Created and Deleted VMs with Aria Operations for Logs

I was trying to determine VMs built this month with Aria Operations and came up with this.

Top left is a List View leveraging the "interval breakdown" and an "expression transformation.

The bottom widget is another List View filtering on VMs built in the last 30 days.

This isn't bad, but I'd like to get the VM creator, which isn't available as of 8.18.3. I do have a feature request open for this. If you'd like this Dashboard (and Views) you can get them here.

I was also looking to get VMs that have been deleted this month, but there isn't a super clean way to do this. One way would be to list all VMs with Health of -1, indicating they are no longer reporting, but this doesn't necessarily mean they've been deleted. You also need to consider how long you're keeping deleted objects in Operatinos, if it's less than 30 days your total won't be accurate. So, I turned to Operations for Logs.

If you've installed the VMware - vSphere Content Pack you'll notice several Dashboards, including one called Virtual Machine - Overview.

This is promising! Exploring the VMs created and VMs deleted widgets, I adjusted them to my liking. My VMs Created widget looks like this.

My VMs Deleted widget looks like this.

I used these same querys to populate additional widgets, using different formats, to come up with this.

You'll notice details at the bottom showing who created and deleted the VMs. Viewing them in Explore Logs, you'll see even more.

Not exactly what I wanted, but I now have visibility into who is creating and deleting VMs. If you would like this Dashboard you can get it here.

I do have a feature request open to get these events into Operations, specifically the new (as of 8.18) Audit Events blade. Ultimately, I'd like to be able to generate an alert/notification or simply export them from there. Until then, use Logs!