Identify the user that initiated the VM power On task from vCenter

Products

• VMware vSphere ESXi
• VMware vCenter Server

Issue/Introduction

A VM was powered down administratively from the Guest OS for maintenance activity.

However, the VM started after a while with no manual intervention. You need to identify the user that initiated the power on of the VM.

Resolution

Navigate to the Events page of the VM from vSphere UI as below

1. 1. vSphere UI - VM - Monitor - Tasks and Events - Events
   2. Filter the Event Type ID column with the string "vim.event.VmPoweredOnEvent" to filter only the power on events for the selected VM.
   3. Find out the user name from the column "User".

 

Alternatively, run "journalctl" from the bash shell of the vCenter appliance and review the events similar to the below from the output.

MM DD hh:mm:ss <vCenter_FQDN> vpxd[6835]: Event [141928] [1-1] [YYYY-MM-DDThh:mm:ss] [vim.event.TaskEvent] [info] [<DOMAIN\User_Name>] [<Data Center Name>] [141928] [Task: Initialize powering On]
MM DD hh:mm:ss <vCenter_FQDN> vpxd[6835]: Event [141930] [1-1] [YYYY-MM-DDThh:mm:ss] [vim.event.TaskEvent] [info] [<DOMAIN\User_Name>] [<Data Center Name>] [141928] [Task: Power On virtual machine]
MM DD hh:mm:ss <vCenter_FQDN> vpxd[6835]: Event [141931] [1-1] [YYYY-MM-DDThh:mm:ss] [vim.event.VmStartingEvent] [info] [<DOMAIN\User_Name>] [<Data Center Name>] [141930] [<VM_Name> on <ESXi_Hostname> in <Data Center Name> is starting]

The third line in the above log excerpt indicates that user involved in the power on task.

Additional Information

Enable or Disable SSH and Bash Shell Access

Toggling the vCenter Server Appliance default shell