If integrating vSphere with Log Insight, that would probably be the most effective way, because then it would have the log entry for the exact change.
thanks
we must however do a post-incident analysis and log insight was not installed
Surely you can just take a look through tasks and events in the vsphere client?
if not, then check the vpxd.log from vcenter, or the fdm logs on the host. These might give you some further information with timestamps for investigation