VMware virtual machine logging

cmatchett
cmatchett used Ask the Experts™
on
In VMware, does it record when compute resources are added to a virtual machine ?

Is there a log?  I know that there is the tasks and events section, but does it only say that an action was performed and not what that action was?
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Andrew Hancock (VMware vExpert / EE Fellow)VMware and Virtualization Consultant
Fellow 2018
Expert of the Year 2017

Commented:
By compute resoures do you mean extra vCPU and Memory?

Author

Commented:
i do indeed
Top Expert 2015

Commented:
It logs that configuration was changed, indeed there is no telling if it was machines' desscription or VM size.
Ensure you’re charging the right price for your IT

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden using our free interactive tool and use it to determine the right price for your IT services. Start calculating Now!

VMware and Virtualization Consultant
Fellow 2018
Expert of the Year 2017
Commented:
A Reconfigure Virtual Machine Tasks is created in the Task and Event log.

additional vCPUs and Memory are not shown in Tasks and Events.

However, if you check the vmware.log (s), which are rotated at each power on, these logs can be found in the virtual machine folder, you will see the changes in the logs, for memSize and memsize

e.g.

2014-04-16T09:27:55.823Z| vmx| I120: DICT                   memSize = 4096
/vmfs/volumes/52d590cd-46540da8-517d-c81f66d8fc55/Windows 7 # cat vmware.log | grep memSize

2014-05-01T09:05:08.856Z| vmx| I120: DICT                   memSize = 8192
/vmfs/volumes/52d590cd-46540da8-517d-c81f66d8fc55/Windows 7 #

/vmfs/volumes/52d590cd-46540da8-517d-c81f66d8fc55/Windows 7 # cat vmware-56.log | grep memsize

2014-04-16T09:27:56.800Z| vmx| I120: OvhdMem: memsize 4096 MB VMK fixed 83 pages var 0 pages cbrcOverhead 0 pages total 2133 pages

2014-04-16T11:02:32.675Z| vmx| I120: OvhdMem: memsize 4096 MB VMK fixed 83 pages var 0 pages cbrcOverhead 0 pages total 2133 pages

/vmfs/volumes/52d590cd-46540da8-517d-c81f66d8fc55/Windows 7 # cat vmware.log | grep memsize

2014-05-01T09:05:09.226Z| vmx| I120: OvhdMem: memsize 8192 MB VMK fixed 83 pages var 0 pages cbrcOverhead 0 pages total 4183 pages

2014-05-01T09:12:34.977Z| vmx| I120: OvhdMem: memsize 8192 MB VMK fixed 83 pages var 0 pages cbrcOverhead 0 pages total 4183 pages
/vmfs/volumes/52d590cd-46540da8-517d-c81f66d8fc55/Windows 7 #

the same is true for the variable  numvcpus, so any changed to a virtual machine can be audited by inpsecting the vmware.log (s).

/vmfs/volumes/52d590cd-46540da8-517d-c81f66d8fc55/Windows 7 # cat vmware-56.log | grep numvcpus

2014-04-16T09:27:55.823Z| vmx| I120: DICT                  numvcpus = 2
/vmfs/volumes/52d590cd-46540da8-517d-c81f66d8fc55/Windows 7 #


So a log is not actually recorded of the change, but changes can be detected, based on changes to the vmware.log (s), which are timestamped. So if you are trying to track an unauthorized change, you can see who performed the configuration change, based on Tasks and Events, and inspecting the logs (vmware) in the VM folder, can check which change has been made.

Author

Commented:
great work
Andrew Hancock (VMware vExpert / EE Fellow)VMware and Virtualization Consultant
Fellow 2018
Expert of the Year 2017

Commented:
no problems!

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial