delete/move file on datastore

[kevinjj]

Hello guys, is it possible to get a report of those events using script?

Thanks much.

[LucD]

Sure is, try the following script

$tgtEvents = "DatastoreFileDeletedEvent","DatastoreFileMovedEvent"
$report = @()

$events = Get-VIEvent -Start (Get-Date).AddHours(-1)
$events | where {$tgtEvents -contains $_.GetType().Name} | %{
	$row = "" | Select FileName,Datastore,UserName,Time,Message
	$row.Filename = $_.TargetFile
	$row.Datastore = $_.Datastore.Name
	$row.UserName = $_.UserName
	$row.Time = $_.CreatedTime
	$row.Message = $_.FullFormattedMessage
	$report += $row
}
$report

You can change the -Start parameter to monitor further back in the past.

____________

Blog: LucD notes

Twitter: lucd22

[kevinjj]

Thanks Luc for the quick reply. Will this script get failed operation? or can status be shown in the report?

[kevinjj]

not sure what type of move is able to be tracked. only the ones using datastore browser? only files? what about folders?

[LucD]

The problem is that the event gets written away before the action is completed.

So the Result field is still blank and the State field says "queued".

You can find this result field as follows, but unfortunately it will be blank (at least it was in my test setup).

$tgtEvents = "DatastoreFileDeletedEvent","DatastoreFileMovedEvent"
$report = @()

$events = Get-VIEvent -Start (Get-Date).AddHours(-1)
$events | where {$tgtEvents -contains $_.GetType().Name} | %{
	$event = $_
	$task = $events | where {$_.GetType().Name -eq "TaskEvent" -and $_.ChainId -eq $event.ChainId}
	$row = "" | Select FileName,Datastore,UserName,Time,Message,Result
	$row.Filename = $_.TargetFile
	$row.Datastore = $_.Datastore.Name
	$row.UserName = $_.UserName
	$row.Time = $_.CreatedTime
	$row.Message = $_.FullFormattedMessage
	$row.Result = $task.Info.Result
	$report += $row
}
$report

____________

Blog: LucD notes

Twitter: lucd22

[LucD]

These events track files and folders.

If the delete or move is not done through the DeleteDatastoreFile_Task or MoveDatastoreFile_Task method then there won't be an event I'm afraid.

The Datastore browser uses these methods as well in the background.

____________

Blog: LucD notes

Twitter: lucd22

[kevinjj]

just deleted a *.log file on datastore by using datastore browser, but the sript returned nothing. looks like the operation wasn't captured?

[LucD]

Just did the same test and I can see the log file deleted event.

Are you connected to a vCenter ? Or directly to the ESX(i) host ?

____________

Blog: LucD notes

Twitter: lucd22

[kevinjj]

connected to a vcenter server.

[LucD]

Do you see the delete file under the Tasks & Events tab in vCenter ?

If yes, then there must be an event.

____________

Blog: LucD notes

Twitter: lucd22

[kevinjj]

I do see the events under the Tasks & Events tab, but the script doesn't detect them.

[kevinjj]

PowerCLI Version

-

---

VMware vSphere PowerCLI 4.1 build 264274

[LucD]

I just tried it again and I can see the event with both PowerCLU 4u1 and 4.1

Do you see a "DatastoreFileDeletedEvent" line when you do

Get-VIEvent -Start (Get-Date).AddHours(-6) | Group-Object -Property {$_.GetType().Name}

If not then there must be something wrong.

Does the

$defaultVIserver

variable show your vCenter ?

____________

Blog: LucD notes

Twitter: lucd22

[kevinjj]

I don't see "DatastoreFileDeletedEvent", but some other events are there.such as DrsVmMigratedEvent, VmBeingHotMigratedEvent, Taskevent

$defaultviserver returns the vcenter server that I'm connected to.

[LucD · Accepted solution]

Are you by any chance runnign this against Virtual Center 2.5 and/or ESX 3.5 ?

The Datastore events are introduced with API 4.i which means vCenter 4 and ESX(i) 4.

____________

Blog: LucD notes

Twitter: lucd22

[kevinjj]

OMG. That explains it. Thanks anyway!!

[bikashyadav]

Hi LUCD,

I dont see the any datastore file events. When i ran the Get-VIEvent -Start (Get-Date).Adddays(-300) | Group-Object -Property {$_.GetType().Name}.

See snapshot below. I am running PS version 5.1 with VMware POwercli 11.5 module. THe VC is 6.7 U3.

Can you please help me with the command i need to run to get the deleted/modified/copied events of files/folders in a Datastore.

Thanks

Bikash

[LucD]

You left out the MaxSamples parameter, without that one you will only get 100 events returned.

[bikashyadav]

I still dont see those datastore related events.

[LucD]

I don't see your file