VMware vSphere

 View Only
  • 1.  Who made the VM

    Posted Feb 13, 2020 07:27 PM

    Hello,

    Is there or is there not a simple way to find out who in our environment made a specific VM or not? If so, how?

    Thanks



  • 2.  RE: Who made the VM

    Posted Feb 13, 2020 07:51 PM

    Hi,

    You can understand it from the authentication log file and from the date and time of creation of the VM (date of the vmdk file), analyzing these two data, you can understand who is logged in.

    Suppose, however, that if you used administrator@vsphere.local (vCenter) or root (Esxi) user authentication ... it could have been anyone who used that account.

    To work around this problem, you need to create accounts per person or use your personal Active Directory account (with the necessary configurations). In this case from the log files, you can see exactly who did and what.

    If it can be useful:

    https://www.virtuallyghetto.com/2017/06/auditinglogging-vcenter-server-authentication-authorization-activities.html

    --------------

    ESXi Log File Locations

    Authentication/var/log/auth.log

    Contains all events related to authentication for the local system.

    VMkernel /var/log/vmkernel.logRecords activities related to virtual machines and ESXi.
    VMkernel warnings/var/log/vmkwarning.logRecords activities related to virtual machines.

    ARomeo



  • 3.  RE: Who made the VM

    Posted Feb 13, 2020 08:36 PM

    Hi,

    doing research I found this post by LucD that is right for you:

    Get VM's creation date

    ARomeo



  • 4.  RE: Who made the VM

    Posted Feb 13, 2020 09:45 PM

    Yes, i have a modified Script which search for the VM Created task trough the vCenter events and fill a custom form with that information. If nothing was found it use some Quest AD commandlets to query the windows AD about the computer object (as a fallback).

    Iam pretty sure it is based on some of LucD​​ scripts.

    Regards,
    Joerg