Script to determine who created a snapshot

Similar Questions

• Who created the snapshot

  No idea how I can relatemy Get-Snapshot information information Get-VIEvent to determine who created a snapshot?

  Thank you

  Alan

  Small question, but a long answer. In the end, I arrived.

  There were a few quirks in writing this script.

  (1) the timestamp of creation in the event object is not always exactly the same as the timestamp in the property instant VirtualMachine.

  The solution is to use the entity property of the task to get the timestamp of the snapshot.

  (2) the Get-ViEvent cmdlet returns a VimApi.ManagedObjectReference instead of a VMware.Vim.ManagedObjectReference.

  So this isn't a big problem because I can easily convert a MoRef (unfortunately not by casting).

  (3) the speed of the Get-ViEvent cmdlet is not ideal compered to the task of the collector of the API

  (2) and 3) I decided to go for the collector's working methods.

  The flow of the script is very simple.

  First create a hash of all the tasks table that created snapshots on specific comments.

  The key in the hash table is the name of the guest concatenated with the snapshot creation timestamp.

  Then the script use the cmdlet Get-Snapshot to retrieve snapshots for the guests.

  This output is built a key and then the key is used to search for the user in the hash table.

  The user property is added to the SnapshotImpl object.

  function Get-SnapshotTree{
       param($tree, $target)
  
       $found = $null
       foreach($elem in $tree){
            if($elem.Snapshot.Value -eq $target.Value){
                 $found = $elem
                 continue
            }
       }
       if($found -eq $null -and $elem.ChildSnapshotList -ne $null){
            $found = Get-SnapshotTree $elem.ChildSnapshotList $target
       }
  
       return $found
  }
  
  $daysBack = 3                            # How many days back from now
  $guestName =                           # The name of the guest
  
  $tasknumber = 999                       # Windowsize of the Task collector
  
  #$serviceInstance = get-view ServiceInstance
  $taskMgr = Get-View TaskManager
  
  # Create hash table. Each entry is a create snapshot task
  $report = @{}
  
  $filter = New-Object VMware.Vim.TaskFilterSpec
  $filter.Time = New-Object VMware.Vim.TaskFilterSpecByTime
  $filter.Time.beginTime = (Get-Date).AddDays(-$daysBack)
  $filter.Time.timeType = "startedTime"
  
  $collectionImpl = Get-View ($taskMgr.CreateCollectorForTasks($filter))
  
  $dummy = $collectionImpl.RewindCollector
  $collection = $collectionImpl.ReadNextTasks($tasknumber)
  while($collection -ne $null){
       $collection | where {$_.DescriptionId -eq "VirtualMachine.createSnapshot" -and $_.State -eq "success" -and $_.EntityName -eq $guestName} | %{
            $row = New-Object PsObject
            $row | Add-Member -MemberType NoteProperty -Name User -Value $_.Reason.UserName
            $vm = Get-View $_.Entity
          $snapshot = Get-SnapshotTree $vm.Snapshot.RootSnapshotList $_.Result
            $key = $_.EntityName + "&" + ($snapshot.CreateTime.ToString())
            $report[$key] = $row
       }
       $collection = $collectionImpl.ReadNextTasks($tasknumber)
  }
  $collectionImpl.DestroyCollector()
  
  # Get the guest's snapshots and add the user
  $snapshotsExtra = Get-VM $guestName | Get-Snapshot | % {
       $key = $_.vm.Name + "&" + ($_.Created.ToString())
       if($report.ContainsKey($key)){
            $_ | Add-Member -MemberType NoteProperty -Name User -Value $report[$key].User
       }
       $_
  }
  
  $snapshotsExtra | Export-Csv "C:\SnapshotsExtra.csv" -NoTypeInformation -UseCulture
  

  Note1: the parameter - UseCulture to the Export-Csv cmdlet is PS v2 CTP3

  Note 2: it should not be too difficult to convert the script to handle all the guests instead of one. The name of the guest is already in the key in the hash table.

• Determine which created a snapshot

  This report could be amended to take the person who created a given snapshot:

  Get - vm | Get-snapshot

  Thank you!

  In the script of SnapReminder of Alan, there is a function of my friends that retrieves the creator of a snapshot of events.

• Determine who changed the permissions

  I have a small group of people defined as administrators at the farm, I succeeded. Recently, someone brought some changes to permissions and mess. Of course, nobody has anything, so I want to determine who did the changes permissions and when. I look through logs of filtering for Word permissions, but nothing came. I'm going to make them much more limited to administrators in the very near future, but I still want to know who has changed. Is there a log somewhere that I can use to determine who made the change?

  Thank you

  Matt

  You may be interested in one of the following methods in the paintings of the event:

  RoleUpdatedEvent

  RoleRemovedEvent

  RoleEvent

  RoleAddedEvent

  PermissionRemovedEvent

  PermissionUpdatedEvent

  PermissionEvent

  PermissionAddedEvent

  I use a viperltoolkit script, found here:

  http://communities.VMware.com/servlet/JiveServlet/download/821751-4447/vmeventmgr.pl

  Create an eventlist.txt file list above and who then pass as an argument to the script.  Runs like a champ.  In fact, I run every week via cron and the results by email to me so I can check what is happening in our virtual infrastructure.  I includes a number of other types of events, such as the creation of the VM, Central, etc...  You can have it report for the last X days/weeks/hours... everything that you need.

• How to determine who has access to the training

  Hello

  I have an iomega StorCenter ix4 - 300 d set up as a network drive with several users who have permission to access. From time to time some of the scripts are unable to access one of the drives inside. For me, it seems that when that happens someone in my network uses extensively this player (the blue led continues to blink). Is there a way to determine who is using the drive or what resources are being accessed?

  Thank you very much for the help.

  Hi pegazik,

  The event log indicates if users log in to the device and make changes. There is not a way to show what is being accessed.

• Essbase calc script to determine the number of occurrence

  Hello

  is it possible within a calc script to determine the number of occurrence of a value in the account dimension?

  I have an account called ranks which can contain any value between 1 and 10.  I would like to know how many times each value is repeated for a specific cost center.  It's in a database of planning BSO.

  Thanks in advance for your contributions...

  CL

  This isn't the typical calculation you would do in an OLAP architecture, but yes it is certainly possible.

  you will need to create 10 accounts such as occurrence_of_1, occurrence_of_2 etc.

  Then you increment them according to the value of the 5th year.

  Don't forget to put in your calculation!

• Creating hidden snapshots?

  Hello

  My eq is PS6210E model 70-0425. A cluster of hyper-v (4 guests) connects via iSCSI.

  The SAN, I configured 4 instant and for replacement if necessary.

  However, I see a lot more snapshots for each volume this empty space volume... and I see that are requested by the hyper-v via the VSS hardware provider hosts. So, I opened the Auto Snapshot Manager on each host, but there is NO timetable. I also took a quick glance in the Task Scheduler... but no jobs are configured.

  Where can I look to find this snapshot planning 'ghost '?

  Thank you.

  Hello

  An application calls the Volume Shadow Service. (VSS).  Are you running the DPM?   VEEAM?  ASM allows you to create a snapshot, he put a comment in the description of the snapshot, are there comments on these snapshots 'ghost '?

  Kind regards

• Cisco ISE, who created a ticket in portal sponsor

  Hi I was wondering how do I see who created a guest in ISE of Cisco user ticket by using the Developer Portal without checking the logs of the system you have to download.

  Is there a better way to do it?

  Kind regards

  operations > reports > endpoints and users > sponsor comments summary

  The summary of Sponsor comments report displays all users comments created by each sponsor. Click on a sponsor's name to view information about guest users.

• Cisco ACS - determine who was in a particular device

  Hello

  How can I determine who was in a particular to a specific date and time device?

  Hi Steve,.

  You can use 'query and run' inside Ganymede on 5 ACS or radius Accounting section. Accounting exec provides information on Terminal sessions user EXEC (user shells) on the network access server, including the user name, date, start and stop times, the IP address of the access server.

  If you want to see what changes have been made by a specific user, then that can be verified if the accounting command is enabled on the network access device. Accounting command provides information about the shell EXEC to a specified privilege level commands that are running on a network access server. Each command accounting record includes a list of the commands executed for this level of privilege, and the date and time that each command was executed, and the user who executed. Don't forget the accounting command is only supported by Ganymede +.

  Kind regards

  Jatin kone

  * Does the rate of useful messages *.

• Inability to create the snapshot (General error) - need help

  Hello

  Since 3 days, snapshot is no longer working with one of my VM (is a production machine).

  Vsphere Client 5.5.0 I got a General in vSphere Client error when I do a snapshot. In management of snapshot section, I see no snapshot

  but when I go into the directory of the virtual machine by ssh is to see that below (there are a few photos...)

  I tried to create the snapshot with and without the data from the memory, but it always the same effect. (Snapshot is taken with the virtual machine is turned on).

  • What am I trying to consolidate the disk? Is it safe?
  • Can someone help me?

  Thanks in advance,

  Michael

  VMware - 4.log

  VMware - 5.log

  VMware - 6.log

  VMware - 7.log

  VMware - 8.log

  VMware - 9.log

  VMware.log

  VMX-prod03-64-Ubuntu-2098329481-1.vswp

  prod03-64-ubuntu-000001 - ctk.vmdk

  prod03-64-ubuntu-000001 - delta.vmdk

  prod03-64-ubuntu - 000001.vmdk

  prod03-64-ubuntu-000002 - ctk.vmdk

  prod03-64-ubuntu-000002 - delta.vmdk

  prod03-64-ubuntu - 000002.vmdk

  prod03-64-ubuntu-000003 - ctk.vmdk

  prod03-64-ubuntu-000003 - delta.vmdk

  prod03-64-ubuntu - 000003.vmdk

  prod03-64-ubuntu-000004 - ctk.vmdk

  prod03-64-ubuntu-000004 - delta.vmdk

  prod03-64-ubuntu - 000004.vmdk

  prod03-64-ubuntu-000005 - ctk.vmdk

  prod03-64-ubuntu-000005 - delta.vmdk

  prod03-64-ubuntu - 000005.vmdk

  prod03-64-ubuntu-000006 - ctk.vmdk

  prod03-64-ubuntu-000006 - delta.vmdk

  prod03-64-ubuntu - 000006.vmdk

  prod03-64-ubuntu - 7d11f789.vswp

  prod03-64-ubuntu - Snapshot137.vmsn

  prod03-64-ubuntu - Snapshot138.vmsn

  prod03-64-ubuntu - Snapshot139.vmsn

  prod03-64-ubuntu - Snapshot140.vmsn

  prod03-64-ubuntu - Snapshot141.vmsn

  prod03-64-ubuntu - Snapshot142.vmsn

  prod03-64-ubuntu - ctk.vmdk

  prod03-64-ubuntu - flat hard

  prod03-64 - ubuntu.nvram

  prod03-64 - ubuntu.vmdk

  prod03-64 - ubuntu.vmsd

  prod03-64 - ubuntu.vmx

  prod03-64 - ubuntu.vmx.lck

  prod03-64 - ubuntu.vmxf

  I found the problem

  Some VM had a disc mounted in vSphere. It worked until last week, don't know why this problem only appears now.

  After you have disconnected the CD, 'manage the snapshot' list still empty, I clicked on consolidate first, after that, back to 'manage the snapshot' and my snapshots

  appeared. And last step, I deleted this snapshot for merge all...

  Maybe this will help someone else...

• Reasons for SLOW create / delete snapshots

  Hello

  We run 5.1 ESXi hosts in a cluster.

  We have added a number of virtual machines to the cluster, and so the use of the memory of each ESXi host is about 60%.  Network administrator also performs a network change lately (he said it shouldn't affect VMWare).

  However, it takes much more time for us to create / delete snapshot.  Wonder if it may be due to network problem OR just we are running out of memory in ESXi hosts / SAN Performance?

  Your opinion is requested.

  Hello

  Before we dive more deep, the main issue here - what is was exactly the scope of this network change? It seems that something has changed on the network affecting the connection between ESXi host & network storage interfaces shared. Also, you must ensure that change did not affect VAAI availability on your space of storage as well as snapshots are handled directly on the drive bays. A delta disc is created, the basic disk is read-only and all writes are then carried out on delta drive. The snapshot delete commits these changes. But of course, you should check your SAN performance if it does not hit the bottleneck by chance (CPU, memory, input/output).

  If you get the information on what has changed, we can help you further.

• POS upgrade again create a snapshot

  I am currently trying to improve our 5.5.5.180 to 5.8 VDP device. I followed the guide of upgrade and created the snapshot required, but when I try to start the upgrade I get always the same message telling me to create a snapshot first. I also tried the upgrade to 5.5.6 but with the same result. If anyone has had this problem or know a solution?

  It turns out the password user VDP become invalid for some reason, but I certainly did not change. Apparently just VDP didn't see the snapshot because it could not connect to the Server vCenter. After you set a new password and reconfiguration WTP runs the upgrade now.

• standby of the comments file system create two snapshot files

  Why would or should suspend the comments file system create two snapshot files.

  In our environment, we have the following VMDK.

  Syntest.VMDK

  Syntest_1.VMDK

  Syntest_2.VMDK

  Syntest_3.VMDK

  Syntest_4.VMDK

  When I create a snapshot that suspends the comments file system it creates two syntest_1 - 000001.vmdk and syntest_1.000002.vmdk (as well as all of the files for snapshots).  Here is a screenshot.

  

  Why and is at - it something wrong?   I can find a ton of articles on stereotypes, but nothing that speaks.

  We are currently on ESXi 5.1.0,1157734.

  Thank you

  Mike

  Out of curiosity. Are two snapshots created even when you create the snapshot manually?

  With backup applications, this behavior is not uncommon. The first snapshot is created for the virtual machine write them changed data, while the current is/instant backup, and the second snapshot is created by the backup software to attach the virtual disk basic to the host/proxy backup as "independent - not persistent. Once the virtual disk is disconnected from the proxy the second snapshot will be discarded and then the first snapshot will be validated for the basic disk.

  CBT information should not be reset somehow, but updated as changed during the backup data.

  André

• «FAILED: failed to create a snapshot of the source volumes VSS.» Error code: 2147754758 (0 x 80042306). "Down to 1% with autonomous converted 5.5

  Hi all

  I'm trying to convert a physical Windows 2008 R2 (SP1) virtual, using Vmware vCenter Converter Standalone version 5.5 build 1362012, it fails at 1% (after around 40mins) with the following message

  Failed: Failed to create a snapshot VSS of the source volumes. Error code:
  

  2147754758 (0 x 80042306).

  
  

  Windows systems has some LUN (4 x each various size GB) San, being the GUID (GPT) Partition Table.  I went through the wizard as a general rule, by selecting "edited on the machine", a player selected vmware "vmware workstation" or another vmware virtual machine destination 6.0.x and the location of the target being a LUN with 500 GB of space.

  Now for the data to be copied I selected 3 LUN (on a database resides) and put the 'Size' option (but I tried to keep the size of the various passes) to save space.

  
  

  Looking through the logs, I see the following errors

  Server-convert-VMware - 1.log

  2014 01-16 T 19: 42:37.371 - 07:00 [info 08696 'Default'] [serviceWin32, 416] Server vmware-converter service started

  2014 01-16 T 19: 42:51.006 - 07:00 [08696 info "Libs"] username [ADS] Get failed: 1332

  2014 01-16 T 19: 42:51.006 - 07:00 [08696 info "Libs"] [ADS] subtle failed: 1312

  2014 01-16 T 19: 42:51.115 - 07:00 [info 08696 'Default'] [user, 874] successfully authenticated the user administrator of the local computer (by using pipe)

  2014 01-16 T 19: 43:38.898 - 07:00 [10116 info "Libs"] username [ADS] Get failed: 1332

  2014 01-16 T 19: 43:38.898 - 07:00 [10116 info "Libs"] [ADS] subtle failed: 1312

  2014 01-16 T 19: 43:39.023 - 07:00 [info 10116 'Default'] [user, 874] successfully authenticated the user administrator of the local computer (by using pipe)

  2014 01-16 T 19: 43:39.647 - 07:00 [info 07628 "ThreadPool"] Thread has enlisted

  2014 01-16 T 19: 44:26.152 - 07:00 [08696 error 'Ufa.HTTPService'] cannot read the request; flow: io_obj p:0x0141b84c, h:-1, < tube "\\.\pipe\vmware-converter-server-soap" >, < pipe "\\.\pipe\vmware-converter-server-soap" > >, error: class Vmacore::TimeoutException (operation timed out)

  2014 01-16 T 19: 47:32.

  Worker-converter-VMware - 1.log

  2014 01-16 T 19: 47:34.323 - 07:00 [warning 07248 "Default"] disk number 1 has been ignored due to errors when reading partition table

  2014 01-16 T 19: 47:34.323 - 07:00 [warning 07248 "Default"] disk number 1 has been ignored due to errors during playback of dynamic disks header or LDM database is corrupt

  2014 01-16 T 19: 47:34.323 - 07:00 [warning 07248 'Default'] [MoveActiveDiskIfNeeded] GetFirstBootDisk failed, error mntapi: 176

  2014 01-16 T 19: 47:34.323 - 07:00 [warning 07248 'Default'] score: Invalid magic number sector.

  2014 01-16 T 19: 47:34.323 - 07:00 [warning 07248 'Default'] score: Invalid magic number sector.

  2014 01-16 T 19: 47:34.323 - 07:00 [warning 07248 'Default'] [PopulateCapabilities] based on the Volume of cloning has been disabled due to: no volume is recognized >

  ..

  2014 01-16 T 19: 47:34.323 - 07:00 [warning 07248 "Default"] Partition: ERROR: MBR sector must be present and valid initialize to GPT disk.

  2014 01-16 T 19: 47:34.354 - 07:00 [info 07248 'Default'] signature of disk found 80a2884a-05e9-4c1b-81-3d-35-1b-a3-6c-4b-bc, drive to 225981112, sectors 512 sector size size

  2014 01-16 T 19: 47:34.354 - 07:00 [info 07248 "Default"] Partition found type Efi system / single 4078aaff-430e-4825-bf-07-67-c6-ab-a1-87-3f

  ...

  2014 01-16 T 19: 47:37.365 - 07:00 [info 07596 "ThreadPool"] wire removed from the list

  2014 01-16 T 19: 47:37.412 - 07:00 [10164 info "ThreadPool"] Thread has enlisted

  2014 01-16 T 19: 47:37.459 - 07:00 [info 07696 "Default"] MNTAPI: mounted volume \\.\vstor2-mntapi20-shared-444D494F3A49443AFFAA78400E432548BF0767C6ABA1873F03000000\ FS: <>

  2014 01-16 T 19: 47:37.584 - 07:00 [info 07696 "Default"] error 0 when calling GetVolumeInformation for \\.\vstor2-mntapi20-shared-444D494F3A49443AFFAA78400E432548BF0767C6ABA1873F03000000\ FS: <>

  2014 01-16 T 19: 47:37.677 - 07:00 [info 07696 "Default"] error 0 when calling GetVolumeInformation for \\.\vstor2-mntapi20-shared-444D494F3A49443AFFAA78400E432548BF0767C6ABA1873F03000000\ FS: <>

  2014 01-16 T 19: 47:37.755 - 07:00 [info 07696 "Default"] error 0 when calling GetVolumeInformation for \\.\vstor2-mntapi20-shared-444D494F3A49443AFFAA78400E432548BF0767C6ABA1873F03000000\ FS: <>

  2014 01-16 T 19: 47:37.849 - 07:00 [info 07696 "Default"] error 0 when calling GetVolumeInformation for \\.\vstor2-mntapi20-shared-444D494F3A49443AFFAA78400E432548BF0767C6ABA1873F03000000\ FS: <>

  2014 01-16 T 19: 47:37.942 - 07:00 [info 07696 "Default"] error 0 when calling GetVolumeInformation for \\.\vstor2-mntapi20-shared-444D494F3A49443AFFAA78400E432548BF0767C6ABA1873F03000000\ FS: <>

  2014 01-16 T 19: 47:38.052 - 07:00 [info 07696 "Default"] error 0 when calling GetVolumeInformation for \\.\vstor2-mntapi20-shared-444D494F3A49443AFFAA78400E432548BF0767C6ABA1873F03000000\ FS: <>

  2014 01-16 T 19: 47:38.098 - 07:00 [10164 info "ThreadPool"] wire removed from the list

  2014 01-16 T 19: 47:38.098 - 07:00 [info 03736 "ThreadPool"] Thread has enlisted

  I wonder if the converter is not able to work on the GPT partitions?  (I think I saw some discussion of the community on this problem using v.5.1, but using 5.5 should be resolved?)

  Any help is appreciated. Thank you

  Your problem is with VSS, it is probably the lack of space, to seek solutions and similar problems.

  Errors that you see are expected, we need a full newspaper bundle for investigation and don't warry on GPT disks, they are supported with converter 5 +.

• Create the snapshot and paste in different PDF in Adobe Reader DC is broken

  Creating a snapshot and pasting to a different PDF in Adobe Reader DC are broken

  When I paste the snapshot to the 2013 Word and copy it again I can stick it in the PDF without problem.

  Hello

  Can you please let me know the complete workflow, exactly what you're trying to achieve?

  Copy paste & images is part of edition & you can't edit PDF using the Adobe Acrobat Reader DC.

  For this will need you Adobe Acrobat application (Adobe Acrobat free trial downloadversion |) Acrobat Pro DC).

  Kind regards

  Nicos