I have a quite strange issue - I need to find out what or who deleted a VMFS volume by first deleting the partitiontable - then recreating it and formatting it
the following entries can be found in hostd.log
2013-08-05T13:23:39.310Z [FFFB4B90 verbose 'Partitionsvc' opID=291C9D06-000000D0] InvokePartedUtil /sbin/partedUtil "getptbl" "/vmfs/devices/disks/naa.6848f690eeeb95001903ddd4183d53ef"
2013-08-05T13:23:39.311Z [FFFB4B90 info 'SysCommandPosix' opID=291C9D06-000000D0] ForkExec(/sbin/partedUtil) 1950716
2013-08-05T13:23:39.364Z [FFFB4B90 verbose 'Partitionsvc' opID=291C9D06-000000D0] Output Stream from partedUtil while getting partitions for /vmfs/devices/disks/naa.6848f690eeeb95001903ddd4183d53ef:
--> gpt
--> 240614 255 63 3865468800
-->
2013-08-05T13:23:39.364Z [FFFB4B90 verbose 'Partitionsvc' opID=291C9D06-000000D0] InvokePartedUtil /sbin/partedUtil "getptbl" "/vmfs/devices/disks/naa.6848f690eeeb95001903ddd4183d53ef"
2013-08-05T13:23:39.365Z [FFFB4B90 info 'SysCommandPosix' opID=291C9D06-000000D0] ForkExec(/sbin/partedUtil) 1950717
2013-08-05T13:23:39.416Z [FFFB4B90 verbose 'Partitionsvc' opID=291C9D06-000000D0] Output Stream from partedUtil while getting partitions for /vmfs/devices/disks/naa.6848f690eeeb95001903ddd4183d53ef:
--> gpt
--> 240614 255 63 3865468800
-->
2013-08-05T13:23:39.416Z [FFFB4B90 verbose 'Partitionsvc' opID=291C9D06-000000D0] InvokePartedUtil /sbin/partedUtil "getUsableSectors" "/vmfs/devices/disks/naa.6848f690eeeb95001903ddd4183d53ef"
2013-08-05T13:23:39.417Z [FFFB4B90 info 'SysCommandPosix' opID=291C9D06-000000D0] ForkExec(/sbin/partedUtil) 1946622
2013-08-05T13:23:39.467Z [FFFB4B90 verbose 'Partitionsvc' opID=291C9D06-000000D0] Output Stream from partedUtil while getting usable sectors for /vmfs/devices/disks/naa.6848f690eeeb95001903ddd4183d53ef:
--> 34 3865468766
-->
2013-08-05T13:23:39.468Z [FFFB4B90 verbose 'Default' opID=291C9D06-000000D0] Available primary : [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, ]
2013-08-05T13:23:39.468Z [FFFB4B90 verbose 'Default' opID=291C9D06-000000D0] Setting start sector to 2048 for 1MB alignment
2013-08-05T13:23:39.486Z [64881B90 info 'TaskManager' opID=291C9D06-000000D1] Task Created : haTask-ha-host-vim.host.DatastoreSystem.createVmfsDatastore-104632042
2013-08-05T13:23:39.487Z [64481B90 verbose 'FSVolumeProvider' opID=291C9D06-000000D1] RescanVmfs called
2013-08-05T13:23:39.554Z [64481B90 verbose 'Partitionsvc' opID=291C9D06-000000D1] InvokePartedUtil /sbin/partedUtil "setptbl" "/vmfs/devices/disks/naa.6848f690eeeb95001903ddd4183d53ef" "gpt" "1 2048 3865463909 AA31E02A400F11DB9590000C2911D1B8 0"
2013-08-05T13:23:39.554Z [64C4DB90 verbose 'Hostsvc::DatastoreSystem'] VmfsUpdate: got VMFS message [N11HostdCommon18VmkernelUpdateVmfsE:0x8310ab0] timestamp=3208504497337 specific=0 name= label=
2013-08-05T13:23:39.555Z [64481B90 info 'SysCommandPosix' opID=291C9D06-000000D1] ForkExec(/sbin/partedUtil) 1950719
2013-08-05T13:23:39.572Z [64481B90 verbose 'FSVolumeProvider' opID=291C9D06-000000D1] RescanVmfs called
2013-08-05T13:23:39.630Z [64481B90 info 'Hostsvc::DatastoreSystem' opID=291C9D06-000000D1] Formatting vmfs partition
2013-08-05T13:23:39.630Z [64481B90 verbose 'FSVolumeProvider' opID=291C9D06-000000D1] FormatVmfs called
2013-08-05T13:23:39.631Z [64481B90 verbose 'FSVolumeProvider' opID=291C9D06-000000D1] LookupVmfs: Cannot find VMFS volume with disk name naa.6848f690eeeb95001903ddd4183d53ef and number 1
2013-08-05T13:23:39.631Z [64481B90 verbose 'FSVolumeProvider' opID=291C9D06-000000D1] LookupVmfs: Cannot find VMFS volume with id <unset>, path, <unset>, or name data
2013-08-05T13:23:39.631Z [64481B90 verbose 'FSVolumeProvider' opID=291C9D06-000000D1] LookupNasByName: Cannot find NasVolume with volume name data
2013-08-05T13:23:42.598Z [64840B90 info 'VmkVprobSource'] VmkVprobSource::Post event: (vim.event.EventEx) {
--> dynamicType = <unset>,
--> key = 1693445704,
--> chainId = 1681851588,
--> createdTime = "1970-01-01T00:00:00Z",
--> userName = "",
--> datacenter = (vim.event.DatacenterEventArgument) null,
--> computeResource = (vim.event.ComputeResourceEventArgument) null,
--> host = (vim.event.HostEventArgument) {
--> dynamicType = <unset>,
--> name = "de-insevm12.ri.local",
--> host = 'vim.HostSystem:ha-host',
--> },
--> vm = (vim.event.VmEventArgument) null,
--> ds = (vim.event.DatastoreEventArgument) null,
--> net = (vim.event.NetworkEventArgument) null,
--> dvs = (vim.event.DvsEventArgument) null,
--> fullFormattedMessage = <unset>,
--> changeTag = <unset>,
--> eventTypeId = "esx.audit.vmfs.lvm.device.discovered",
--> severity = <unset>,
--> message = <unset>,
--> objectId = "ha-eventmgr",
--> objectType = "vim.HostSystem",
--> objectName = <unset>,
--> fault = (vmodl.MethodFault) null,
--> }
2013-08-05T13:23:42.600Z [64840B90 info 'ha-eventmgr'] Event 300 : One or more LVM devices have been discovered on this host.
2013-08-05T13:23:42.600Z [65046B90 verbose 'Hostsvc::DatastoreSystem'] VmfsVobUpdate: vmfs VOB: discovery: msg: [N11HostdCommon6VobMsgE:0x64385310] timestamp=3208507543638
2013-08-05T13:23:42.601Z [65046B90 verbose 'Hostsvc::DatastoreSystem'] Automount: scheduling thread NOW
2013-08-05T13:23:43.142Z [64C0CB90 verbose 'Cimsvc'] Ticket issued for CIMOM version 1.0, user root
2013-08-05T13:23:56.447Z [64FC2B90 info 'VmkVprobSource'] VmkVprobSource::Post event: (vim.event.EventEx) {
--> dynamicType = <unset>,
--> key = 102397564,
--> chainId = 1681847216,
--> createdTime = "1970-01-01T00:00:00Z",
--> userName = "",
--> datacenter = (vim.event.DatacenterEventArgument) null,
--> computeResource = (vim.event.ComputeResourceEventArgument) null,
--> host = (vim.event.HostEventArgument) {
--> dynamicType = <unset>,
--> name = "de-insevm12.ri.local",
--> host = 'vim.HostSystem:ha-host',
--> },
--> vm = (vim.event.VmEventArgument) null,
--> ds = (vim.event.DatastoreEventArgument) null,
--> net = (vim.event.NetworkEventArgument) null,
--> dvs = (vim.event.DvsEventArgument) null,
--> fullFormattedMessage = <unset>,
--> changeTag = <unset>,
--> eventTypeId = "esx.audit.vmfs.volume.mounted",
--> severity = <unset>,
--> message = <unset>,
--> arguments = (vmodl.KeyAnyValue) [
--> (vmodl.KeyAnyValue) {
--> dynamicType = <unset>,
--> key = "1",
--> value = "[data, 51ffa76c-96d6efb1-76e4-90b11c496b72]",
--> },
--> (vmodl.KeyAnyValue) {
--> dynamicType = <unset>,
--> key = "2",
--> value = "51ffa76b-46dd7eee-714f-90b11c496b72",
--> },
--> (vmodl.KeyAnyValue) {
--> dynamicType = <unset>,
--> key = "3",
--> value = "rw",
--> }
--> ],
--> objectId = "ha-eventmgr",
--> objectType = "vim.HostSystem",
--> objectName = <unset>,
--> fault = (vmodl.MethodFault) null,
--> }
2013-08-05T13:23:56.450Z [64FC2B90 info 'ha-eventmgr'] Event 301 : File system [data, 51ffa76c-96d6efb1-76e4-90b11c496b72] on volume 51ffa76b-46dd7eee-714f-90b11c496b72 has been mounted in rw mode on this host.
2013-08-05T13:23:56.508Z [64481B90 verbose 'FSVolumeProvider' opID=291C9D06-000000D1] AttachVmfsExtent called on /vmfs/volumes/51ffa76c-96d6efb1-76e4-90b11c496b72
2013-08-05T13:23:56.508Z [64481B90 verbose 'FSVolumeProvider' opID=291C9D06-000000D1] Attach extent is NO-OP, it is already the head of volume.
2013-08-05T13:23:56.508Z [64481B90 info 'Hostsvc::DatastoreSystem' opID=291C9D06-000000D1] Added VMFS volume [/vmfs/volumes/51ffa76c-96d6efb1-76e4-90b11c496b72].
2013-08-05T13:23:56.509Z [64481B90 verbose 'Hostsvc::DatastoreSystem' opID=291C9D06-000000D1] ReconcileVMFSDatastores called: refresh = true, rescan = false
2013-08-05T13:23:56.509Z [64481B90 verbose 'FSVolumeProvider' opID=291C9D06-000000D1] RefreshVMFSVolumes called
2013-08-05T13:23:56.540Z [64481B90 verbose 'FSVolumeProvider' opID=291C9D06-000000D1] RefreshVMFSVolumes: refreshed volume, id 51ffa76c-96d6efb1-76e4-90b11c496b72, name data
2013-08-05T13:23:56.540Z [64481B90 verbose 'FSVolumeProvider' opID=291C9D06-000000D1] RefreshOneVmfsVolume on /vmfs/volumes/51ffa76c-96d6efb1-76e4-90b11c496b72
2013-08-05T13:23:56.572Z [64481B90 info 'Hostsvc::Datastore' opID=291C9D06-000000D1] Refresh: VMFS Datastore name was changed from '51ffa76c-96d6efb1-76e4-90b11c496b72' to 'data'.
2013-08-05T13:23:56.572Z [64481B90 verbose 'Hostsvc::DatastoreSystem' opID=291C9D06-000000D1] DiscoverNewDatastores: data created.
2013-08-05T13:23:56.572Z [64481B90 verbose 'Hostsvc::DatastoreSystem' opID=291C9D06-000000D1] Removing issue NoDatastoresConfigured
2013-08-05T13:23:56.572Z [64481B90 verbose 'Hostsvc::DatastoreSystem' opID=291C9D06-000000D1] ReconcileVMFSDatastores: Done discovering new filesystem volumes.
2013-08-05T13:23:56.573Z [64481B90 info 'TaskManager' opID=291C9D06-000000D1] Task Completed : haTask-ha-host-vim.host.DatastoreSystem.createVmfsDatastore-104632042 Status success
2013-08-05T13:23:56.573Z [64C4DB90 verbose 'Hostsvc::DatastoreSystem'] VmfsUpdate: got VMFS message [N11HostdCommon18VmkernelUpdateVmfsE:0x64509668] timestamp=3208504573901 specific=0 name= label=
2013-08-05T13:23:56.573Z [648C2B90 verbose 'Hostsvc::DatastoreSystem'] ReconcileVMFSDatastores called: refresh = true, rescan = false
2013-08-05T13:23:56.573Z [648C2B90 verbose 'FSVolumeProvider'] RefreshVMFSVolumes called
2013-08-05T13:23:56.637Z [648C2B90 verbose 'FSVolumeProvider'] RefreshVMFSVolumes: refreshed volume, id 51ffa76c-96d6efb1-76e4-90b11c496b72, name data
2013-08-05T13:23:56.637Z [648C2B90 verbose 'Hostsvc::Datastore'] SetVolume: Datastore 51ffa76c-96d6efb1-76e4-90b11c496b72 has changed provider volume pointer
2013-08-05T13:23:56.637Z [648C2B90 verbose 'Hostsvc::DatastoreSystem'] ReconcileVMFSDatastores: Done discovering new filesystem volumes.
2013-08-05T13:23:56.638Z [FFF10A90 verbose 'FSVolumeProvider'] AutomountVolumes called
2013-08-05T13:23:56.638Z [64CDEB90 warning 'PropertyProvider' opID=291C9D06-000000D3] _RetrieveContents took 12599905 microseconds to lock vim.host.DatastoreSystem:ha-datastoresystem
2013-08-05T13:23:56.655Z [FFF10A90 info 'Hostsvc::DatastoreSystem'] DatastoreSystemImpl.AutomountVolumes completed