Which VM was this vSphere VM cloned from?

This was a question that I saw back in December on the VMware {code} Slack which was quickly answered by the always awesome Luc Dekens. The solution is to look at vCenter Server Events, which are super rich in information and can be used for a number of things including identifying the source VM that it was cloned from. When I was a customer, this was something I did all the time, using events for auditing purposes but also identifying who, what and when a certain operation was performed including source VMs for cloning operations.

Although this information maybe known to some, there is still not an elegant solution that can help someone quickly identify the source VM for a specific vSphere VM that was cloned. This topic also intrigued me as I have seen this question come up in the past. I figure I might as well add this to my random scripting backlog and take a look when I had some time.

Before taking a look at the solution, it is important to understand the different types of clones that exists in vSphere today and also the respective vCenter Server events that can help us correlate to both the source VM but also the specific clone type.

Cloning Types

• Full Clone - An independent copy of a virtual machine that shares nothing with the parent virtual machine after the cloning operation. Ongoing operation of a full clone is entirely separate from the parent virtual machine
• Linked Clone - A copy of a virtual machine that shares virtual disks with the parent virtual machine in an ongoing manner. This conserves disk space, and allows multiple virtual machines to use the same software installation
• Instant Clone - An independent copy of a virtual machine that starts executing from the exact running state of the source powered on virtual machine. Instant Clone uses rapid in-memory cloning of a running parent virtual machine and copy-on-write, simliar to that of Linked Cloning to rapidly deploy virtual machines

vCenter Event Types

• VmClonedEvent - Triggered when a Full Clone or Linked Clone has been performed
• com.vmware.vc.VmInstantClonedEvent - Triggered when an Instant Clone has been performed
• VmDeployedEvent - Triggered a VM has been deployed either from a vSphere Template or Content Library Template

Using this information, I have created a PowerCLI function called Get-VMCloneInfo which can be installed directly from the PowerShell Gallery by running:

Install-Script VMCloneInfo

The function accepts a single parameter called -VMName which is the name of the VM that you wish to look up the cloning information about. Below are some example output for the various cloning scenarios which will output the clone type, source VM, Date and User that performed the original clone operation.

Cloning Scenarios

#1 - Here is a example when specifying a VM that was not cloned:

> Get-VMCloneInfo -VMName "SourceVM"
Unable to find any cloning information for SourceVM, VM may not have been cloned or vCenter Events have rolled over

#2 - Here is an example when specifying a VM that was Full Cloned:

> Get-VMCloneInfo -VMName "Full-Clone-VM"
Type Source Date User
---- ------ ---- ----
Full SourceVM 1/3/2021 1:13:00 PM VSPHERE.LOCAL\Administrator

#3 - Here is an example when specifying a VM that was Linked Cloned:

> Get-VMCloneInfo -VMName "Linked-Clone-VM"
Type Source Date User
---- ------ ---- ----
Linked SourceVM 1/3/2021 1:13:14 PM VSPHERE.LOCAL\Administrator

#4 - Here is an example when specifying a VM that was Instant Cloned:

> Get-VMCloneInfo -VMName "Instant-Clone-VM"
Type Source Date User
---- ------ ---- ----
Instant SourceVM2 1/3/2021 1:12:44 PM VSPHERE.LOCAL\Administrator

#5 - Here is an example when specifying a VM that was cloned from a vSphere Template:

> Get-VMCloneInfo -VMName "VMTX-VM"
Type Source Date User
---- ------ ---- ----
Full SourceVMTXTemplate 1/3/2021 2:20:31 PM VSPHERE.LOCAL\Administrator

#6 - Here is an example when specifying a VM that was cloned from a Content Library VM Template:

> Get-VMCloneInfo -VMName "VMTemplate-VM"
Type Source Date User
---- ------ ---- ----
Full SourceVMTemplate 1/3/2021 2:23:41 PM VSPHERE.LOCAL\Administrator