/VMware: vCenter find who deleted a VM

VMware: vCenter find who deleted a VM

Today I need to check who deleted a Virtual Machine from our vCenter. Looking this task in logs can be painful and spend a lot of time, so the best way to check this is in the vCenter DB.

Just connect to vCenter DB(in our case was VCDB and using SQL Server Management Studio) and run a small query and you will have all the information.

Query:

###########
SELECT CREATE_TIME, USERNAME, VM_NAME, HOST_NAME, EVENT_TYPE FROM VCDB.DBO.VPX_EVENT WHERE EVENT_TYPE = ‘vim.event.VmRemovedEvent’
AND VM_NAME = ‘VMNAME’
###########

Where the VMNAME is the name of your Virtual Machine that was deleted.

If you don’t know the full name of the VM, you can just use wildcards(AND VM_NAME LIKE ‘VM%’). This will show all results from all Virtual Machines that start with ‘VM’.
You can use many different wildcards to look for the right result. Please check Microsoft KBQ98434 how to use wildcards.

Using VPX_EVENT you can query a lot of events/tasks that were performed on VMs/Hosts.

Example:

vim.event.VmPoweredOffEvent – Virtual Machines that were Poweroff(without using Guest Powerdown)

Hope this can help.

Note: Share this article, if you think is worth sharing.

By | 2017-12-30T02:50:13+01:00 July 16th, 2013|VMware Posts|0 Comments

About the Author:

I have over 20 years of experience in the IT industry. I have been working with Virtualization for more than 15 years (mainly VMware). I recently obtained certifications, including VCP DCV 2022, VCAP DCV Design 2023, and VCP Cloud 2023. Additionally, I have VCP6.5-DCV, VMware vSAN Specialist, vExpert vSAN, vExpert NSX, vExpert Cloud Provider for the last two years, and vExpert for the last 7 years and a old MCP. My specialties are Virtualization, Storage, and Virtual Backup. I am a Solutions Architect in the area VMware, Cloud and Backup / Storage. I am employed by ITQ, a VMware partner as a Senior Consultant. I am also a blogger and owner of the blog ProVirtualzone.com

Leave A Comment