Who powered off/on what VM and when in vSphere

The answer to the above question can be answered easily with Log Insight. I used the 2 built-in variables, which will ensure the log entry has user name and VM name. To filter all non power activity, I specify the string “power”. This will include both power on and power off.

Apparently, the log entry included irrelevant entry. That was easy to filter. Just click on the entry and filter the text out, like what I did below.

The result is a table showing who powered on or powered off which VM and when. You get the host, cluster, data center, vCenter also. I hide the time stamp. You can easily bring it back by clicking the Columns link. Notice I hide 11 columns, so there are other info that Log Insight can show.


I grouped the above chart by the VM Name. You can easily change it. Below is how to do it. Notice I’ve grouped it by user name. This is just a lab, as I used root a lot (not a good discipline!). I should have used proper AD name.


For more Log Insight tips, I highly recommend Steven Flander’s blog.

One thought on “Who powered off/on what VM and when in vSphere

  1. Pingback: Newsletter: March 1, 2015 | Notes from MWhite

Leave a Reply