Getting information on deleted virtual machines

[TheVMinator]

Is is possible to pull information on who deleted a virtual machine or at least when it was deleted by using the logs in vCenter Server?

Thanks

[LucD]

You can use the logic from my Events – Part 4 : Who started that VM ? post but instead look for the VMRemovedEvent

[TheVMinator]

For some reason I'm not getting any results even though I know vms have been deleted - even if I expand the dates back indefinitely - it creates the output file but it has nothing in it.  For some reason it's not picking up the events.  Any ideas?

Get-VIEvent |
where {$_.gettype().Name -eq "VMRemovedEvent"} |  
select @{N="VMname"; E={$_.Vm.Name}},

     @{N="CreatedTime"; E={$_.CreatedTime}}, 
  
     @{N="Host"; E={$_.Host.Name}},

     @{N="User"; E={$_.UserName}} |

   Export-Csv "C:\VM-deleted-audit.csv" -NoTypeInformation -UseCulture

[LucD · Accepted solution]

The Get-VIEvent cmdlet, by default, only returns 100 events.

Use the -MaxSamples parameter with a huge number to see some results.

Get-VIEvent -MaxSamples 99999  |
where {$_.gettype().Name -eq "VMRemovedEvent"} |  
select @{N="VMname"; E={$_.Vm.Name}},

     @{N="CreatedTime"; E={$_.CreatedTime}}, 
     @{N="Host"; E={$_.Host.Name}},

     @{N="User"; E={$_.UserName}} |

   Export-Csv "C:\VM-deleted-audit.csv" -NoTypeInformation -UseCulture

[TheVMinator]

That works great - thanks.  (I promise to go back and award points once they fix the broken "helpful' and "correct" buttons which are broken as of communities website upgrade).