What are the ESXi Hosts that a VM has ever run on?

“Where has this VM been running in the past xxx months?” You may need to answer that to satisfy Oracle audit. You need to prove that it has not been running on Host that you have not licensed. To prove, you need to use vSphere logs. That can be difficult as vSphere produces a lot of logs.

Luckily, Log Insight can help. The following screenshot shows the query. It gets all the log entries that has a VM name, a host name and a cluster name. If you do not use Cluster, then you just exclude the cluster name. I group the result by host name. From the bar chart, it shows 3 ESXi (which is all I had in my cluster), which became 2 as I put the host into maintenance mode to save power.

The table below the chart shows all the VM name. In my example, it happens to show an Oracle VM.


If this is an Oracle VM that is the subject of audit, I could zoom into it. I simply used it as a filter, and I got the result below.

Bingo! All the ESXi hosts that ever run the VM is shown.

11 - zoomed into a VM

The chart above maybe a little too details if you need to go back far in time. You can change the level of granularity to daily, as shown below.

12 - day view and event type

For video example, watch this by VMware Spain team.

Log Insight 4.0 has the dashboard as one of its out of the box dashboard.

So that’s it! I hope it helps in proving to the Oracle audit.

One thought on “What are the ESXi Hosts that a VM has ever run on?

  1. Pingback: Why you need a Log Management platform

Leave a Reply