How to check quickly in VMware vCenter about users who have created or deleted the VMs?
The below PowerCLI script can be fetched using the TaskEvent which has the description VmBeingDeployedEvent or VmBeingClonedEvent and VmRemovedEvent in VMware vCenter 6.
VMware PowerCLI ConnectConnect your vCenter
> Connect-VIServer vcenter.cloudkb.com Name Port User ---- ---- ---- vcenter.cloudkb.com 443 VSPHERE.LOCAL\Administrator
You can list the virtual machine details which user has removed or deleted and Created, check the vCenter Server Events Logs using PowerCLI command to list all the details.
Use the following powerCLI command to list VM created list.
Get-VIEvent -MaxSamples ([int]::MaxValue) -Start (Get-Date).AddDays(-30) | where {$_.Gettype().Name -eq “VmCreatedEvent” -or $_.Gettype().Name -eq “VmBeingClonedEvent” -or $_.Gettype().Name -eq “VmBeingDeployedEvent”} | %{“{0} created by {1}” -f $_.VM.Name,$_.UserName}
Use the following PowerCLI command to list last 7 days VM deleted Event logs with a username.
Get-VIEvent -MaxSamples ([int]::MaxValue) -Start (Get-Date).AddDays(-7) | where {$_.Gettype().Name -eq “VmRemovedEvent”} | %{“{0} created by {1}” -f $_.VM.Name,$_.UserName}
How to get a list Virtual Machine Snapshots in VMware
This is additional information to get a list of all VM Snapshots for VMs managed by vCenter you can type the following command using PowerCLI.
get-vm | get-snapshot | format-list
The command above will give you the following properties:
Description
Created
Quiesced
PowerState
VM
VMId
Parent
ParentSnapshotId
ParentSnapshot
Children
SizeMB
IsCurrent
IsReplaySupported
ExtensionData
Id
Name
Uid
If you want the VM list with the name of the snapshot, you could simply add these properties after “format-list” as shown below.
get-vm | get-snapshot | format-list vm,name
