VMware snapshot restore logs?

[Noctis0791]

Hi Experts,

I read a post somewhere that snapshot restoration is not being recorded in Tasks/Events/Logs of vSphere anymore starting ESXi 5.x. Is this true? If that is the case, can we pull the info via ESX CLI? What command can we run to pull the logs about snapshot restoration so we could tell who restored a VM on a specific time?

Thank you so much in advanced!

Noctis

[daphnissov]

If it was done through vCenter then the Tasks for that VM will absolutely record said information. If you had log integration with vCenter (Log Insight) then you potentially have this for much longer retention periods.

[NathanosBlightc]

You can investigate any snapshot operations (such as restore) in the vmware.log file inside the related VM directory. Run the following command in the shell access to check it out:

cat /vmfs/volumes/[datastore]/[vm-dir]/vmware.log | grep snapshot

[daphnissov]

You can investigate any snapshot operations (such as restore) in the vmware.log file inside the related VM directory.

As long as you keep in mind this log file will ​not​ record the user responsible for the action. Only the action itself.