Determining which user removed or deleted a virtual machine

quite a common question for vm sysadmin, may i know who deleted the vm?

answer in the link.

http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2005478

To determine which user removed or deleted a virtual machine, check the vCenter Server Events tab for the host or cluster on which the virtual machine resided. 

 

If the Events tab does not provide a record far back enough, you can export user events.

 

To export user events:

1. With the vSphere client connected to the vCenter Server, click File > Export > Export Events.
2. Ensure the type User is selected.
3. Choose a time range using the From and To dropdowns.
4. Click OK.
5. Open the text file that is created, navigate to the end of the file, and search backward for the name of the virtual machine. The username of the user that removed or deleted the virtual machine displays.

Keeping VMTools ALWAYS up to date

Dear sysadmins out there, how do you guys keep the VMtools and virtual hardware up to date, all the time? Less than 20 VM would still be manageable, but hundreds of them, with some are in live production environment is not an easy task.

The task should be split into two parts:

1) Get all the VMtools up to date

2) Upgrade virtual hardware

This would require at least 2 downtimes. First downtime is a reboot once VMtools installed. 2nd downtime is to power off the VM and do the virtual hardware upgrade. Note that virtual hardware should only be upgraded once the VMtools is updated or you might lose the network setting on that VM.

There is an option to keep the VMtools checked during each power cycle. Found a link to get that massed using powerCLI (http://damiankarlson.com/2011/01/23/managing-vmware-tools-advanced-options-powercli/) but for the first round it could be the manual option. 

1st update:
One liner to get the VMtool and virtual hardware version status:
Get-VM | select Name,Version,@{N="Tools Status";E={$_.Guest.Extensiondata.ToolsVersionStatus}}

2nd Update:
One liner is not good enough, my plan is to align the VMtool upgrade during patching windows (subject to approval)

first, script to get the details.

Function Get-myPatchingReport {
#sample get-vm | % { Get-myPatchingReport $_ } | ft -a
param ($VM)
$report = @()
$row = "" | select Name, OS, Version, ToolStatus
$v = get-vm $VM | get-view
$get = get-vm $VM
$row.Name = $VM
$row.OS = $v.Guest.GuestFullName
$row.Version = $get.Version
$row.ToolStatus = $get.Guest.Extensiondata.ToolsVersionStatus
$report += $row
$report
}

export the report to csv/xls and compare to the patching master list for the exact window. Since some VMs are still running Win2k3, they will not be in patching list. Thus, the Guest OS that is captured from the script.

Going to update this (again) later after I got some live data.
*edit: script was badly coded it will create large temp files and took very long time to complete if you have large environment. will work for about 20-30 vm. else just export the list from vcenter.

Disk drive is write protected, Unable to create file with File system error (65535)

Some simptoms:


Unable to create file with File system error (65535)

Whenever I try to create new file in my one of my system drives it is displaying "Unable to create file xxxx.txt". File system error(65535) Previously I was able to create/delete files.

Now every thing related to file operations are getting failed (create/delete/modify).

For file modify following error message is displayed "The drive cannot fine sector requested".



Second hard drive says write-protected
I've got a new 2008 enterprise terminal server. I've installed all my apps to the 2nd hard drive. Now for no reason, I can't write to the drive and my apps can't either as they all crash as soon as they need to.

I get this exact error when simply trying to create a directory in the root of the drive:

"The disk is write-protected.

Remove the write-protection or use another disk."

I'm logging in as the local admin, domain admin makes no diff. I've also given full permissions to "everyone" with no luck. How the heck can I fix this bugger?

Solution:

It could be that the ReadOnly flag is on, do the following


on cmd prompt launch "diskpart.exe"

on the diskpart prompt, do the following

LIST DISK

This will give you a list of all disks in your system
Note down the number of your problem disk, then do the folloiwng

SELECT DISK x

Where x is the number of your problem disk, then do the following

DETAIL DISK

This will list all the details of your problem disk
Check if the ReadOnly flag is set to Yes

If the ReadOnly flag is set to Yes, do the follwing

ATTR DISK CLEAR READONLY

This should clear the flag on the disk, please retry your disk operations

If ths does not solve it, we have another flag on the volume, same command, but now on volume:

LIST VOLUME

SELECT VOLUME x

DETAIL VOLUME

ATTR VOLUME CLEAR READONLY

How to remove ESXi from domain (AD)

This is how to leave a domain for ESX server (for whatever reason you have).


1) Put the ESX in maintenance mode
2) Go to Configuration > Authentication Services
3) click on Properties
4) On the Domain Settings, click button Leave Domain
5) Exit maintenance mode

on the error event "Leave Windows Domain: The operation is not allow in the current state", try to reboot the ESX and repeat the steps. In my case, it helps.


PowerCLI command to see which ESX is still authenticated to AD:-

Get-VMHost | sort | Get-VMHostAuthentication | select vmhost,domain,DomainMembershipStatus,TrustedDomains | ft -a

Reset HP ILO using SSH

There are times when your HP ILO (Integrated Lights-Out) web interface stop responding, and you need to reset it to get it working again. You can use SSH session to do the reset. 

This will not reset the server, just the ILO session.

1) open up an SSH session (you can use PuTTy) to your ILO (using the same IP as web interface) and login
2) once in, type "cd /map1" without the quotes, then press ENTER
3) type "reset" without the quotes, then press ENTER again
4) wait for about a minute, then try to login to your web interface again.

It should be something like this. 

User:######### logged-in to ##############
iLO 2 Standard Blade Edition 2.05 at 13:38:05 Dec 16 2010
Server Name: ###################
Server Power: On 

</>hpiLO-> cd /map1 

status=0
status_tag=COMMAND COMPLETED
/map1 

</map1>hpiLO-> reset 

status=0
status_tag=COMMAND COMPLETED 

Resetting iLO. 

CLI session stopped

powershell script to get number of CPU and Memory

takes input list of servers from C:\servers.txt and output the result to C:\ram-cpu.csv

make sure your powershell/powerCLI has admin rights


get-wmiobject Win32_ComputerSystem -computer (gc C:\servers.txt) | select Name,@{name="TotalPhysicalMemory(MB)";expression={($_.TotalPhysicalMemory/1mb).tostring("N0")}},NumberOfProcessors | export-csv C:\ram-cpu.csv

Get logical disk layout from OS level (windows)

run this in powerCLI / powershell. make sure you have admin rights (elevated for the powerCLI/powershell)

it takes list of servers from c:\servers.txt and output the result to c:\Disk-GB.csv

gwmi -query "SELECT SystemName,Caption,VolumeName,Size,Freespace FROM win32_logicaldisk WHERE DriveType=3" -computer (gc c:\servers.txt) | Select-Object SystemName,Caption,VolumeName,@{Name="Size(GB)"; Expression={"{0:N2}" -f ($_.Size/1GB)}},@{Name="Freespace(GB)"; Expression={"{0:N2}" -f ($_.Freespace/1GB)}}, @{n="% Free";e={"{0:P2}" -f ([long]$_.FreeSpace/[long]$_.Size)}} | sort "Systemname","caption" | export-csv c:\Disk-GB.csv

Custom VM report, output to CSV

Note: VC, Template and Description is for manual entry, they don't have any data :)

function Get-myReport {
#sample: get-content test.txt | %{ Get-myReport $_ } | export-csv C:\testout.csv -notypeinformation

param ($VM)
$report = @()
$row = "" | select VC, Cluster, Name, Template, ResourcePool, NumCPU, RAMSizeGB, D_DriveSizeGB, VLAN, Application, BusinessUnit, Category, Support, Description


$v = get-vm $VM
$VLAN = get-virtualportgroup -vm $VM
$app = get-vm -Name $VM | get-annotation | where-object {$_.Name -eq "Application"}
$unit = get-vm -Name $VM | get-annotation | where-object {$_.Name -eq "business unit"}
$category = get-vm -Name $VM | get-annotation | where-object {$_.Name -eq "category"}
$support = get-vm -Name $VM | get-annotation | where-object {$_.Name -eq "support"}
$row.Cluster = $v.vmhost.parent.name
$row.Name = $VM
$row.ResourcePool = $v.resourcepool.name
$row.NumCPU = $v.NumCpu
$row.RAMSizeGB = $v.MemoryMB / 1024
$row.D_DriveSizeGB = ""
$row.VLAN = $VLAN.name
$row.Application = $app.value
$row.BusinessUnit = $unit.value
$row.Category = $category.value
$row.Support = $support.value

$DriveD = Get-mVMdriveD $VM
$row.D_DriveSizeGB = $DriveD.Size

$report += $row

$report

}


function Get-mVMdriveD {
param ($VM)
gwmi -query "SELECT Caption, Size FROM win32_logicaldisk WHERE DriveType=3" -computer $VM | where-object { $_.Caption -eq "D:" } | select-object @{Name="Size"; Expression={"{0:N0}" -f ($_.Size/1GB)}}

}