Determining which user account initiated a task in vCenter Server
search cancel

Determining which user account initiated a task in vCenter Server


Article ID: 342314


Updated On:


VMware vCenter Server


This article provides steps to determine which user account initiated a task in vCenter Server 4.x, 5.0 and 5.1.


VMware vCenter Server 4.0.x
VMware vCenter Server 5.1.x
VMware vCenter Server 5.0.x
VMware vCenter Server 4.1.x


In some cases, you may need to determine who initiated tasks such as creating/deleting a virtual machine, powering on/off a virtual machine, creating/deleting a snapshot.

Open a vSphere Client to vCenter Server, select the Hosts and Clusters View, and look under the Tasks and Events tab to see if the task and the identity of the user who initiated the task can be identified.

If the user information is not available, you can attempt to retrieve this information directly from the vCenter Server database. All tasks are stored in table VPX_TASK in the vCenter Server database, and the data available is dependent on the Database Retention Policy. By default, Database Retention Policy is turned off and the retention policy is to keep tasks and event indefinitely. To access the Database Retention Policy setting in the vSphere Client, select Administration > vCenter Server Settings > Database Retention Policy.

To determine which user initiated a task
  1. Log in to SQL Server Management Studio.
  2. Click New Query.
  3. From the database dropdown, select the vCenter Server database.
  4. Run this query in the SQL Query window:

    select task_id, parent_task_id, start_time, username, complete_time, entity_name, descriptionid, complete_state
    from VPX_TASK

  5. Click Execute to run the query.

    From the output, determine the task_id of the task in question. If there is no associated username with the task, find the parent_task_id and determine the user that initiated that task. For example:

Note: For more information about the descriptionid column, see the Additional Information section.

In this example output, task_id 212 shows a recorded event for virtual machine VM4 powering on. However, there is no associated username. In this case, you need to look at the parent_task_id, which is 211. task_id 211 shows that the task was performed by KNOWLEDGE\brandon. In most cases, the task and the user who initiated the task is shown.

Additional Information

This table provides a description of the terms in the descriptionid column:
vim.VirtualMachine.PowerOffVirtual machine was powered off
Guest operating system was rebooted
vim.VirtualMachine.resetVirtual machine was reset
vim.Datacenter.powerOnVmVirtual machine was powered on
Guest operating system was shut down
Datacenter.ExecuteVmPowerOnLROVirtual machine was powered on
Drm.ExecuteVmPowerOnLROVirtual machine was powered on
vim.VirtualMachine.createSnapshotSnapshot was created on virtual machine
vim.VirtualMachine.destroyVirtual machine was deleted from disk
All snapshots were removed
vim.Folder.createVMNew Virtual machine was created