Or, Tracing deleted VMDK files in VMware
Or, How to check who deleted the virtual disk of the
virtual machine in VMware?
Descriptions: First thing first, Once you have deleted the virtual disk by selecting “Delete From Disk” option, VMware cant
help you to get it back as they dont have any built-in recovery solution in VMware. You may consult data recovery vendors to check for any
possibility of data restoration.
In common scenario, if the
disk was deleted by someone else or it was done unknowingly, an administrator
is always asked to trace the logs..
At first attempt, VMware
administrators prefer to check the task and events of vSphere client which is
very much useful in most of the cases but not for all the cases.
For example:
If someone have deleted the disk of VM, modified RAM capacity, or Modified CPU
capacity, vSphere will have almost similar kind of event for all these actions
(like, Reconfigure Virtual Machine). In this case, you will not be able to
understand at what stage HDD or deleted and at what stage CPU was updated.
In this article, we will see
some available options to trace the logs more efficiently for deleted vmdks.
Steps: How to trace the logs for deleted VMDK?
1. Check for the Tasks and Events
in vSphere Client for the affected Virtual Machine and note down the “Reconfigure”
event details time stamps
2. Check for the associated
Datastore from which the disk was deleted
3. Check for the Host on which
this Virtual Machine was running when the Modify event was occurred.
SSH the Host in Putty and run the following commands
sequencially
# ls -la
# cd vmfs/volumes
# ls -la
# cd Datastore
# ls -la
# cd VMName
# ls -la
# less vmware.log | less
Search for the logs:
1. (Destroying Virtual Dev for
scsix:xxx vscsi=xxxx)
2. (DISKLIB-VMFS : ‘’vmfs/volumes/xxxx-xxxxx-xxxx-xxxx-VMName/VMName-Flat.VMDK”
: Closed )
Above two highlighted events gives some clue about VMDK
deletion. It was started from term “Destroying” and completed at term “Closed”.
Cheers, Please write me back if you have any query or feedback..