Tracking Folder Movements and Deletions in vCenter Server

Products

• VMware vSphere ESXi

Issue/Introduction

This article provides guidance on identifying when folder paths are modified or removed within vCenter Server logs and configuring logging for future tracking.

Environment

VMware vCenter Server 7.x, 8.x

Cause

Folder organizational changes, such as moving or destroying a folder, are not captured in standard vCenter logging levels. Historical tracking of these events is not possible if the required logging level was not enabled prior to the operation.

Resolution

To identify folder organizational changes in vCenter Server logs:

• Review the logs located at /var/log/vmware/vpxd/vpxd.log.
• Search for the following event strings:
• Folder Movement:
  
  verbose vpxd[####] [Originator@6876 sub=alarmMo opID=...] [ProcessEntityRelocated] Entity has been relocated: group-#####
• Folder Deletion:
  
  info vpxd[#####] [Originator@6876 sub=vpxLro opID=...] [VpxLRO] -- BEGIN task-####-- group-#####-- vim.Folder.unregisterAndDestroy -- ...
verbose vpxd[#####] [Originator@6876 sub=alarmMo opID=...] [ProcessEntityRemoved] Entity has been destroyed: group-######
  
  
• To track future folder movements, enable verbose logging (this does not require a service restart):
  • Log into the vSphere Client as an administrator.
  • Navigate to vCenter Server > Configure > Advanced System Settings.
  • Change the config.log.level parameter to verbose.

Additional Information

For detailed steps on how to retrieve and download logs from vCenter, see the steps here or refer to Creating and Managing Broadcom Support Cases if further assistance is required.