top of page

Created and Deleted VMs with Aria Operations for Logs

  • Writer: Brock Peterson
    Brock Peterson
  • Apr 18
  • 2 min read

Updated: Apr 19

I was trying to determine VMs built this month with Aria Operations and came up with this.

ree

Top left is a List View leveraging the "interval breakdown" and an "expression transformation.

ree

The bottom widget is another List View filtering on VMs built in the last 30 days.

ree

This isn't bad, but I'd like to get the VM creator, which isn't available as of 8.18.3. I do have a feature request open for this. If you'd like this Dashboard (and Views) you can get them here.


I was also looking to get VMs that have been deleted this month, but there isn't a super clean way to do this. One way would be to list all VMs with Health of -1, indicating they are no longer reporting, but this doesn't necessarily mean they've been deleted. You also need to consider how long you're keeping deleted objects in Operatinos, if it's less than 30 days your total won't be accurate. So, I turned to Operations for Logs.


If you've installed the VMware - vSphere Content Pack you'll notice several Dashboards, including one called Virtual Machine - Overview.

ree

This is promising! Exploring the VMs created and VMs deleted widgets, I adjusted them to my liking. My VMs Created widget looks like this.

ree

My VMs Deleted widget looks like this.

ree

I used these same querys to populate additional widgets, using different formats, to come up with this.

ree

You'll notice details at the bottom showing who created and deleted the VMs. Viewing them in Explore Logs, you'll see even more.

ree

Not exactly what I wanted, but I now have visibility into who is creating and deleting VMs. If you would like this Dashboard you can get it here.


I do have a feature request open to get these events into Operations, specifically the new (as of 8.18) Audit Events blade. Ultimately, I'd like to be able to generate an alert/notification or simply export them from there. Until then, use Logs!

2 Comments


Matt H
Matt H
May 14

Hey Brock this is great - but the VM creation widget/query is picking up snapshots as "create vm snapshot' because includes the create vm text string in the query. Any way to update this to exclude those?

Edited
Like
Brock Peterson
Brock Peterson
May 21
Replying to

Hey Matt! Adjust the vmw_vc_task_type contains to matches regex ^(create|clone) virtual machine$


ree

Like
    bottom of page