Find Deleted VM Information

[Narkis]

Hi Dudes,

In my environement some one has deleted a VM and I don't have no clue who has deleted the VM. I need to find who has deleted and when it was done. Setup has ESX 3.5 and VC 2.5.Your help much appreciated. Cheers!

[VladN]

Look in Events/Tasks for these records:

[lamw]

Take a look at this script:

=========================================================================

William Lam

VMware vExpert 2009

VMware ESX/ESXi scripts and resources at:

VMware Code Central - Scripts/Sample code for Developers and Administrators

If you find this information useful, please award points for "correct" or "helpful".

[Narkis]

Hi Lam,

Thanks & sorry for my belated reply , I executed the script and it prmpting for delted VM name but it didn't return any result. Can you please tell me how to do further? I used VMware toolkit . Cheers!

[CB1]

William,

I'm in desperate need to figure out who deleted a VM. The script that you posted. I'm sorry but I'm not a guru so I''m a little lost.

Where do I actually run this script? What tool do i Use?

thanks for help

[ctrople]

I think the script uses the VMware SDK for Perl.

http://communities.vmware.com/community/developer/forums/vsphere_sdk_perl

There's a chance the event for the VM being deleted may have already rolled off the vCenter server.

Have you already tried going into vCenter, selecting the highest level in the tree and searching from the Events tab?

Depending on what the user did (remove or delete), you should see one of the following messages:

• Task: Destroy Virtual Machine

• Removed <vm name> on <host> from <datacenter>

If you can't find it in vCenter events, chances are the events have already rolled off and the script won't return anything either.

======================================

Chyna Trople, VCP

Monitor. Correlate. Act. | vWire.com

[lamw]

Agreed with ctrople response, if it's not in vCenter events, then it probably rolled over. I'm not sure how many admins have access to delete VM(s) but might be worth a shot to send an email out to see if anyone care to claim responsibility

Sorry couldn't be of more help

=========================================================================

William Lam

VMware vExpert 2009

VMware ESX/ESXi scripts and resources at:

VMware Code Central - Scripts/Sample code for Developers and Administrators

VMware Developer Comuunity

Twitter: @lamw

If you find this information useful, please award points for "correct" or "helpful".

[skywalkr]

Since as a non-SQL expert, I just had to do this..

On a vSphere 5.x setup.. here's the query I ran after selecting the vCS database..

select task_id, parent_task_id, start_time, username, complete_time, entity_name, descriptionid, complete_state from VPX_TASK
where ENTITY_NAME='MyVMName'

in the output  window,  look for the descriptionid -> vim.VirtualMachine.destroy = DELETED FROM DISK = It is history / gone...

based on --> http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=200907...

Cheers.