Which VMware Product Can Solve This Efficiently?

[SavkoorSuhas]

I have a vCenter server with a bunch of ESXi and about 500+ VMs. These VMs are being created, deleted, and updated on a frequent basis with over 200+ users. The requirement I have is below:

In a selectable time frame, I want to know:

1. Who created how many VMs
2. Who deleted how many VMs
3. Who has logged in how frequently to a vCenter
4. Who owns the most number of VMs
5. Resource usage by the user 

If these can be available in a tabular + graph that would be excellent. I took a look at vROPS, but I am not sure if that solves these purposes. 

Please suggest if there is any product offering that can do this. Thanks.

[BivasM]

Hi,

Just curious about your environment. Do you have 200 vcenter users that can create a vm?

Here's my few cents about your questions:

1. I am not sure you can do that with an existing set of vm's. maybe moving forward you can trigger a vrops alert that generates a report for you. If your vcenter is above 6.7 it will have vm creation date.

2. maybe create a custom alert for vm deletion.

3. logs can be found here https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.authentication.doc/GUID-7D574459-A9...

4. more of a permission based question. vcenter admin can remove permission from a user. 

5. maybe create vm folder and move a users vm to that folder. then you can get easy view from vcenter.

[SavkoorSuhas]

Yes, if not more than 200.

Does vROPS provide the solution for this use case for VMs and actions going forward? I can gather the current details from powershell maybe as a one-off but a dashboard is preferred. 

I could use log insight for the session creation earlier, but does vROPS track those too? 

I don't need to remove any permissions from a user. There is a huge hierarchy of parent-child folder hierarchy and a count on a user folder level is preferred, and the user folder can come from various parent folders and the various parent folder can be mapped under another set of parent.

[BivasM]

maybe you can generate a custom report from a view in vrops

https://docs.vmware.com/en/vRealize-Operations/8.10/com.vmware.vcom.core.doc/GUID-40D426D2-92D8-4132...

log insight would be better as it would be better for custom queries later, much easier to handle than vrops.

If you dont mind , I was curious about your environment that why do you have so many users creating vm's . 

Are you some kind of managed service provider or is this like a cloud automation requirement where a user can choose to deploy

a vm from an offered template. 

[lamw]

1-4 can be achieved by looking at vCenter Server Events, which provides the Who, What and When for a given type of operation/change within your vSphere environment. From that info, you can then build queries/reports manually by asking vCenter Server via vSphere API or consume these events within vRealize/Aria Operations. This information will be available up to the configured retention period within vCenter Server, meaning you can only go as far as the data is stored in vCenter Server. vRealize/Aria Operations is typically used to provide longer retention period and provide custom dashboard/monitoring capabilities on top of vCenter Server including answering 5 which isn't straight forward as you now need to associate a set of resources to a user then build reports based on that.

For additional context, even for VMs that have been created, you can still go back and query these events and get answers immediately by simply using the vSphere API and here are examples below for 1-4

1. Number of VMs created by user - VM creation can happen in a number of ways beyond just a new VM, see this post https://williamlam.com/2021/01/which-vm-was-this-vsphere-vm-cloned-from.html for more details.

2. Number of VMs deleted by user - See https://williamlam.com/2021/01/quick-tip-how-to-retrieve-deleted-vm-history.html 

3. Logins by user - https://williamlam.com/2016/11/an-update-on-how-to-retrieve-useful-information-from-a-vsphere-login.... 

4. VMs owned by user - You need to define what this means to your organization ... is person who created the owner? If not, then you need a way to associate that and this happens either using custom Change Management Database (CMDB) to some simply using vSphere Tag and naming it "owner" with the value of the actual VM owner. Once you figure out the association, then its easy enough script to build 🙂 

As you can see, these questions and MANY other can all be answered by the power of Events - https://williamlam.com/2019/12/listing-all-events-for-vcenter-server.html and once you understand this concept, you can do MUCH more using Event Driven Automation, such as updating a report when a new VM has been provisioned. For this, I strongly recommend looking at the VMware Event Broker Appliance (VEBA) solution https://vmweventbroker.io/ which provides you a way to do a ton of interesting things using these events along with archiving them to your desired format for offline reporting w/o having to store all VC Events, which is what vRealize/Aria Operations would have to do as it wouldn't know what events you want or do not want. 

Finally, given that your organization/environment allows for over 200+ users to provision workloads, you may want to consider some form of governance/resource management system that gives you a bit more control over resources like Aria Automation