Who created these VM snapshots???

[MarkStrong]

I am sure you have been in a situation where there are a lot of old, unidentifiable virtual machine snapshots and no one takes responsibility for creating them. How would you deal with all these “pre install”, “upgrade” or any other meaningless snapshot names without description?

Well, it is easy to find out when snapshot was taken ( Get-VM | Get-Snapshot | Select-Object VM, Name, SizeMB, Created ) but how to identify, name and shame users who created them?

Depending on vCenter Event database retention policy, the username might not be available – the Create VM snapshot event has already been purged.
Check the Database Retention Policy configuration: Administration / vCenter Server Settings / Database Retention Policy / Tasks retained for X days, Events retained for X days.

Here is the script that gets a list of virtual machine snapshots and users who created them:

  #

foreach ($snap in Get-VM | Get-Snapshot)

{$snapevent = Get-VIEvent -Entity $snap.VM -Types Info -Finish $snap.Created -MaxSamples 1 | Where-Object {$_.FullFormattedMessage -imatch 'Task: Create virtual machine snapshot'}

if ($snapevent -ne $null){Write-Host ( "VM: "+ $snap.VM + ". Snapshot '" + $snap + "' created on " + $snap.Created.DateTime + " by " + $snapevent.UserName +".")}

else {Write-Host ("VM: "+ $snap.VM + ". Snapshot '" + $snap + "' created on " + $snap.Created.DateTime + ". This event is not in vCenter events database")}}

#

Output result example:

VM: DC2DC001. Snapshot 'pre-5.1.2upgrade' created on 28 July 2013 07:10:26 by vStrong.info\win8user.
VM: DC1DC001. Snapshot 'pre 5.1.2a upgrade' created on 28 July 2013 07:51:24 by vStrong.info\win7user.
VM: DC2APP001. Snapshot 'pre-fix' created on 02 August 2012 14:29:19. This event is not in vCenter events database

http://www.vstrong.info/2013/08/20/who-created-these-vm-snapshots/