Auditing vGPU Profile Reconfigurations in vSphere

vCenter Server Events are extremely powerful and contains a ton of useful information, especially for auditing and compliance purposes. As of vSphere 8.0 Update 3, there are over 2.1K+ out of the box events with many more through 2nd and 3rd party integrations.

One of my favorite vCenter Server Event is the VmReconfiguredEvent as it provides complete visibility into every VM reconfiguration change as shared in this blog post back in 2015.

I recently saw an interesting inquiry about being able to audit and track vGPU profile reconfigurations for a VM and of course, vCenter Server Events to the rescue!

Here is a quick PowerCLI snippet which retrieves the latest 1000 vCenter Server Events (you can certainly go back further or add other filters to reduce the initial events) and then look for the VmReconfiguredEvent and check whether there is ConfigChanges.Modified that matches the "vgpu" string, which will indicate a vGPU profile reconfiguration:

$events = Get-VIEvent -MaxSamples 1000

$gpuEvents = $events | where {$_.getType().Name -eq "VmReconfiguredEvent"} | where {$_.ConfigChanges.Modified -match "vgpu"}
$results = @()
foreach ($gpuEvent in $gpuEvents) {
    $summaryLine = $gpuEvent.ConfigChanges.Modified -Split "`n"


    $tmp = [pscustomobject] @{
        VM = $gpuEvent.Vm.Name
        CreatedTime = $gpuEvent.CreatedTime
        UserName = $gpuEvent.UserName
        Change = $summaryLine[0]
    }
    $results+=$tmp
}
$results | Sort-Object -Property CreatedTime

Here is an example output from running the snippet above where we can see several VMs that have had their vGPU Profile has change which includes the original configuration as well as the modified value and of  it will include the date/time and the user who made the change:

The next time you need to track or audit a VM reconfiguration, make sure you look at vCenter Server Events which are consumable both in the vSphere UI (though less useful outside of quickly finding the change) to emitting them to external systems, which of course, the VMware Event Broker Application (VEBA) is one of the easiest way to do that!