P.

[mancio]

Get complete vCenter session info - LucD notes ... it's perfect

thanks

Matteo