Getting the username of snapshot owners/creators in vSphere

Have you ever taken a snapshot of a virtual machine that you forgot to delete afterwards? Me too.

If snapshots never get deleted they can grow in size and affect the performance and stability of the virtual machine.

The “Get-Snapshot”-cmdlet does not contain the username of the admin who took the snapshot, therefor I wrote an advanced function that can get this information.

I know there are other scripts for doing this, but those did not work in our environment and instead of debugging them it was easier to just create a new one πŸ™‚

I’m guessing a lot of you have different accounts for administering vSphere and using e-mail, so you might need to parse the username you get back before looking up the users e-mail in Active Directory, and since this is probably pretty specific for your environment I didn’t see much of a reason to publish the script we use to loop through the snapshots.

But get the username from the function, check when the snapshot is created (CreatedTime) and if it is greater than your threshold then send out an e-mail, and you are done πŸ™‚

The function returns the name of the VM, the size of the snapshot (in mb), the name of the snapshot, Id of the snapshot, the Creator (username) and the time when it was created.

The code for this function is available here.

I would also like to credit Dave Garnar who did most of the heavy lifting in figuring out where to find the username information and was kind enough to post it in this post. I basically just created an advanced function out of it, nothing fancy.

2 thoughts on “Getting the username of snapshot owners/creators in vSphere

  1. Chandan Hegde

    How have run the above script in my environment . But could not able to collect creator information for older the snapshots.How will I able to collect those information .

    1. Anders Post author

      Hi Chandan,
      Sorry for a late reply, missed your comment. You can try to create a bigger timespan by modifying the lines:
      $Filter.Time.beginTime = ((($Snapshot.Created).AddSeconds(-5)).ToUniversalTime())
      $Filter.Time.EndTime = ((($Snapshot.Created).AddSeconds(5)).ToUniversalTime())

      Try making it bigger (-3600/3600 for example) and see if it makes a difference. I guess it can also be an issue with the old events being overwritten/dropped due to log retention if they are really old. In that case I don’t think there is much you can do about it I’m afraid.


Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.