Hyper-V VM Import audit

Question

Hyper-V VM Import audit

Sugan Raj Sundararaj 1

Hi All,

There has been VM movement from one hyper-v cluster to other hyper-v cluster and our management want to know who has performed the VM import on specific cluster from logs. Kindly let me know the specific log to audit successful VM import activity by an individual in hyper-v server.

Regards,
Sugan

3 answers

Your answer

Answer 1

SUNOJ KUMAR YELURU 15,491 MVP Volunteer Moderator

Hi @Sugan Raj Sundararaj

Below are the current event log channels for Hyper-V. Using "Event Viewer" you can find them under "Applications and Services Logs", "Microsoft", "Windows". If you would like to collect events from these channels and consolidate them into a single file

How to collect cluster diagnostic logs from the hyper-v host

----------

Please don’t forget to Accept the answer and up-vote wherever the information provided helps you, this can be beneficial to other community members.

Sugan Raj Sundararaj 1 Reputation point

2021-01-15T15:11:55.957+00:00

Hi I am aware the logs section specific to Hyper-V . What i need to know is a VM import performed by user get logged there. On check i found only errors get logged there not any successful import. So needed more clarity on same.

Answer 2

Mico Mi 1,936

Hi,
Do you mean you want to track who has imported VM to another cluster in logs? If there is any misunderstanding, please feel free to let me know.
By default, Hyper-V cannot audit or track the user account who did changes to a VM in logs. But something like VMware, SCVMM or third-party software can meet your needs.

Thanks for your time!
Best Regards,
Mico Mi

-----------------------------

If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Sugan Raj Sundararaj 1 Reputation point

2021-01-15T15:15:02.217+00:00

Hi Mico,

You are right I need to i need to know the user who has imported the VM to hyper-v host from logs. Unfortunately on logs i always see SYSTEM as user when an VM action if performed by user. In SCVMM it reflects as VM moved state log but that also has vmm service account. So currently we are unable to track who did the activity.

Regards,
Sugan

Answer 3

Hi,
Maybe you can try some third-party softwares, such as:
Netwrix

Virtual Appliance

Fully supported and tested on Hyper-V and VMware hypervisors.

EventLog Analyzer

EventLog Analyzer offers two major groups of reports for auditing your Hyper-V servers.
Hyper-V server event reports: Report on the internal structure of Hyper-V servers and any changes made in them.
Hyper-V VM management reports: Report on the VMs that are hosted on Hyper-V servers. You can monitor changes to VMs as well as all activities related to the VM Management Service.

Best regards,
Mico Mi

If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Share via

Hyper-V VM Import audit

3 answers

Your answer