Get VM Create Date & Time

[vmdavinci]

Hello,

I'm searching for the code the get the VM Create Date & Time.

[LucD]

Afaik this information is not readily available in any of the objects from the VITK or the SDK.

What I normally do is to scan the events for VmCreatedEvents entries and then extract the date/time information from the event object.

I'm not sure if this method also covers clones and imported virtual appliances.

To be inevstigated.

# How many days in the past to start from
$start = (Get-Date).AddDays(-10)

# The more days back, the higher this number should be.
$eventNr = 9999

$report = @()

Get-VIEvent -Start $start -MaxSamples $eventNr | `
  Where-Object {$_.GetType().Name -eq "VmCreatedEvent"} | %{
	$row = "" | Select Date, Msg, User
	$row.Date = $_.createdTime
	$row.Msg = $_.fullFormattedMessage
	$row.User = $_.userName
	$report += $row
  }
$report

Note that how far back you can go depends on the number of event records you keep in your VC db.

[vmdavinci]

Thanks for the quick reply. I will test it asap.

[vmdavinci]

The script works fine in a VI3 only envirionment. If there is a VI2 datacenter in vCenter the results are empty. I have to define the datacenter before running the "VmCreatedEvent" query.

Can you give me a hint how to define a datacenter in this script

I tried this:

*

Get-Datacenter "$VCDataCenter" | Get-VIEvent -Start $start -MaxSamples $eventNr | `

*

[LucD]

What do you mean with a VI2 datacenter ?

Is that a VC2.0 ? Or is that with ESX2.x servers ?

Note that ESX 2.x is not included in the supported platforms in the VITK v1.5 release notes.

[vmdavinci]

It's a VC2.5 with ESX2x hosts. I know that's not supported.

Because we have ESX2x and ESX3x hosts in the same VC, I have to exclude the ESX2.x hosts. By defining a datacenter in my opinion I can exclude the ESX2x hosts.

[LucD]

I can't test this since I have no ESX 2.x servers but this return anything ?

Get-Datacenter "$VCDataCenter" | Get-Inventory | Get-VIEvent -Start $start -MaxSamples $eventNr

[vmdavinci]

Luc,

What am I doing wrong in the script below? I have a Datacenter with 2 HA-clusters. 1 cluster contains vm's, the other cluster has none vm's. When I connect both clusters the result is the same: vm's. It looks that the script is reading the datacenter in stead of the ha-cluster.

$VC = Connect-VIServer $VCHOST -User $USER -Password $PASSWORD

#How many days in the past to start from

$start = (Get-Date).AddDays(-20)

#The more days back, the higher this number should be.

$eventNr = 9999

$report = @()

foreach ($virtual in Get-Cluster "$VCCluster")

{

Get-VIEvent -Start $start -MaxSamples $eventNr | `

Where-Object {$_.GetType().Name -eq "VmCreatedEvent"} | %{

$row = "" | Select Date, Msg, User

$row.Date = $_.createdTime

$row.Msg = $_.fullFormattedMessage

$row.User = $_.userName

$report += $row

}

}

$report

[vmdavinci]

It's working now but there are now double entries in the output.

$VC = Connect-VIServer $VCHOST -User $USER -Password $PASSWORD

#How many days in the past to start from

$start = (Get-Date).AddDays(-20)

#The more days back, the higher this number should be.

$eventNr = 9999

$report = @()

foreach ($row in (Get-Cluster $VCCluster | Get-VM))

{

Get-VIEvent -Start $start -MaxSamples $eventNr | `

Where-Object {$_.GetType().Name -eq "VmCreatedEvent"} | %{

$row = "" | Select Date, Msg, User

$row.Date = $_.createdTime

$row.Msg = $_.fullFormattedMessage

$row.User = $_.userName

$report += $row

}

}

[LucD · Accepted solution]

The reason you see the same entries twice was because the events are collected from the VC and the script doesn't specify a specific cluster.

The reason why I didn't use the -Entity parameter on the Get-ViEvent cmdlet was because not all tasks are run against a cluster but could belong to an entity lower in the structure (for example an ESX host).

The following adaptation of the script will also include the clustername and the ESX hostname on which the guest was created.

You could adapt the script to test on the name of the cluster and/or the ESX host.

The reason why the name of the cluster and the ESX host are obtained in such a cumbersome way is because there seems to be a bug in the Managed Object Reference(s) the Get-ViEvent cmdlet returns.

# How many days in the past to start from
$start = (Get-Date).AddDays(-10)

# The more days back, the higher this number should be.
$eventNr = 9999

$report = @()

Get-VIEvent -Start $start -MaxSamples $eventNr | `
Where-Object {$_.GetType().Name -eq "VmCreatedEvent"} | % {
	$row = "" | Select Date, Msg, User, Cluster, Host
	$row.Date = $_.createdTime
	$row.Msg = $_.fullFormattedMessage
	$row.User = $_.userName
	
	$t = New-Object VMware.Vim.ManagedObjectReference
	$t.type = $_.computeResource.computeResource.type
	$t.Value = $_.computeResource.computeResource.Value
	$row.Cluster = (Get-View $t).Name

	$t.type = $_.host.host.type
	$t.Value = $_.host.host.Value
	$row.Host = (Get-View $t).Name
	
	$report += $row
}
$report

[vmdavinci]

Ok, so i searched half a day because of a possible bug in the Get-ViEvent cmdlet :(. The last enhancement of your code sample you've posted has completing my script.

I'll hope the bug is fixed soon. Is VMware aware of this possible bug.

[LucD]

Yes, I informed VMware of this problem with Get-ViEVent.

[vmdavinci]

Ok

Thanks a lot for all your support!

[wingnut76]

LucD,

I'm trying to use this code to find the creation date of the VM but it returns nothing. I've adjusted the days to go back further and I know there were systems created in the time frame I've given. Nothing has been cleaned up in VC but I still don't get any records. If I run this:

Get-ViEvent -Start (Get-Date).AddDays(-180) | select-object {$_.GetType().Name}

...I don't get any named events with "VmCreatedEvent" either. Is there something I'm doing wrong or possibly something else is wrong?

[LucD]

Did you also adjust the $eventNr variable.

The Get-VIEvent cmdlet unfortunately only returns that number of events even if the time range is specified.

The number that you have to give depends on how "active" your VI environment is.

A bit of trial and error I'm afraid.

An 2nd alternative is to use the SDK history collector for events.

It will allow you to only specify a time range without the need to estimate the number of events.

For a sample of SDK history collectors have a look at .

In that script I used the task and event collectors to track DRS initiated vMotions.

A 3th option is to query the VC database directly.

See a sample in .

Btw that query also returns the creation date.

[wingnut76]

That was it! Thanks!

[wingnut76]

Is it possible to get this into a format like a CSV to use in Excel? It appears to output the information in a tabular form grouped together like this:

Date : 4/27/2009 2:14:31 PM

Msg : Created virtual machine SERVERA on MyHost in MyDatacenter

User : username_here

Cluster : ESX Server Farm

Host : Myhost

I'd like to have:

Date, User, VM Name, Cluster, Host, Full Message

Something like that...

[LucD]

Sure, no problem.

# How many days in the past to start from
$start = (Get-Date).AddDays(-7)

# The more days back, the higher this number should be.
$eventNr = 9999

$report = @()

Get-VIEvent -Start $start -MaxSamples $eventNr |`
  Where-Object {$_.GetType().Name -eq "VmCreatedEvent"} | % {
	$row = "" | Select Date, User, VmName, Cluster, Host, Msg
	$row.Date = $_.createdTime
	$row.Msg = $_.fullFormattedMessage
	$row.User = $_.userName
	$row.VMName = $_.vm.name
	$t = New-Object VMware.Vim.ManagedObjectReference
	$t.type = $_.computeResource.computeResource.type
	$t.Value = $_.computeResource.computeResource.Value
	$row.Cluster = (Get-View $t).Name
	$t.type = $_.host.host.type
	$t.Value = $_.host.host.Value
	$row.Host = (Get-View $t).Name
	$report += $row
}
$report | Export-Csv "C:\VMCreated.csv" -NoTypeInformation

[jamunoz]

I saw the script and going to try it out. Except, where do you run the script (on each esx host, etc) ?

[LucD]

You run this script on a PC that has PowerCLI installed.

You connect first to your Virtual Center (with the Connect-ViServer cmdlet).