Determining the user account that initiated a Content Library deletion task within the vCenter Server

Products

• VMware vCenter Server

Issue/Introduction

A Content Library deletion task has been initiated by an unknown user and it needs to be determined who completed the task.

Environment

vCenter Server 

Resolution

Before proceeding, ensure to obtain the specific task and corresponding timestamp. To check from the vCenter Web UI, select the vCenter inventory object > Monitor > Tasks.

In a vCenter, grep for below events using command 

#journalctl -b 0 | grep -i "Deleted Library"

Example:

Jun 16 12:34:57 vcenter.example.com vpxd[6291]: Event [932710] [1-1] [2024-06-16T12:34:57.495184Z] [vim.event.EventEx] [info] [EXAMPLE.COM\exampleuser] [] [932710] [Deleted Library ExampleContentLibrary]

In the above example, AD user exampleuser performed the deletion on the Content Library ExampleContentLibrary.