- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How can I find out who created this VMware snapshot on ESXi through PuTTY? Please help.
How can I find out who created this VMware snapshot on ESXi through PuTTY? Please help.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
you can do a log review of /var/run/log/hostd.log on the ESXi host and check if the logs do still cover the snapshot event. Usually it should note the executing user in the log message.
You can check the vmware.log of the VM directory possibly to find out a timeframe when a snapshot was performed.
Depending on how much is occurring on the host and how long ago this snapshot was created, the logs might already have rolled over. You can fallback to your syslog server, if configured, and get older logs from there.
Hope this helps.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
log files that can be helpful for your scenario are hostd.log (host level), vmkernel.log (host level), and vmware.log (VM level). I recommend using Log Insight for collecting all logs in your vSphere environment. By Log Insight, you can create different dashboards to visualize your logs and search among all types of log files in your vSphere environment.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ssh to the ESXi
cd /vmfs/volumes/<datastore>/VM-Name/
ls -l *.vmsn
cat <snapshot-file-name>.vmsn
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Example pls