Virtual machines with large file size utilization

Last updated
Save as PDF
Share
1. Share
2. Tweet
3. Share

VMware stores several critical files for each virtual machine. Depending on configurations or usage, the overall space consumed by these files might grow large. In some cases, excessive snapshotting might be contributing to the overall file size. You want to identify virtual machines consuming large amounts of file space to determine if you can perform any cleanup to reduce the amount of space being used.

Data required

VMware. This procedure depends on data primarily obtained from the Splunk Add-on for VMware Metrics; however, log and event data from the VMWare environment can also provide additional insights into general VMWare environment health. Therefore, for best performance, you should also download and install Splunk Add-on for VMware ESXi Logs and Splunk Add-on for vCenter Logs.

Procedure

Ensure that you have installed the IT Essentials Work app to onboard VMware data and provide the various VMware entity type configurations and dashboards.
Ensure that you are collecting VMware data through one or more Data Collection Nodes, which are essentially Splunk heavy forwarders with specific VMware collection configurations.
Run the following search. You can optimize it by specifying an index and adjusting the time range.

| mstats latest(vsphere.vm.datastore.storage_committed) AS storage_committed latest(vsphere.vm.datastore.storage_uncommitted) AS storage_uncommitted latest(vsphere.vm.datastore.storage_used_percent) AS storage_used_percent WHERE (index=vmware-perf-metrics) AND entity_type=vsphere.vm span=1m BY name 
| dedup name sortby - _time 
| eval total_file_size_gb=round(storage_committed/1024/1024/1024,2), used_percent=round(storage_used_percent,2), total_uncommitted_gb=round(storage_uncommitted/1024/1024/1024,2), total_available_storage_gb=(total_file_size_gb+total_uncommitted_gb)
| sort - total_file_size_gb
| fields - storage_committed storage_uncommitted storage_used_percent
| table name total_file_size_gb total_uncommitted_gb total_available_storage_gb used_percent
| rename name AS "Virtual Machine"

Search explanation

The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.

Splunk Search	Explanation
`\| mstats latest(vsphere.vm.datastore.storage_committed) AS storage_committed latest(vsphere.vm.datastore.storage_uncommitted) AS storage_uncommitted latest(vsphere.vm.datastore.storage_used_percent) AS storage_used_percent WHERE (index=vmware-perf-metrics) AND entity_type=vsphere.vm span=1m BY name`	Search only VMware datastore inventory data.
`\| dedup name sortby - _time`	Remove duplicate managed object IDs (MOIDs).
`\| eval total_file_size_gb=round(storage_committed/1024/1024/1024,2), used_percent=round(storage_used_percent,2), total_uncommitted_gb=round(storage_uncommitted/1024/1024/1024,2), total_available_storage_gb=(total_file_size_gb+total_uncommitted_gb)`	Convert bytes to gigabytes and round per metric.
`\| sort - total_file_size_gb`	Sort results with the virtual machines taking up the most space first.
`\| fields - storage_committed storage_uncommitted storage_used_percent`	Remove the fields shown from the results.
`\| table name total_file_size_gb total_uncommitted_gb total_available_storage_gb used_percent`	Display the results in a table with columns in the order shown.
`\| rename name AS "Virtual Machine"`	Rename the field shown for better readability.

Next steps

The table below shows sample results for the search. This data gives good insight on where space is consumed on a per VM basis and can be used to determine where to optimize space.

`moid`	`total_files`	`total_file_size_gb`	`snapshots`
`vm-18`	`15`	`83.55`	`0`
`vm-211`	`18`	`24.56`	`0`
`vm-209`	`20`	`24.25`	`0`
`vm-192`	`21`	`24.16`	`0`
`vm-234`	`20`	`24.16`	`0`

Finally, you might be interested in other processes associated with the Monitoring VMware virtual machine performance use case.