Alert from Log Insight for disconnecting Newtwork card from edit setting of vm.

[vmitra]

Hi All,

We need to configure an alert when someone Disconnect the Network Card from Edit Setting of virtual machine , need to know which user done that

also want to know Configuration changes like increase in RAM,CPU,Hard Disk, Add hard disk ,Add Nic

is it possible to create an alert for same from Log Insight or with the help of running any script ??

Please help

[daphnissov]

Yes, this is possible, depending on your version of vSphere because earlier versions don't surface up what exactly changed.

For example, in the below example running in vSphere 6.5 U1, I disconnected a vNIC and found the message captured by vCenter forwarded to vRLI:

You can see what changed, who changed it, and when that occurred. Based on this, you can craft a query into an alert and do whatever you like with it. The highlighted word in the log output is the name of the VM.