pull out info on who remove vm from inventory

[drivera01]

Is there a way to get the information from vcenter on a particular VM that was removed from vcenter... I would like to know when and who did it..if possible

thanks

[LucD]

You can try the Get-VIEvent cmdlet and look for the removal event.

See Alan's PowerCLI: One-liners last 10 VMs created and removed

[drivera01]

i tried Alan's one-liner but unfortunately it did not pick it up, it does not appear to go back far enough. From the timestamps on the files that make up the VM, it appears it was shut down/removed around 6/7/2013, just over a month ago.

bummers....

[mattandes]

For the Get-VIEvent cmdlt there is a MaxSamples options. In the one liners that LucD references they are set to 10000. You can use the following to pull and maximum possible events from your vCenter.

Get-VIEvent -MaxSamples ([int]::MaxValue)

There is one catch with this though. Event data will only go back as far as what your retention policy in vCenter is set to regardless of the MaxSamples number.

[LucD]

If you know the approximate timeframe in which the event has occurred, you might have a go at my Get-VIEventPlus function (see Get the vMotion/svMotion history).

It also allows you to look for a specific type of event.

Should make it a lot easier (and faster)