Identifying the Initiator of a Datacenter Deletion in vCenter Server

Products

• VMware vCenter Server

Issue/Introduction

A virtual Datacenter object has been removed from the vCenter inventory, and administrators need to identify which user account performed the deletion.

Cause

A Datacenter object can be deleted via the vSphere Client (UI), PowerCLI, or the vSphere API. While the object is removed from the inventory, the event and task history recorded in vCenter logs usually contain the initiator's identity.

Resolution

Method 1: vSphere Client (UI)

If the deletion occurred recently and the events have not rolled over, use the vSphere Client:

1. Log in to the vSphere Client.
2. Select the vCenter Server object in the inventory.
3. Navigate to the Monitor tab and select Events.
4. In the filter/search box, type the name of the deleted datacenter or the keyword Removed.
5. Locate the event titled "Datacenter [Name] removed" or similar.
6. Review the User or Initiator column to see the account responsible.

Method 2: Log Analysis (SSH/Command Line)

If the event is no longer visible in the UI, or for deeper auditing, search the vCenter Server Appliance (VCSA) logs directly.

[!IMPORTANT] Replace <DC_NAME> with the exact name of the deleted datacenter 

1. SSH to the vCenter Server Appliance as root.
2. Access the shell by typing shell and pressing Enter.
3. Navigate to the vCenter service logs directory:

   cd /var/log/vmware/vpxd/

4. Search for the removal event in the vpxd.log files:

   grep -i "<DC_NAME>" vpxd*.log | grep -i "Removed"

   Alternative search for the destruction task:

   grep -i "destroy" vpxd*.log | grep -i "<DC_NAME>"

5. Analyze the output for an entry similar to: Event [ID] [Time] [vim.event.DatacenterRemovedEvent] [info] [DOMAIN\USER] [DatacenterName] [Removed DatacenterName]

Method 3: vSphere UI Client Logs

You can also check the UI client logs for specific user sessions initiating removal commands:

1. Navigate to the UI log directory:

   cd /var/log/vmware/vsphere-ui/logs/

2. Grep for the "Removing" action associated with the object:

   grep -i "Removing" vsphere_client_virgo*.log | grep -i "<DC_NAME>"

Additional Information

If the logs have rolled over and the vCenter database has cleared the events, it may be impossible to identify the initiator. In such cases, consider reviewing external syslog servers if vCenter is configured to forward logs externally.