<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Query to see what ID powered off a VM in VMware Aria Operations for Logs Discussions</title>
    <link>https://communities.vmware.com/t5/VMware-Aria-Operations-for-Logs/Query-to-see-what-ID-powered-off-a-VM/m-p/2982744#M2890</link>
    <description>&lt;P&gt;&lt;a href="https://communities.vmware.com/t5/user/viewprofilepage/user-id/1875901"&gt;@Bruticusmaximus&lt;/a&gt;,&lt;/P&gt;&lt;P&gt;Not a defined query as such, but yes you could use the filters to choose Virtual machines and then search for 'shutdown' keyword to look for the logs with shutdown message.&lt;BR /&gt;&lt;BR /&gt;Here's the link to few search query examples.&lt;/P&gt;&lt;P&gt;&lt;A href="https://docs.vmware.com/en/vRealize-Log-Insight/8.10/com.vmware.log-insight.user.doc/GUID-F494F057-33AF-4378-B5C7-6236EA041679.html" target="_blank"&gt;https://docs.vmware.com/en/vRealize-Log-Insight/8.10/com.vmware.log-insight.user.doc/GUID-F494F057-33AF-4378-B5C7-6236EA041679.html&lt;/A&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
    <pubDate>Thu, 17 Aug 2023 16:13:25 GMT</pubDate>
    <dc:creator>Shen88</dc:creator>
    <dc:date>2023-08-17T16:13:25Z</dc:date>
    <item>
      <title>Query to see what ID powered off a VM</title>
      <link>https://communities.vmware.com/t5/VMware-Aria-Operations-for-Logs/Query-to-see-what-ID-powered-off-a-VM/m-p/2982716#M2889</link>
      <description>&lt;P&gt;Is there a log insight query I can use to see who shut down a VM? I don't use Log Insight a lot.&amp;nbsp; We have a VM that keeps shutting down.&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Thu, 17 Aug 2023 14:11:46 GMT</pubDate>
      <guid>https://communities.vmware.com/t5/VMware-Aria-Operations-for-Logs/Query-to-see-what-ID-powered-off-a-VM/m-p/2982716#M2889</guid>
      <dc:creator>Bruticusmaximus</dc:creator>
      <dc:date>2023-08-17T14:11:46Z</dc:date>
    </item>
    <item>
      <title>Re: Query to see what ID powered off a VM</title>
      <link>https://communities.vmware.com/t5/VMware-Aria-Operations-for-Logs/Query-to-see-what-ID-powered-off-a-VM/m-p/2982744#M2890</link>
      <description>&lt;P&gt;&lt;a href="https://communities.vmware.com/t5/user/viewprofilepage/user-id/1875901"&gt;@Bruticusmaximus&lt;/a&gt;,&lt;/P&gt;&lt;P&gt;Not a defined query as such, but yes you could use the filters to choose Virtual machines and then search for 'shutdown' keyword to look for the logs with shutdown message.&lt;BR /&gt;&lt;BR /&gt;Here's the link to few search query examples.&lt;/P&gt;&lt;P&gt;&lt;A href="https://docs.vmware.com/en/vRealize-Log-Insight/8.10/com.vmware.log-insight.user.doc/GUID-F494F057-33AF-4378-B5C7-6236EA041679.html" target="_blank"&gt;https://docs.vmware.com/en/vRealize-Log-Insight/8.10/com.vmware.log-insight.user.doc/GUID-F494F057-33AF-4378-B5C7-6236EA041679.html&lt;/A&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Thu, 17 Aug 2023 16:13:25 GMT</pubDate>
      <guid>https://communities.vmware.com/t5/VMware-Aria-Operations-for-Logs/Query-to-see-what-ID-powered-off-a-VM/m-p/2982744#M2890</guid>
      <dc:creator>Shen88</dc:creator>
      <dc:date>2023-08-17T16:13:25Z</dc:date>
    </item>
    <item>
      <title>Re: Query to see what ID powered off a VM</title>
      <link>https://communities.vmware.com/t5/VMware-Aria-Operations-for-Logs/Query-to-see-what-ID-powered-off-a-VM/m-p/2983085#M2891</link>
      <description>&lt;P&gt;If you don't absolutely have to use Log Insight to find this information, couldn't you easily just check the Tasks of the VM that is being shutdown and look for the "&lt;SPAN&gt;Initiate guest OS shutdown" task and what account is listed for it in the Initiator column?&lt;/SPAN&gt;&lt;/P&gt;</description>
      <pubDate>Sun, 20 Aug 2023 02:48:30 GMT</pubDate>
      <guid>https://communities.vmware.com/t5/VMware-Aria-Operations-for-Logs/Query-to-see-what-ID-powered-off-a-VM/m-p/2983085#M2891</guid>
      <dc:creator>swint</dc:creator>
      <dc:date>2023-08-20T02:48:30Z</dc:date>
    </item>
    <item>
      <title>Re: Query to see what ID powered off a VM</title>
      <link>https://communities.vmware.com/t5/VMware-Aria-Operations-for-Logs/Query-to-see-what-ID-powered-off-a-VM/m-p/2983945#M2892</link>
      <description>&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="FredGSanford_0-1692968446599.png" style="width: 400px;"&gt;&lt;img src="https://communities.vmware.com/t5/image/serverpage/image-id/103198iECEED19EBD2F0638/image-size/medium/is-moderation-mode/true?v=v2&amp;amp;px=400" role="button" title="FredGSanford_0-1692968446599.png" alt="FredGSanford_0-1692968446599.png" /&gt;&lt;/span&gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Fri, 25 Aug 2023 13:01:21 GMT</pubDate>
      <guid>https://communities.vmware.com/t5/VMware-Aria-Operations-for-Logs/Query-to-see-what-ID-powered-off-a-VM/m-p/2983945#M2892</guid>
      <dc:creator>FredGSanford</dc:creator>
      <dc:date>2023-08-25T13:01:21Z</dc:date>
    </item>
  </channel>
</rss>

