Deletion of file or directory [DATASTORE_NAME] VM_NAME from DATASTORE_NAME was initiated - task performed by administrator account.

Products

• VMware vSphere ESXi

Issue/Introduction

A task like this will appear being initiated by [e-mail]

"Deletion of file or directory [DATASTORE_NAME] VM_NAME from DATASTORE_NAME was initiated from 'VMware vim-java.1.0@127.0.0.1' and completed with status success."

 

Environment

vCenter Server Appliance 8.0.x

ESXi host 8.0.x

Cause

vCenter and ESXi hosts have no automatic action to delete virtual machines directories.

This event indicates an intentional action to delete the directory, that can be due to manual action performed by logging in to vSphere Web Client or an automatic deletion triggered by external solutions that are authenticating with vCenter with the administrator account.

 

Resolution

Take proactive actions to prevent undesirable operations to be performed on vSphere, for instance:

1. Restrict the usage of the accounts to make sure each user or service will have their own account to use vSphere avoiding 1 account being used by 2 or more sources of authentication.
   
   
2. Limit [e-mail] to "Break-Glass" operations: Identity source changes, Root CA updates, and high-level script execution.
   
   
3. Follow the guidelines of vCenter Server and ESXi Security Best Practices and Resources for more information on reducing undesirable actions to be performed on the environment.

Note: VMFS does not support file-level undelete operations. Upon deletion, data is permanently purged from the datastore. Recovery is strictly impossible unless the file is restored from a previously validated backup or entirely recreated.