Hi all,
fast little info that is making me bang my head all day. I need to investigate who deleted a vmdk (persistent volume).
I am accused of having deleted a vmdk (persistent volume) created specifically for kubernetes with a vmware user to whom I have granted write permissions on that volume.Obviously we didn't do anything.
I need to find who deleted vmdk
On VM Task side I see this:
Reconfigure virtual machine
Status:
File [] /vmfs/volumes/xxxx/xx/xxxx.vmdk was not found
Initiator:
user to whom I granted write permission
Target:
name of the vm
Server:
xxxx
Related events:
date, time
Task: Reconfigure virtual machine
But he does not say who has canceled it, he only says that he does not find it
I searched on vpxa and hostd but I can't find anything, I only have the last 4 days but the event dates back to 15 days ago. Ideas?