Followed the steps from the description. The audit log I got: Disk 'vm-1_Disk1' from Snapshot(s) '1' of VM 'vm-2' deletion was initiated by admin@internal Used: rhevm-3.6.7.5-0.1.el6.noarch vdsm-4.17.31-0.el7ev.noarch