Comments on: Who deleted my VM ?

By: René

René — Wed, 09 Feb 2011 17:42:54 +0000

Got a tricky question about something similar:
I want to find out, which user moved a folder to another folder. (even if the event is out of the max 1000 events in the client view)
The problem is, that i see in events and tasks: “user moved to target” without “what” he moved…
With the get-vievent cmdlet i only receive a “Task: move entity”, but no folder or something and also no target

How can i achive this ?

By: Alen

Alen — Wed, 13 Oct 2010 12:20:03 +0000

I found that when i migrate a VM guest from a host to another host a event is logged saying : Migrated from host ESX1 to ESX2

When i do datastore migration and i leave the host the same I get the following log:
Migrated from host esx1 to esx1 but i cant find to which datastore it was moved?

is there a way to get that info?

By: René

René — Fri, 19 Mar 2010 18:00:59 +0000

Thanks for the quick answer…
This script like posted before did not run.

Have it done now with an direct script into excel..

By: Virtu-Al

Virtu-Al — Fri, 19 Mar 2010 16:09:15 +0000

Yes it would

By: René

René — Fri, 19 Mar 2010 16:07:16 +0000

Is it possible to read the information from the vc directly ? Like:
$results = Get-VM | Get-VIEvent -maxsamples 10000 -Start (Get-Date).AddDays(-1) | where {$_.fullformattedmessage -eq “Aufgabe: Virtuelle Maschine ausschalten” -or $_.fullformattedmessage -eq “Aufgabe: Herunterfahren des Gastbetriebssystems initiiert.”} | Sort CreatedTime -Descending | select createdtime, username, vm, fullformattedmessage

foreach ($result in $Results) {
$Details=”" | select createdtime, username, vm, fullformattedmessage
$Details.createdtime = $result.createdtime
$Details.username = $result.username
$Details.vm = $result.vm.name
$Details.FullFormattedMessage = $result.fullformattedMessage
}
$details | Export-csv -NoTypeInformation ‘C:\TEMP\shutdown.csv’

I want to read out which user shutdown which vm at which time