is there a way to get a history of all users or accounts that have logged into vCenter and when they logged in? I know I can view currently logged in sessions in Administration -> Sessions. where can I see the historical log of who logged in when? Thanks
Mike P.
Yes, there's two ways:
1) scrape the vpxd.logs of your vCenter Server, take a look at this blog post http://www.virtuallyghetto.com/2010/12/how-to-identify-origin-of-vsphere-login.html
2) using the vSphere API, you can search on particular events such as a login or logout http://vijava.sourceforge.net/vSphereAPIDoc/ver5/ReferenceGuide/vim.event.SessionEvent.html
Here is a vSphere SDK for Perl script that looks for VM creation events, but you can easily modify it to substitute UserLoginSessionEvent and UserLogoutSessionEvent events - http://communities.vmware.com/docs/DOC-10773
Note, the available information is based on how far back you're keeping your vCenter DB stats, if you're only keeping 3months worth, then you'll only have events going back that far. If you archive or backup your vpxd.log, you maybe able to go back farther in your history.
Here is an example script execution:
vi-admin@scofield:~> ./queryVMsCreated.pl --server reflex --username primp
VM | TIME | USERNAME
User Administrator@172.30.0.12 logged in | 2010-07-26T22:10:38.906999Z | Administrator
User Administrator logged out | 2010-07-26T22:17:22.14Z | Administrator
User PRIMP-IND\tuan@172.30.0.12 logged in | 2010-07-26T22:22:19.489999Z | PRIMP-IND\tuan
User root logged out | 2010-07-26T22:24:29.176999Z | root
User PRIMP-IND\tuan@127.0.0.1 logged in | 2010-07-26T22:25:47.682999Z | PRIMP-IND\tuan
User root@127.0.0.1 logged in | 2010-07-27T03:16:42.143Z | root
Yes, there's two ways:
1) scrape the vpxd.logs of your vCenter Server, take a look at this blog post http://www.virtuallyghetto.com/2010/12/how-to-identify-origin-of-vsphere-login.html
2) using the vSphere API, you can search on particular events such as a login or logout http://vijava.sourceforge.net/vSphereAPIDoc/ver5/ReferenceGuide/vim.event.SessionEvent.html
Here is a vSphere SDK for Perl script that looks for VM creation events, but you can easily modify it to substitute UserLoginSessionEvent and UserLogoutSessionEvent events - http://communities.vmware.com/docs/DOC-10773
Note, the available information is based on how far back you're keeping your vCenter DB stats, if you're only keeping 3months worth, then you'll only have events going back that far. If you archive or backup your vpxd.log, you maybe able to go back farther in your history.
Here is an example script execution:
vi-admin@scofield:~> ./queryVMsCreated.pl --server reflex --username primp
VM | TIME | USERNAME
User Administrator@172.30.0.12 logged in | 2010-07-26T22:10:38.906999Z | Administrator
User Administrator logged out | 2010-07-26T22:17:22.14Z | Administrator
User PRIMP-IND\tuan@172.30.0.12 logged in | 2010-07-26T22:22:19.489999Z | PRIMP-IND\tuan
User root logged out | 2010-07-26T22:24:29.176999Z | root
User PRIMP-IND\tuan@127.0.0.1 logged in | 2010-07-26T22:25:47.682999Z | PRIMP-IND\tuan
User root@127.0.0.1 logged in | 2010-07-27T03:16:42.143Z | root
is there a way to do your pear script in PowerCLI instead?