VM snapshot question

[cyh5470]

Hi all

I found some logs from my vCenter,

all of the guest machines create snapshot and remove it from 3:00 AM.

Created and Removed, Every single one.

I checked the scheduled Tasks, but nothing in here.

I am not sure what happened.

Is this a kind of the special feature or I missed something ??

Thanks for taking a look my question.

[rcporto]

You're using some kind of backup software to take backup of your virtual machines ?

[cyh5470]

We only have appassure for some specific servers and it's agent base on the system ( windows or Linux ).

Those agents, I need to logon the Server and install them one by one.

I never setup anything on vCenter or VM hosts...

[greco827]

Does it say what account initiated the snapshot and/or the deletion?  Do you recognize that account?  Is it a service account?

[cyh5470]

All from ROOT ,

That's why I am thinking this might be kind of the service which I didn't know.....

[Zahori]

Backups?

[cyh5470]

No backup in our vCenter level......

[greco827]

Other than .vmdk level backups via Netbackup or some other backup software, I'm not sure of anything that would create and delete snapshots, and even then it wouldn't be using root more than likely.  Perhaps someone ran a PowerCLI script that did this.  Obviously it would have to be someone with the root password though.  I'd change the password, and not share it right away.  If someone wrote a script, the password change will break it, and that same someone will ask if it changed.

[bansne]

I suggest following checks:

1) Backup configured  --> as confirmed by you no so leaving this

2) What all plugins you see in vCenterPlugins? What you see installed under vCentrer-->Inventory-->Home

3) Create a alarm to trigger for VM with snaphshot , the momment you get alarmed login to any of the ESX goto vmware.log and check what just happened . You could check back date logs too otherwise.

4) You could also check and cross verify datastores if you see any deltas there

5) You could also try checking if you see anytask initiated over vpxa logs too.

[cyh5470]

Thank you guys,

I will try them all

and

let you know if I could find some things....