vCenter

 View Only
  • 1.  VM snapshot question

    Posted Sep 16, 2015 06:00 PM

    Hi all

    I found some logs from my vCenter,

    all of the guest machines create snapshot and remove it from 3:00 AM.

    Created and Removed, Every single one.

    I checked the scheduled Tasks, but nothing in here.

    I am not sure what happened.

    Is this a kind of the special feature or I missed something ??

    Thanks for taking a look my question.



  • 2.  RE: VM snapshot question

    Posted Sep 16, 2015 06:13 PM

    You're using some kind of backup software to take backup of your virtual machines ?



  • 3.  RE: VM snapshot question

    Posted Sep 16, 2015 06:23 PM

    We only have appassure for some specific servers and it's agent base on the system ( windows or Linux ).

    Those agents, I need to logon the Server and install them one by one.

    I never setup anything on vCenter or VM hosts...



  • 4.  RE: VM snapshot question

    Posted Sep 16, 2015 06:29 PM

    Does it say what account initiated the snapshot and/or the deletion?  Do you recognize that account?  Is it a service account?



  • 5.  RE: VM snapshot question

    Posted Sep 16, 2015 06:36 PM

    All from ROOT ,

    That's why I am thinking this might be kind of the service which I didn't know.....



  • 6.  RE: VM snapshot question

    Posted Sep 16, 2015 06:43 PM

    Backups?



  • 7.  RE: VM snapshot question

    Posted Sep 16, 2015 06:49 PM

    No backup in our vCenter level......



  • 8.  RE: VM snapshot question

    Posted Sep 16, 2015 07:17 PM

    Other than .vmdk level backups via Netbackup or some other backup software, I'm not sure of anything that would create and delete snapshots, and even then it wouldn't be using root more than likely.  Perhaps someone ran a PowerCLI script that did this.  Obviously it would have to be someone with the root password though.  I'd change the password, and not share it right away.  If someone wrote a script, the password change will break it, and that same someone will ask if it changed.



  • 9.  RE: VM snapshot question

    Posted Sep 16, 2015 07:24 PM

    I suggest following checks:

    1) Backup configured  --> as confirmed by you no so leaving this

    2) What all plugins you see in vCenterPlugins? What you see installed under vCentrer-->Inventory-->Home

    3) Create a alarm to trigger for VM with snaphshot , the momment you get alarmed login to any of the ESX goto vmware.log and check what just happened . You could check back date logs too otherwise.

    4) You could also check and cross verify datastores if you see any deltas there

    5) You could also try checking if you see anytask initiated over vpxa logs too.



  • 10.  RE: VM snapshot question

    Posted Sep 16, 2015 07:38 PM

    Thank you guys,

    I will try them all

    and

    let you know if I could find some things....