Get API Satellite activities in VIEvent

[Pocodeyo]

Hi All,

I have a question regarding activities by accounts (Mostly AD accounts).

I can get activities of users that are accessing via VMRC.

Get-VIEvent -Entity $VMSQ -MaxSamples 10 | Where-Object {$_.TicketType -eq "mks"} | Select-Object UserName, @{N='VM';E={$_.Vm.Name}}, CreatedTime

Get-VIEvent -Entity $VMSQ -MaxSamples 10 | Where-Object {$_.TicketType -eq "webmks"} | Select-Object UserName, @{N='VM';E={$_.Vm.Name}}, CreatedTime

I would like to get/catch the activities of accounts that are making use of API call, like Satellite.

What is the correct string that I need to use?

Many thanks in advance.

Kind regards,

Roberto

[LucD · Accepted solution]

I assume that you are referring to the Red Hat Satellite application that provisions and configures vSphere VMs?

If yes, there will not be a general event for an API call.

Instead, there will be events for the provisioning and configuring API calls, like for example VmCreatedEvent.

To find out if this is for a call from the Satellite app, you will need to look at the VM that hosts the Satellite app.

Assume your Red Hat machine with the Satellite app is a VM with the name RDSatellite, then you could do

$vm = Get-VM -Name RHSatellite

Get-VIEvent -Entity $vm -Start (Get-Date).AddMinutes(-15) -MaxSamples([int]::MaxValue)

Once you have the events you could have a look at what type of events are generated by which API call.

$vm = Get-VM -Name RHSatellite

Get-VIEvent -Entity $vm -Start (Get-Date).AddMinutes(-15) -MaxSamples([int]::MaxValue) |

Group-Object -Property {$_.GetType().Name}

From the events you can then select the once you want to monitor.

[Pocodeyo]

Hi Luc,

Many thanks for helping me out.

I indeed was searching for an general event.

This lead/advise will help me.

Cheers,

Roberto