Skip to main content
Answer

Audit of active VMware virtual machines?

  • June 28, 2013
  • 5 replies
  • 19 views
S
Forum|alt.badge.img+13

Hi,

I need to do an audit to get a list of which of our Macs have an active VMware virtual machine installed. It's sort of been "every man for himself" with regard to people installing Windows VMs, but there is an effort underway to get these VMs bound to our Active Directory domain and managed by IT (so they can have AV and patches, etc. the same way our Windows desktops do).

I can easily find out who has VMware Fusion installed... but that tells me nothing, because somewhere along the line a past employee added VMware Fusion to our default configuration, so a great many people have the app, but don't have a license installed or any VMs created.

Best answer by mm2270

Yeah, Application Usage logs could do it, but as dpertschi mentions, its a pain to make the output usable.

Another option would be an Extension Attribute that utilizes the power of the Spotlight API.

Try something like this against a system to see what it gives you. It pulls the Last Opened Spotlight information for VMware Fusion.app-

#!/bin/sh

FusionPath=$( mdfind "kMDItemCFBundleIdentifier == 'com.vmware.fusion'" | head -1 )

if [ "$FusionPath" != "" ]; then
    result=$( mdls "$FusionPath" | awk '/kMDItemLastUsedDate/{ print $3,$4 }' )
else
    result="VMware Fusion not installed"
fi

echo "<result>$result</result>"

On my Mac it returns:

<result>2013-06-28 20:48:47</result>

which incidentally is the perfect format for a Date type Extension Attribute. You can then build groups or queries based on Macs that haven't opened it within X number of days. This won't help you know if the user has active VMs in it but it will at least tell you that they've launched the application.

EDIT: And of course I'm completely forgetting that the Casper Suite comes with an Extension Attribute right in the templates that pulls all installed Fusion VMs as well. Take a look in Settings > Inventory Options > Inventory Collection Preferences > Extension Attributes. Then click the Add Extension Attribute From Template link and turn down the Virtualization list. Add in "VMware - Virtual Machine List" That should collect all the VMs on the Macs.

I think in conjunction with the last used EA I posted above, you should be able to build a report of machines with VMs that have been used recently.

    5 replies

    dpertschi
    Forum|alt.badge.img+19
    • dpertschi
    • Contributor
    • June 28, 2013

    First thing that comes to my mind is to make a Licensed Software entry for it, and then use the Application Usage Logs to find out which machines are actually running it.

    The output is hard to deal with though, you have to click through each record to reveal amount of usage. I never figured out otherwise how to use that data more efficiently for reporting. But it's there.

    mm2270
    Forum|alt.badge.img+24
    • mm2270
    • Legendary Contributor
    • Answer
    • June 28, 2013

    Yeah, Application Usage logs could do it, but as dpertschi mentions, its a pain to make the output usable.

    Another option would be an Extension Attribute that utilizes the power of the Spotlight API.

    Try something like this against a system to see what it gives you. It pulls the Last Opened Spotlight information for VMware Fusion.app-

    #!/bin/sh

FusionPath=$( mdfind "kMDItemCFBundleIdentifier == 'com.vmware.fusion'" | head -1 )

if [ "$FusionPath" != "" ]; then
    result=$( mdls "$FusionPath" | awk '/kMDItemLastUsedDate/{ print $3,$4 }' )
else
    result="VMware Fusion not installed"
fi

echo "<result>$result</result>"

    On my Mac it returns:

    <result>2013-06-28 20:48:47</result>

    which incidentally is the perfect format for a Date type Extension Attribute. You can then build groups or queries based on Macs that haven't opened it within X number of days. This won't help you know if the user has active VMs in it but it will at least tell you that they've launched the application.

    EDIT: And of course I'm completely forgetting that the Casper Suite comes with an Extension Attribute right in the templates that pulls all installed Fusion VMs as well. Take a look in Settings > Inventory Options > Inventory Collection Preferences > Extension Attributes. Then click the Add Extension Attribute From Template link and turn down the Virtualization list. Add in "VMware - Virtual Machine List" That should collect all the VMs on the Macs.

    I think in conjunction with the last used EA I posted above, you should be able to build a report of machines with VMs that have been used recently.

    R
    Forum|alt.badge.img+33
    • rich.trouton
    • Hall of Fame
    • June 28, 2013

    You can also pull info from VMware Fusion's plist file to see how many VMs are set up and which OSs are installed in those VMs, even if the VM itself is offline:

    http://derflounder.wordpress.com/2012/12/18/pulling-guest-os-information-from-offline-vmware-fusion-vms/

    S
    Forum|alt.badge.img+13
    • stevehahn
    • Author
    • Contributor
    • July 2, 2013

    Thanks so much, everyone--great info. I managed to create an Extension Attribute as mm2270 suggested.

    R
    Forum|alt.badge.img+12
    • rmanly
    • Contributor
    • July 3, 2013

    @mm270 thanks for your post! I always forget about spotlight's attributes. kMDItemLastUsedDate and kMDItemUsedDates are just what I need for a current problem. :D

    Does anyone know the maximum number of entries for kMDItemUsedDates?

    p.s. you can also pass mdls the keyword(s) you want as an argument ;)

    mdls -name kMDItemLastUsedDate /Applications/TextEdit.app
    Terms & ConditionsCookie settingsAccessibility statement