WIn2012R2 Standard + Hyper-V
We found out a VM that seems to be re-configured and maybe it had got back in time, maybe applying an old snaphost
Developers are complaining about a theorical time machine effect, where someone had applied a old snapshot
I couldn´t find any event log proofing that.
i´ve created a TEST VM, created a snapshot, merged/deleted the snapshot and the event viewer has shown the event id related to the merging proccess
BUT...
i´ve created a TEST2 VM, created snapshot and APPLIED the snapshot (going back in time) and.. no event ID logged, no trace of the operation.
It is right?
All Hyper-V advanced logs are enabled in event viewer (and i see the merge) but i see the applying of the snapshot
wich event id would appear in applying snapshot?
Why is that?
There something elese to do enable more logs?
This is by design?