When a powered-on VM’s vNIC is removed, you will notice a corresponding task in the vSphere Client under the Tasks tab: “Config.hardware.device(4000).connetable.connected: true-> false; Added:Deleted:”
When a vNIC disconnect or connect task is initiated, evidence of this will be found in vmware.log: Receiving.HotPlugManager.BeginBatch request
When a vNIC disconnect or connect task is completed, evidence of this will be found in vmware.log: Completed.HotPlugManager.EndBatch request in xx US.
The user who initiated the task can be identified by reviewing the vSphere Client.
VM ---> Monitor ---> Tasks ---> Task name: Reconfigure Virtual Machine ---> initiator
When a powered-on VM’s vNIC is connected, you will notice a corresponding task in the vSphere Client under the Tasks tab: Config.hardware.device(4000).connetable.connected: false-> true; Added:Deleted: