How to get disk changed areas from CBT(changed block tracker) in vSphere

Part 1: Identify the Managed Object Reference-ID (MORef-ID) of the VM

If the VM is being protected by Veeam Backup & Replication, navigate to the log directory on the Veeam Backup Server (%programdata%\Veeam\Backup). Within that directory, find the folder that is named after the job that the VM is protected by. Within the job folder will be a log named Task.<vmname>.<Ref-ID>.log

• If the Ref-ID starts with “vm-“ the job is connecting to the vCenter server.
  Exampe: Task.SQL.vm-1337.log
• If the Ref-ID is just a number, the job is connecting to a standalone host.
  Example: Task.DC01.42.log

Part 2: Find that VM in the Managed Object Browser (MOB)

1. Open a web browser and navigate to that VM's MOB page.
   Consider the following:
   
   • If the MORef-ID had the prefix 'vm-' the MOB page will be:
     https://<vc>/mob/?moid=<Ref-ID>
     
     Example: https://vcsa.domain.tld/mob/?moid=vm-1337
   • If the MORef-ID is only a number, the MOB page will be:
     https://<ESXihost>/mob/?moid=<ref-id>
     
     Example:  https://esxi1.domain.tld/mob/?moid=42

Part 3: Create a Snapshot and Identify Snapshot

2. Open a web browser and navigate to that VM's MOB page.
   Consider the following:
   
   • If the MORef-ID had the prefix 'vm-' the MOB page will be:
     https://<vc>/mob/?moid=<Ref-ID>
     
     Example: https://vcsa.domain.tld/mob/?moid=vm-1337
   • If the MORef-ID is only a number, the MOB page will be:
     https://<ESXihost>/mob/?moid=<ref-id>
     
     Example:  https://esxi1.domain.tld/mob/?moid=42
3. Create a snapshot for the virtual machine, and note that snapshot's ref-id on the MOB page.