Scribd
Upload
28 views1 page

VMware Auditing Quick Reference Guide

This document provides information on auditing events in a VMware environment using different tools. It outlines how to view events in the vSphere Web Client, vSphere Client, and using PowerCLI commands. It also lists some common VMware events that can be monitored such as VM power on/off, account changes, permissions changes, and more. Finally, it advertises a free trial of Netwrix Auditor for comprehensive event monitoring in VMware environments.

Uploaded by

fptstop
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
28 views1 page

VMware Auditing Quick Reference Guide

This document provides information on auditing events in a VMware environment using different tools. It outlines how to view events in the vSphere Web Client, vSphere Client, and using PowerCLI commands. It also lists some common VMware events that can be monitored such as VM power on/off, account changes, permissions changes, and more. Finally, it advertises a free trial of Netwrix Auditor for comprehensive event monitoring in VMware environments.

Uploaded by

fptstop
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd

Quick Reference Guide

VMware Auditing
VMware vCenter Server 4.1-6.0

VCenter Events View


Run vSphere Web Client on your vCenter server > Navigate to
Events Tab > Event Console will open where you can find all
events happened with your virtual machines

vSphere Events View


Run vSphere Client on your computer > Select a Host > Navigate to
Events Tab > Event Console will open where you can find all
events happened with your virtual environment

PowerCLI Events View

Common VMware
Events:

Run VMware PowerCLI connect to your vCenter using command:


Connect-VIServer server servername
Execute command Get-VIEvent
You can get more information by executing: Get-Help Get-VIEvent
You can specify parameters by adding the monitored event from
the Common VM Events list into this script (save this script in txt
file with .ps1 extension) and run this script in PowerCLI console:

Get-VIEvent -Start (Get-Date).adddays(-120) | `


where {$_.gettype().Name -eq "add event here and $_.CreatedTime -lt (Get-Date).adddays(1)} | `
select @{N="VMname"; E={$_.[Link]}},
@{N="OccuredTime"; E={$_.CreatedTime}},
@{N="Hostname"; E={$_.[Link]}},
@{N="Username"; E={$_.UserName}}
You can also select different date range by changing adddays
parameter.

VmPoweredOffEvent VM powered
off
VmPoweredOnEvent VM powered
on
VmSuspendedEvent VM
suspended
AccountCreatedEvent Account
created
AccountRemovedEvent Account
removed
AccountUpdatedEvent Account
updated
EnteredMaintenanceModeEvent
Entered maintenance mode
ExitMaintenanceModeEvent Exit
maintenance mode
PermissionAddedEvent
Permission added
PermissionRemovedEvent
Permission removed
PermissionUpdatedEvent
Permission updated
UserLoginSessionEvent User login

UserLogoutSessionEvent User
logout
UserPasswordChanged User
password changed
AlarmAcknowledgedEvent Alarm
acknowledged
BadUsernameSessionEvent
Invalid user name
ClusterCreatedEvent Cluster
created
ClusterDestroyedEvent Cluster
deleted
You can find full list of events here
[Link]/vmevents

Gain #completevisibility into all activity in your VMware environment


for free with Netwrix Auditor for VMware: [Link]/go/trial-vm

Corporate Headquarters:
300 Spectrum Center Drive, Suite 1100,
Irvine, CA 92618

Toll-free: 888-638-9749

Int'l: 1-949-407-5125
EMEA: 44 (0) 203-318-0261

[Link]/social

You might also like