Orphaned VM

[VMWareNewbie]

We have a vm that was orphaned last night. I looked at the tasks and events and there were some activites on the host. But nothing that would delete the directory of the vm in question. Does anyone know what directory I can look at the host level where it would show activities for console deletion of the directory? I did a history command and it did not show any rm commands.

[admin]

Have you checked with the datastore browser (or ls from the console) that the files are actually gone?

The only record of Service Console commands will be in /var/log/secure, and that will only be if you use sudo. VC logs should have comprehensive a list of events so might be worth checking those (on the VC server).

[VMWareNewbie]

Thanks for the response. Yes I have confirmed the files are gone. All files related to the vm. I looked at the secure logs and it only showed who authenticated. But the vc logs does not show anyone deleting anything during that time.

[admin]

Unfortunately if you haven't implemented SUDO usage on your service console you may never be able to find out what happened, no root actions are logged apart from login. Did anyone log in around the time thf iles went missing? Have a look in the VC logs to determine when the Vm state changed to orphaned and go from there.

[VMWareNewbie]

We use platespin to migrate physical to virtuals. And it uses root to log on the host. So there were activites during the time it was removed. We know when the files were removed, we just don't know how it was removed.

Thanks for all the info you have provided so far.