To find out VM activities

[virtualdive]

Hi All,

There was a VM powered down but I need to know who powered down it. When checked in the Tasks/Events in vCenter there is no userID given. Is there any way to find out who powered down the VM. It was powered down 3 days back.

The Task says "VM was powered down in this host" but no UserID.....I checked in the vCenter logs too but no joy.

Can someone suggest please?

Thanks

Nicky

[AndreTheGiant]

Under vCenter task you will see the user (initiated by...).

Andre

[virtualdive]

Thanks Andre,

It is not showing anything over there. Could it be possible the VM is powered ON or OFF by DRS?

Thanks

[npeter · Accepted solution]

It could be that the VM was shutdown inside from the guest. In that case you won't see any vCenter logs. Please chack your system logs to if this is the case.

[bulletprooffool]

Have you had a look in your windows logs?

If the OS was shut down from within the OS via RDP etc, VMWare would have no way of intrecepting the request.

If not 'shut down' at least look for the logs where all the services are shutting themselves down and then the security logs to determine who was last logged on.

Unfortunately though . . various tools do allow users to send remote shutdowns to Windows hosts . . .

good luck

[AndreTheGiant]

It is not showing anything over there. Could it be possible the VM is powered ON or OFF by DRS?

No. Neither DRS or DPM will power off a VM.

As written it's probably a guest user operation.

Andre