Determining which user account initiated a task in vCenter Server

Products

• VMware vCenter Server

Issue/Introduction

This article provides steps to determine which user account initiated a task in vCenter Server 4.x, 5.0 and 5.1.

Environment

VMware vCenter Server 4.0.x
VMware vCenter Server 5.1.x
VMware vCenter Server 5.0.x
VMware vCenter Server 4.1.x

Resolution

In some cases, you may need to determine who initiated tasks such as creating/deleting a virtual machine, powering on/off a virtual machine, creating/deleting a snapshot.

Open a vSphere Client to vCenter Server, select the Hosts and Clusters View, and look under the Tasks and Events tab to see if the task and the identity of the user who initiated the task can be identified.

If the user information is not available, you can attempt to retrieve this information directly from the vCenter Server database. All tasks are stored in table VPX_TASK in the vCenter Server database, and the data available is dependent on the Database Retention Policy. By default, Database Retention Policy is turned off and the retention policy is to keep tasks and event indefinitely. To access the Database Retention Policy setting in the vSphere Client, select Administration > vCenter Server Settings > Database Retention Policy.

To determine which user initiated a task

1. Log in to SQL Server Management Studio.
2. Click New Query.
3. From the database dropdown, select the vCenter Server database.
4. Run this query in the SQL Query window:
   
   select task_id, parent_task_id, start_time, username, complete_time, entity_name, descriptionid, complete_state
   from VPX_TASK
   
   
5. Click Execute to run the query.
   
   From the output, determine the task_id of the task in question. If there is no associated username with the task, find the parent_task_id and determine the user that initiated that task. For example:
   
   

Note: For more information about the descriptionid column, see the Additional Information section.

In this example output, task_id 212 shows a recorded event for virtual machine VM4 powering on. However, there is no associated username. In this case, you need to look at the parent_task_id, which is 211. task_id 211 shows that the task was performed by KNOWLEDGE\brandon. In most cases, the task and the user who initiated the task is shown.

Additional Information

This table provides a description of the terms in the descriptionid column:

descriptionid	Description
vim.VirtualMachine.PowerOff	Virtual machine was powered off
vim.VirtualMachine.rebootGuest	Guest operating system was rebooted
vim.VirtualMachine.reset	Virtual machine was reset
vim.Datacenter.powerOnVm	Virtual machine was powered on
vim.VirtualMachine.shutdownGuest	Guest operating system was shut down
Datacenter.ExecuteVmPowerOnLRO	Virtual machine was powered on
Drm.ExecuteVmPowerOnLRO	Virtual machine was powered on
vim.VirtualMachine.createSnapshot	Snapshot was created on virtual machine
vim.VirtualMachine.destroy	Virtual machine was deleted from disk
vim.VirtualMachine.removeAllSnapshots	All snapshots were removed
vim.Folder.createVM	New Virtual machine was created