locked
Audit - Who created/deleted the VM? RRS feed

  • Question

  • Hi,

    Does anyone know or can point me to the correct direction on how I query who has created or deleted a VM?

    The VM was created for quite some times (according to uptime), but I just couldn't query it from SCVMM console Jobs.


    How long is the History of VM creation/deletion being kept?

    Thank you in advanced!


    ---Pat

    Saturday, December 12, 2015 7:20 PM

Answers

  • SCVMM can only tell you if it was deleted using SCVMM (PowerShell or SCVMM Console).

    If the VM was deleted using Hyper-V Manager or lost by the storage array, SCVMM cannot tell you that.  And neither can Hyper-V (since it does not do user action audit tracking).

    I cannot recall the SCVMM log retention.

    What is shown in the SCVMM console has a history limit that is much smaller than the actual volume of jobs in the database.  You need to use PowerShell to go all the way back.

    This might help get you started: http://itproctology.blogspot.com/2012/01/getting-convert-vhd-jobs-per-vm-from.html


    Brian Ehlert
    http://ITProctology.blogspot.com
    Learn. Apply. Repeat.


    • Edited by BrianEhMVP Monday, December 14, 2015 5:47 PM
    • Proposed as answer by Elton_Ji Thursday, December 17, 2015 2:28 AM
    • Marked as answer by Elton_Ji Sunday, January 3, 2016 11:09 AM
    Monday, December 14, 2015 5:44 PM

All replies

  • SCVMM can only tell you if it was deleted using SCVMM (PowerShell or SCVMM Console).

    If the VM was deleted using Hyper-V Manager or lost by the storage array, SCVMM cannot tell you that.  And neither can Hyper-V (since it does not do user action audit tracking).

    I cannot recall the SCVMM log retention.

    What is shown in the SCVMM console has a history limit that is much smaller than the actual volume of jobs in the database.  You need to use PowerShell to go all the way back.

    This might help get you started: http://itproctology.blogspot.com/2012/01/getting-convert-vhd-jobs-per-vm-from.html


    Brian Ehlert
    http://ITProctology.blogspot.com
    Learn. Apply. Repeat.


    • Edited by BrianEhMVP Monday, December 14, 2015 5:47 PM
    • Proposed as answer by Elton_Ji Thursday, December 17, 2015 2:28 AM
    • Marked as answer by Elton_Ji Sunday, January 3, 2016 11:09 AM
    Monday, December 14, 2015 5:44 PM
  • Hi Pat,

    Agree with Brian .

    >>How long is the History of VM creation/deletion being kept?

    Job history records

    2 Millions

    5 Millions

    5 Millions

    https://technet.microsoft.com/en-us/library/gg671827.aspx

    Best Regards,

    Elton


    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com .

    Thursday, December 17, 2015 2:28 AM