Here is another question that can be solved by leveraging vCenter Server Events, which provides a lot of useful information, especially for historical operations and auditing purposes. Simliar to identifying where a VM was cloned from use case, we can also use vCenter events to retrieve the historical events for all VM deletions for a given vSphere environment.
One important thing to note is that when a VM or any other vSphere object for that matter that has been deleted, all references to that object is removed from vCenter Server. This means, we can not look for events for a give VM but instead, we need to look at the Task-based Event types to actually retrieve this information.
Putting this together, I have created a PowerCLI function called Get-VmDeleteHistory which can be installed directly from the PowerShell Gallery by running:
Install-Script -Name VmDeleteHistory
After connecting to your vCenter Server using the Connect-VIServer cmdlet, you can then run the Get-VmDeleteHistory function which uses the Get-VIEvent cmdlet and looks at the last 500 events. Below is an example output of what you will see which is the VM that was deleted, the User who performed the action along with the date and time.
If you want to look further back in history, you can provide the optional -MaxSamples parameter and that will allow you to specify the maximum number of events to look through.
Get-VmDeleteHistory -MaxSamples 1000
It is also important to understand that how far back you can go is based on your vCenter Server's Task/Event retention configuration.
What am I doing wrong (pwsh on Centos 7):
PS /home/pzi> Install-Script -Name VmDeleteHistory
PS /home/pzi> Get-VmDeleteHistory
Get-VmDeleteHistory: The term 'Get-VmDeleteHistory' is not recognized as the name of a cmdlet, function, script file, or operable program.
Check the spelling of the name, or if a path was included, verify that the path is correct and try again.
On Windows, the script downloads to a default directory (C:\Program Files\WindowsPowerShell\Scripts). I grabbed the file and placed it in my usual working directory. I also had to dot-source the file before running the cmdlet. (e.g. C:\Scripts> . .\VmDeleteHistory.ps1)
After that, Get-VmDeleteHistory worked.
Good luck!
It never worked for me. William, can you provide the steps how this worked for you?
Every time I try to install I get the following error:
PackageManagement\Install-Package : Script
'C:\Users\username\AppData\Local\Temp\8\363694430\VmDeleteHistory\VmDeleteHistory.ps1' is missing required metadata
properties. Verify that the script file has Version, Guid, Description and Author properties. You can use the
Update-ScriptFileInfo or New-ScriptFileInfo cmdlet to add or update the PSScriptInfo to the script file.
At C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\PSModule.psm1:2824 char:21
+ $null = PackageManagement\Install-Package @PSBoundParameters
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidArgument: (C:\Users\userna…leteHistory.ps1:String) [Install-Package], Exception
+ FullyQualifiedErrorId : MissingRequiredPSScriptInfoProperties,Test-ScriptFileInfo,Microsoft.PowerShell.PackageMa
nagement.Cmdlets.InstallPackage
I've tried on different versions and different servers.
Any suggestions?