A question that I had received awhile ago from a customer was how to identify the specific user(s) who have deployed an OVF/OVA? Customers can easily do this by leveraging vCenter Serve Events, which are extremely rich with information that can help answer this and many other questions you might have in your vSphere enviornment.
The first challenge that you will find is that an OVF/OVA import operation is mapped to a generic vCenter TaskEvent, which will require some additional filtering. Secondly, depending on the method that was used to deploy the OVF/OVA such as the vSphere UI or using Automation tools like OVFTool or PowerCLI, you will also slightly diffrent behaviors in terms of the vCenter Server Events that are emitted.
If you deploy an OVF/OVA using the vSphere UI, you may have noticed there are actually two vCenter tasks which are displayed and running simultaneously as shown in the screenshot above. The first task is called "Import OVF package" and you will see that this task is associated with the actual user who initiated the import. The second task called "Deploy OVF template" is then associated with a vCenter system account that handles the actual deployment which will show up with a vpxd-extension-[uuid] username. This occurs because the user who is performing the import is not interacting directly with with vCenter Server, but rather through the vSphere UI which uses a system account to then communicate the operation to vCenter Server.
For this reason, when an OVF/OVA is imported through the vSphere UI, you will need to look at the TaskEvent and filter for the initial import operation. If an OVF/OVA is imported using the vSphere API using something like OVFTool, PowerCLI or any other vSphere SDK, then you will only see the Deploy OVF Template operation and the user associated with that operation is the person who initiated the import.
Using PowerCLI and the Get-VIEvent cmdlet, we can easily filter out these two types of TaskEvents.
Get-VIEvent | where {$_.GetType().Name -eq "TaskEvent" -and $_.FullFormattedMessage -eq "Task: Import OVF package"}
Info : VMware.Vim.TaskInfo Key : 2036862 ChainId : 2036862 CreatedTime : 4/23/2021 9:30:36 AM UserName : vsphere.local\william Datacenter : VMware.Vim.DatacenterEventArgument ComputeResource : VMware.Vim.ComputeResourceEventArgument Host : Vm : Ds : Net : Dvs : FullFormattedMessage : Task: Import OVF package ChangeTag :
Get-VIEvent | where {$_.GetType().Name -eq "TaskEvent" -and $_.FullFormattedMessage -eq "Task: Import OVF package"}
Info : VMware.Vim.TaskInfo Key : 2036869 ChainId : 2036869 CreatedTime : 4/23/2021 9:31:01 AM UserName : VSPHERE.LOCAL\vpxd-extension-767f8016-870d-4a98-a457-8247454fa759 Datacenter : VMware.Vim.DatacenterEventArgument ComputeResource : VMware.Vim.ComputeResourceEventArgument Host : Vm : Ds : Net : Dvs : FullFormattedMessage : Task: Deploy OVF template ChangeTag :
Hi,
When I try to run the cmdlet for a specific VM, it is not giving me any output.
Get-VM -Name xyz | Get-VIEvent | where {$_.GetType().Name -eq "TaskEvent" -and $_.FullFormattedMessage -eq "Task: Import OVF package"}
Get-VM -Name xyz | Get-VIEvent | where {$_.GetType().Name -eq "TaskEvent" -and $_.FullFormattedMessage -eq "Task: Deploy OVF template"}
If you have a lot of events occurring, you may need to expand the window in which it looks for events using MaxSamples. If you still don’t get anything, it’s possible for this VM, the Event had rolled (remember this info persists based on your retention which is typically 30 days by default)
I went to VM - Monitor - Tasks.
I still see a task "Deploy OVF template" and the initiator is vpxd-extension-uuid. I am unable to attach the screenshot here.
As I can still see the task under tasks and events then why I am not getting required output when I ran the above cmdlet. Am I missing something?
Yes, since you're filtering at the VM, you'll see the event but the query provided in example is across entire vCenter Server.
Try:) | where {$_.GetType().Name -eq "TaskEvent" -and $_.FullFormattedMessage -eq "Task: Import OVF package"}
Get-VIEvent -Entity (Get-VM