How to identify who remove the Virtual server

From Bash shell:

cat /var/log/audit | grep "name_of_vs"

cat /var/log/audit.1 | grep "name_of_vs"

zcat /var/log/audit.*.gz | grep "name_of_vs"

From GUI:

Sytem -> Logs --> Audit --> search with VS name (date/time range can also be provided)