Overview

Sometimes you may have a requirement to either replace or remove a Virtual Appliance (VA) and in most environments, it is as easy as just switching DHCP to point to a new address, then waiting for the TTL for the lease to come around. 
However, in some environments such as those where perhaps servers are using statically configured IP settings, it is harder to be 100% confident that the VA being removed is no longer service any traffic.  At present, the standard reporting tools also do not provide 'per-VA' reporting capabilities.  So how do you know when a VA no longer has any clients pointing to it?

Solution

You can use a combination of the 'Umbrella Sites' feature along with scheduled reports.

1. Under 'sites and active directory' create a new 'site' for each VA being decommissioned. 
   For example name the sites...
   
   - decomVA1
   - decomVA2
   - etc...
   
   
2. Then add VA1 to the site 'decomVA1' , VA2 to the site 'decomVA2' etc...
   Any DNS requests being pointed directly at those VA's will be reported under the 'site' identity.
   
   
3. You can create scheduled reports for each new 'site' to view a log of the traffic each VA processed each day/week.
   The report show the internal source IP the VA saw the DNS request originate from.   Keep in mind that if an ADMapping (Username-to-IP mapping) still exists for a user, this also may be reported.
   
   
4. You can then find the last few hosts (if there are any) and configure them to point to the new DNS server.
   
   
5. Power down and delete the VA to be decommissioned.