How to extract or read VMware logs for specific periods

I am particularly interested on the activities  on a few ESXi Hosts (within a Cluster) for specific periods.    I know most logs are in /var/log folder.   But how can I generate  logs for specific period for specific users.  We had a situation where the data from specific vm/datastore just disappeared and would like to know how to find what happened.
cgeorgeisaacAsked:
Who is Participating?
 
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
We had a situation where the data from specific vm/datastore just disappeared and would like to know how to find what happened.

That information is likely recorded in vCenter Tasks and Events database, if recorded.

Do you have a timeframe or userid to search for ?

see here

https://rtfmp.com/2016/04/20/how-to-view-older-tasks-and-events-in-vcenter/

http://9to5it.com/get-vcenter-events-using-powercli/

It is NOT the easiest of information to find, if you are looking for past audit events, especially if it's items on a datastore which have been tampered with!
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.