Trace user actions - retrieve list of tasks that a user has performed

[ppgdtap]

Our centers are running version 6.5 - how can I query the list of tasks a user (domain\user name) has carried out on a specific date (on any VM in that center).

It is mostly to do with snapshot and power off/on operations but could be on any VM in that center.

I need something like: date and time, task, username...

Thanks

[LucD · Accepted solution]

You could do something like this

$userName = 'domain\user'

$finish = Get-Date

$start = $finish.AddDays(-1)

Get-VIEvent -Start $start -Finish $finish |

   where {$_ -is [VMware.Vim.TaskEvent] -and $_.UserName -eq $userName} |

  Select CreatedTime, UserName, FullFormattedMessage,

@{N = 'Datacenter'; E = {$_.Datacenter.Name}},

@{N = 'Cluster'; E = {$_.ComputeResource.Name}},

@{N = 'VMHost'; E = {$_.Host.Name}},

@{N = 'VM'; E = {$_.VM.Name}},

@{N = 'Datastore'; E = {$_.Ds.Name}}

[ppgdtap]

Thanks,

The cursor moved to the next line but no results are being returned even though VCSA CPU usage increased to 40% and holding at that level.

I'll try restarting the appliance out of hours and trying again...

[LucD]

How did you run the code?
From a .ps1 file?
Or did you copy/paste the code to a PS prompt?
Retrieving events might take some time

[ppgdtap]

copied to ISE, so yes ps1 file, edited the domain account and run it as it for last day.

will give it a go after the vcsa restart. it is 10 hosts / 246 VMs vCenter 4CPUs/16Gb of RAM on vCenter VM but it may need need some love

[LucD]

That can produce quite a bit of events.
Perhaps you better test first with a shorter time interval

[ppgdtap]

Thanks, it did indeed return results eventually.

One more question if I may: do I need to specify maxSamples - I take it because we are specifying start and finish times: I don't have to specify MaxSamples too?

MaxSamples

Int32

Specifies the maximum number of retrieved events. When you do not filter events by time period, the maximum number of retrieved events is set to 100 by default.

[LucD]

Depends, if you use Start and/or Finish, you don't need MaxSamples.
That is what they mean by the 'events by time period'