This could be one of the best features that VMware added to the vSphere 6.5 release, Enhanced Logging. As a IT consultant, we often get calls such as, “X isn’t functioning, it was working 10 minutes ago”. You will immediately ask the four “W’s” – What, When, How – then someone will always ask “Who” once the issue is resolved. With enhanced logging, this is now all possible. Enhanced Logging might not be the sexiest thing, but its going to save you a lot of time troubleshooting.
In prior versions of vSphere, when you made a change to the VM, all you would see is “Reconfigured VM” and who made the change. How many times have you asked yourself, “What was the &*#* change”?
Lets look at how you can utilize Log Insight to view the “enhanced logs”.
After you make a change to a VM, you will the answers to our questions. – you can hover your mouse over “vc_username” to see made the change.
In this example, you can see the at 21:35, that the VM “ViewCS-01” had a change that disabled the NIC at Startup. You can also see what the value was prior to the change. As you can see below, the original state was “True” and was changed to false.
At this point, you can edit the configuration to the VM, and revert the change that was made – and the customer is happy.
Here is the awesome thing. If you didn’t know, if you are entitled to vCenter – you are also entitled to a 25 OSI license of Log Insight for your environment for FREE. Hopefully you will never need to use Log Insight, but it will ensure you have the logs necessary if you need to engage VMware GSS or see who made a change in one easy place.