The list of events and tasks that vCenter maintains for each object in the inventory are extremely useful for forensics analysis in a vSphere environment.  For identifying who created or deleted a VM, resized a vmdk, or shut down a VM or host, events and tasks are where you look. In it’s default state, however, the events and tasks views in vCenter have some major issues (from a forensic point of view).

Continue reading