Investigating the cause of virtual machines being moved out of their original VM folders

Products

• VMware vCenter Server

Issue/Introduction

This article explains how to identify when a VM was moved, which user account acted, and the resulting folder placement.

Environment

vCenter Server 7.0

vCenter Server 8.0

Resolution

When a VM is moved out of its original VM folder, the vsphere_client_virgo.log records entries similar to the following:

[####-##-##T##:##:##.###] [ERROR] ent-event-transformer-###### ######## ###### ###### com.vmware.opsmgmt.client.event.impl.i18n.MessageParser           Could not read property name of object (vim.event.VmBeingClonedEvent) {
   dynamicType = null,
   dynamicProperty = null,
   key = ######,
   chainId = ######,
   createdTime = java.util.GregorianCalendar[time=#############,areFieldsSet=true,areAllFieldsSet=false,lenient=true,zone=sun.util.calendar.ZoneInfo[id="GMT+00:00",offset=0,dstSavings=0,useDaylight=false,transitions=0,lastRule=null],firstDayOfWeek=1,minimalDaysInFirstWeek=#,ERA=#,YEAR=####,MONTH=##,WEEK_OF_YEAR=##,WEEK_OF_MONTH=#,DAY_OF_MONTH=##,DAY_OF_YEAR=###,DAY_OF_WEEK=#,DAY_OF_WEEK_IN_MONTH=#,AM_PM=#,HOUR=#,HOUR_OF_DAY=#,MINUTE=#,SECOND=##,MILLISECOND=###,ZONE_OFFSET=0,DST_OFFSET=0],
   userName = VSPHERE.LOCAL\Administrator,                <<<<<<<<<<<<<<<<<<<<<<<<< Execute user accounts
   datacenter = (vim.event.DatacenterEventArgument) {
      dynamicType = null,
      dynamicProperty = null,
      name = <Data Center Name>,               <<<<<<<<<<<<<<<<<<<<<<<<< Data center involved
      datacenter = ManagedObjectReference: type = Datacenter, value = datacenter-#, serverGuid = <vCenter GUID>
   },
   computeResource = (vim.event.ComputeResourceEventArgument) {
      dynamicType = null,
      dynamicProperty = null,
      name = <cluster Name>,               <<<<<<<<<<<<<<<<<<<<<<<<< Cluster involved
      computeResource = ManagedObjectReference: type = ClusterComputeResource, value = domain-c#, serverGuid = <vCenter GUID>
   },
   host = (vim.event.HostEventArgument) {
      dynamicType = null,
      dynamicProperty = null,
      name = <Host fqdn>,
      host = ManagedObjectReference: type = HostSystem, value = host-##, serverGuid = <vCenter GUID>
   },
   vm = (vim.event.VmEventArgument) {
      dynamicType = null,
      dynamicProperty = null,
      name = <VM Name>,               <<<<<<<<<<<<<<<<<<<<<<<<< Involved VM
      vm = ManagedObjectReference: type = VirtualMachine, value = vm-####, serverGuid = <vCenter GUID>
   },
   ds = (vim.event.DatastoreEventArgument) {
      dynamicType = null,
      dynamicProperty = null,
      name = <Datastore Name>,               <<<<<<<<<<<<<<<<<<<<<<<<< Involved datatore
      datastore = ManagedObjectReference: type = Datastore, value = datastore-##, serverGuid = <vCenter GUID>
   },
   net = null,
   dvs = null,
   fullFormattedMessage = Replicating <VM Name> from <Host fqdn>, <Datastore Name> in <Data Center Name> to <VM Name> in <Host fqdn>, <Datastore Name> in <Data Center Name>,
   changeTag = null,
   template = false,
   destFolder = (vim.event.FolderEventArgument) {
      dynamicType = null,
      dynamicProperty = null,
      name = Discovered virtual machine,
      folder = ManagedObjectReference: type = Folder, value = group-v##, serverGuid = <vCenter GUID>
   },
   destName = <VM Name>,
   destHost = (vim.event.HostEventArgument) {
      dynamicType = null,
      dynamicProperty = null,
      name = <Host fqdn>,
      host = ManagedObjectReference: type = HostSystem, value = host-##, serverGuid = <vCenter GUID>
   },
   destDatacenter = null,
   destDatastore = null

These log details allow administrators to determine:

• Timestamp of the move (createdTime)
• User account that executed the action (userName)
• The VM, datastore, host, and destination folder involved

Additional Information

Administrators should verify whether they have recently:

• Manually moved the VM

• Performed VM operations through the API using the VSPHERE.LOCAL\Administrator account

Recommended Actions When VMs Are Found Outside Their Expected Folders

1. Move the VM back to its correct/original folder.

2. Review applications with access to the vSphere SDK API to determine whether any API calls may have triggered the VM move.

3. Regularly update the password for the [email protected] account.

4. Monitor the VM folder structure to determine whether the VM is moved again.

   • If it happens again, promptly review the task list at the datacenter level to determine the exact time and user associated with the operation.