WilliamLam.com

  • About
    • About
    • Privacy
  • VMware Cloud
  • Tanzu
    • Application Modernization
    • Tanzu services
    • Tanzu Community Edition
    • Tanzu Kubernetes Grid
    • vSphere with Tanzu
  • Home Lab
  • Nested Virtualization
  • Apple
You are here: Home / Automation / Quick Tip - How to retrieve deleted VM history?

Quick Tip - How to retrieve deleted VM history?

01.21.2021 by William Lam // 4 Comments

Here is another question that can be solved by leveraging vCenter Server Events, which provides a lot of useful information, especially for historical operations and auditing purposes. Simliar to identifying where a VM was cloned from use case, we can also use vCenter events to retrieve the historical events for all VM deletions for a given vSphere environment.

One important thing to note is that when a VM or any other vSphere object for that matter that has been deleted, all references to that object is removed from vCenter Server. This means, we can not look for events for a give VM but instead, we need to look at the Task-based Event types to actually retrieve this information.

Putting this together, I have created a PowerCLI function called Get-VmDeleteHistory which can be installed directly from the PowerShell Gallery by running:

Install-Script -Name VmDeleteHistory

After connecting to your vCenter Server using the Connect-VIServer cmdlet, you can then run the Get-VmDeleteHistory function which uses the Get-VIEvent cmdlet and looks at the last 500 events. Below is an example output of what you will see which is the VM that was deleted, the User who performed the action along with the date and time.


If you want to look further back in history, you can provide the optional -MaxSamples parameter and that will allow you to specify the maximum number of events to look through.

Get-VmDeleteHistory -MaxSamples 1000

It is also important to understand that how far back you can go is based on your vCenter Server's Task/Event retention configuration.

More from my site

  • PowerCLI 13.0 on Photon OS
  • Heads Up - Unable to open VIB archive in streaming mode using Export-EsxImageProfile with PowerCLI 13.0
  • How to install PowerCLI 13.0 and use new Image Builder & Auto Deploy cmdlets on Apple Silicon?
  • Creating custom ESXi images using vSphere Lifecycle Manager (vLCM) UI and PowerCLI cmdlets for vSphere 8
  • Automated enablement of vSphere with Tanzu using vSphere Zones in vSphere 8

Categories // Automation, PowerCLI Tags // PowerCLI, VmDeleted

Comments

  1. pzi123 says

    01/22/2021 at 2:55 pm

    What am I doing wrong (pwsh on Centos 7):

    PS /home/pzi> Install-Script -Name VmDeleteHistory
    PS /home/pzi> Get-VmDeleteHistory
    Get-VmDeleteHistory: The term 'Get-VmDeleteHistory' is not recognized as the name of a cmdlet, function, script file, or operable program.
    Check the spelling of the name, or if a path was included, verify that the path is correct and try again.

    Reply
  2. rgb_99 says

    01/29/2021 at 5:42 am

    On Windows, the script downloads to a default directory (C:\Program Files\WindowsPowerShell\Scripts). I grabbed the file and placed it in my usual working directory. I also had to dot-source the file before running the cmdlet. (e.g. C:\Scripts> . .\VmDeleteHistory.ps1)

    After that, Get-VmDeleteHistory worked.

    Good luck!

    Reply
  3. zoomvia says

    03/11/2021 at 4:10 am

    It never worked for me. William, can you provide the steps how this worked for you?

    Reply
  4. SealEye says

    04/21/2021 at 6:54 am

    Every time I try to install I get the following error:

    PackageManagement\Install-Package : Script
    'C:\Users\username\AppData\Local\Temp\8\363694430\VmDeleteHistory\VmDeleteHistory.ps1' is missing required metadata
    properties. Verify that the script file has Version, Guid, Description and Author properties. You can use the
    Update-ScriptFileInfo or New-ScriptFileInfo cmdlet to add or update the PSScriptInfo to the script file.
    At C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\PSModule.psm1:2824 char:21
    + $null = PackageManagement\Install-Package @PSBoundParameters
    + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo : InvalidArgument: (C:\Users\userna...leteHistory.ps1:String) [Install-Package], Exception
    + FullyQualifiedErrorId : MissingRequiredPSScriptInfoProperties,Test-ScriptFileInfo,Microsoft.PowerShell.PackageMa
    nagement.Cmdlets.InstallPackage

    I've tried on different versions and different servers.
    Any suggestions?

    Reply

Thanks for the comment! Cancel reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Search

Author

William Lam is a Senior Staff Solution Architect working in the VMware Cloud team within the Cloud Infrastructure Business Group (CIBG) at VMware. He focuses on Cloud Native technologies, Automation, Integration and Operation for the VMware Cloud based Software Defined Datacenters (SDDC)

Connect

  • Email
  • GitHub
  • LinkedIn
  • RSS
  • Twitter
  • Vimeo

Recent

  • Automated ESXi Installation with a USB Network Adapter using Kickstart 02/01/2023
  • How to bootstrap ESXi compute only node and connect to vSAN HCI Mesh? 01/31/2023
  • Quick Tip - Easily move or copy VMs between two Free ESXi hosts? 01/30/2023
  • vSphere with Tanzu using Intel Arc GPU 01/26/2023
  • Quick Tip - Automating allowed and not allowed Datastores for use with vSphere Cluster Services (vCLS) 01/25/2023

Advertisment

Privacy & Cookies: This site uses cookies. By continuing to use this website, you agree to their use.
To find out more, including how to control cookies, see here: Cookie Policy

Copyright WilliamLam.com © 2023

 

Loading Comments...