answer in the link.
http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2005478
To determine which user removed or deleted a virtual machine, check the vCenter Server Events tab for the host or cluster on which the virtual machine resided.
If the Events tab does not provide a record far back enough, you can export user events.
To export user events:
- With the vSphere client connected to the vCenter Server, click File > Export > Export Events.
- Ensure the type User is selected.
- Choose a time range using the From and To dropdowns.
- Click OK.
- Open the text file that is created, navigate to the end of the file, and search backward for the name of the virtual machine. The username of the user that removed or deleted the virtual machine displays.
