ESXi

 View Only

  • 1.  To find out VM activities

    Broadcom Employee
    Posted Jan 29, 2011 10:21 AM

    Hi All,

    There was a VM powered down but I need to know who powered down it. When checked in the Tasks/Events in vCenter there is no userID given. Is there any way to find out who powered down the VM. It was powered down 3 days back.

    The Task says "VM was powered down in this host" but no UserID.....I checked in the vCenter logs too but no joy.

    Can someone suggest please?

    Thanks

    Nicky



  • 2.  RE: To find out VM activities

    Posted Jan 29, 2011 10:56 AM

    Under vCenter task you will see the user (initiated by...).

    Andre



  • 3.  RE: To find out VM activities

    Broadcom Employee
    Posted Feb 07, 2011 06:51 AM

    Thanks Andre,

    It is not showing anything over there. Could it be possible the VM is powered ON or OFF by DRS?

    Thanks



  • 4.  RE: To find out VM activities
    Best Answer

    Posted Feb 07, 2011 06:58 AM

    It could be that the VM was shutdown inside from the guest. In that case you won't see any vCenter logs. Please chack your system logs to if this is the case.



  • 5.  RE: To find out VM activities

    Posted Feb 08, 2011 05:52 AM

    It is not showing anything over there. Could it be possible the VM is powered ON or OFF by DRS?

    No. Neither DRS or DPM will power off a VM.

    As written it's probably a guest user operation.

    Andre



  • 6.  RE: To find out VM activities

    Posted Feb 07, 2011 08:58 AM

    Have you had a look in your windows logs?

    If the OS was shut down from within the OS via RDP etc, VMWare would have no way of intrecepting the request.

    If not 'shut down' at least look for the logs where all the services are shutting themselves down and then the security logs to determine who was last logged on.

    Unfortunately though . . various tools do allow users to send remote shutdowns to Windows hosts . . .

    good luck