Celebrate National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17


vCenter Troubleshooting TIPS - How to find who deleted a VM

Published on
4,424 Points
2 Endorsements
Last Modified:
Luciano Patrão
My main areas of expertise are VMware, Virtual Backups and Storage design.
I am a vExpert and a Technical Blogger in the same areas.
If we need to check who deleted a Virtual Machine from our vCenter. Looking this task in logs can be painful and spend lot of time, so the best way to check this is in the vCenter DB.

Just connect to vCenter DB(default DB should be VCDB and using SQL Server Management Studio) and run a small query and you will have all the information.



Open in new window

Where the VMNAME is the name of your Virtual Machine that was deleted.

If you don't know the full name of the VM, you can just use wildcards(AND VM_NAME LIKE 'VM%'). This will show all results from all Virtual Machines that start with 'VM'.
You can use many different wildcards to look for the right result. Please check Microsoft KBQ98434 how to use wildcards.

Using VPX_EVENT you can query lot of events/tasks that was performed on VMs/Hosts.

vim.event.VmPoweredOffEvent - Virtual Machines that were Poweroff(without using Guest Powerdown)

We can also use the same query using PowerShell Script o check events.

Example(VM created)

Get-VM -Name 'VMNAME' | Get-VIEvent -Types Info | Where {$_.GetType().Name -eq "VmCreatedEvent"}
Select UserName, CreatedTime, FullFormattedMessage | FT -AutoSize

Open in new window

You should get something like this

Template             : False
Key                  : 13264809
ChainId              : 13264804
CreatedTime          : 5/9/2014 16:21:16
UserName             : DOMAIN\USER
Datacenter           : VMware.Vim.DatacenterEventArgument
ComputeResource      : VMware.Vim.ComputeResourceEventArgument
Host                 : VMware.Vim.HostEventArgument
Vm                   : VMware.Vim.VmEventArgument
Ds                   : 
Net                  : 
Dvs                  : 
FullFormattedMessage : Virtuelle Maschine VMNAME auf HOSTNAME in DatacenterNAME erstellt.
ChangeTag            : 
DynamicType          : 
DynamicProperty      : 

Open in new window

You can also list the last VMs deleted, or any other event(just change the event id for the event you want to list).

You can consult all machine events and that can be used in the above query/script VMware vSphere API Reference Documentation

Hope this can help.

This is the second of "TIP Articles" that I plan to write when I have some time. So, please vote "Helpful" on this Article. And I encourage your comments and feedback.
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions

Featured Post

Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Join & Write a Comment

Teach the user how to install ESXi 5.5 and configure the management network System Requirements: ESXi Installation:  Management Network Configuration: Management Network Testing:
Teach the user how to use vSphere Update Manager to update the VMware Tools and virtual machine hardware version Open vSphere Client: Review manual processes for updating VMware Tools and virtual hardware versions: Create a new baseline group in vSp…

Keep in touch with Experts Exchange

Tech news and trends delivered to your inbox every month