VMware Cloud Community
PorzioM
Contributor
Contributor
Jump to solution

vCenter Session History?

is there a way to get a history of all users or accounts that have logged into vCenter and when they logged in? I know I can view currently logged in sessions in Administration -> Sessions. where can I see the historical log of who logged in when? Thanks

Mike P.

0 Kudos
1 Solution

Accepted Solutions
lamw
Community Manager
Community Manager
Jump to solution

Yes, there's two ways:

1) scrape the vpxd.logs of your vCenter Server, take a look at this blog post http://www.virtuallyghetto.com/2010/12/how-to-identify-origin-of-vsphere-login.html

2) using the vSphere API, you can search on particular events such as a login or logout http://vijava.sourceforge.net/vSphereAPIDoc/ver5/ReferenceGuide/vim.event.SessionEvent.html

Here is a vSphere SDK for Perl script that looks for VM creation events, but you can easily modify it to substitute UserLoginSessionEvent and UserLogoutSessionEvent events - http://communities.vmware.com/docs/DOC-10773

Note, the available information is based on how far back you're keeping  your vCenter DB stats, if you're only keeping 3months worth, then you'll  only have events going back that far. If you archive or backup your  vpxd.log, you maybe able to go back farther in your history.

Here is an example script execution:

vi-admin@scofield:~> ./queryVMsCreated.pl --server reflex --username primp
VM                                                                                      | TIME                          | USERNAME
User Administrator@172.30.0.12 logged in                                                | 2010-07-26T22:10:38.906999Z   | Administrator
User Administrator logged out                                                           | 2010-07-26T22:17:22.14Z       | Administrator
User PRIMP-IND\tuan@172.30.0.12 logged in                                               | 2010-07-26T22:22:19.489999Z   | PRIMP-IND\tuan
User root logged out                                                                    | 2010-07-26T22:24:29.176999Z   | root
User PRIMP-IND\tuan@127.0.0.1 logged in                                                 | 2010-07-26T22:25:47.682999Z   | PRIMP-IND\tuan
User root@127.0.0.1 logged in                                                           | 2010-07-27T03:16:42.143Z      | root

View solution in original post

0 Kudos
2 Replies
lamw
Community Manager
Community Manager
Jump to solution

Yes, there's two ways:

1) scrape the vpxd.logs of your vCenter Server, take a look at this blog post http://www.virtuallyghetto.com/2010/12/how-to-identify-origin-of-vsphere-login.html

2) using the vSphere API, you can search on particular events such as a login or logout http://vijava.sourceforge.net/vSphereAPIDoc/ver5/ReferenceGuide/vim.event.SessionEvent.html

Here is a vSphere SDK for Perl script that looks for VM creation events, but you can easily modify it to substitute UserLoginSessionEvent and UserLogoutSessionEvent events - http://communities.vmware.com/docs/DOC-10773

Note, the available information is based on how far back you're keeping  your vCenter DB stats, if you're only keeping 3months worth, then you'll  only have events going back that far. If you archive or backup your  vpxd.log, you maybe able to go back farther in your history.

Here is an example script execution:

vi-admin@scofield:~> ./queryVMsCreated.pl --server reflex --username primp
VM                                                                                      | TIME                          | USERNAME
User Administrator@172.30.0.12 logged in                                                | 2010-07-26T22:10:38.906999Z   | Administrator
User Administrator logged out                                                           | 2010-07-26T22:17:22.14Z       | Administrator
User PRIMP-IND\tuan@172.30.0.12 logged in                                               | 2010-07-26T22:22:19.489999Z   | PRIMP-IND\tuan
User root logged out                                                                    | 2010-07-26T22:24:29.176999Z   | root
User PRIMP-IND\tuan@127.0.0.1 logged in                                                 | 2010-07-26T22:25:47.682999Z   | PRIMP-IND\tuan
User root@127.0.0.1 logged in                                                           | 2010-07-27T03:16:42.143Z      | root
0 Kudos
PorzioM
Contributor
Contributor
Jump to solution

is there a way to do your pear script in PowerCLI instead?

0 Kudos