Hello guys, is it possible to get a report of those events using script?
Thanks much.
Are you by any chance runnign this against Virtual Center 2.5 and/or ESX 3.5 ?
The Datastore events are introduced with API 4.i which means vCenter 4 and ESX(i) 4.
____________
Blog: LucD notes
Twitter: lucd22
Blog: lucd.info Twitter: @LucD22 Co-author PowerCLI Reference
Sure is, try the following script
$tgtEvents = "DatastoreFileDeletedEvent","DatastoreFileMovedEvent" $report = @() $events = Get-VIEvent -Start (Get-Date).AddHours(-1) $events | where {$tgtEvents -contains $_.GetType().Name} | %{ $row = "" | Select FileName,Datastore,UserName,Time,Message $row.Filename = $_.TargetFile $row.Datastore = $_.Datastore.Name $row.UserName = $_.UserName $row.Time = $_.CreatedTime $row.Message = $_.FullFormattedMessage $report += $row } $report
You can change the -Start parameter to monitor further back in the past.
____________
Blog: LucD notes
Twitter: lucd22
Blog: lucd.info Twitter: @LucD22 Co-author PowerCLI Reference
Thanks Luc for the quick reply. Will this script get failed operation? or can status be shown in the report?
not sure what type of move is able to be tracked. only the ones using datastore browser? only files? what about folders?
The problem is that the event gets written away before the action is completed.
So the Result field is still blank and the State field says "queued".
You can find this result field as follows, but unfortunately it will be blank (at least it was in my test setup).
$tgtEvents = "DatastoreFileDeletedEvent","DatastoreFileMovedEvent" $report = @() $events = Get-VIEvent -Start (Get-Date).AddHours(-1) $events | where {$tgtEvents -contains $_.GetType().Name} | %{ $event = $_ $task = $events | where {$_.GetType().Name -eq "TaskEvent" -and $_.ChainId -eq $event.ChainId} $row = "" | Select FileName,Datastore,UserName,Time,Message,Result $row.Filename = $_.TargetFile $row.Datastore = $_.Datastore.Name $row.UserName = $_.UserName $row.Time = $_.CreatedTime $row.Message = $_.FullFormattedMessage $row.Result = $task.Info.Result $report += $row } $report
____________
Blog: LucD notes
Twitter: lucd22
Blog: lucd.info Twitter: @LucD22 Co-author PowerCLI Reference
These events track files and folders.
If the delete or move is not done through the DeleteDatastoreFile_Task or MoveDatastoreFile_Task method then there won't be an event I'm afraid.
The Datastore browser uses these methods as well in the background.
____________
Blog: LucD notes
Twitter: lucd22
Blog: lucd.info Twitter: @LucD22 Co-author PowerCLI Reference
just deleted a *.log file on datastore by using datastore browser, but the sript returned nothing. looks like the operation wasn't captured?
Just did the same test and I can see the log file deleted event.
Are you connected to a vCenter ? Or directly to the ESX(i) host ?
____________
Blog: LucD notes
Twitter: lucd22
Blog: lucd.info Twitter: @LucD22 Co-author PowerCLI Reference
connected to a vcenter server.
Do you see the delete file under the Tasks & Events tab in vCenter ?
If yes, then there must be an event.
____________
Blog: LucD notes
Twitter: lucd22
Blog: lucd.info Twitter: @LucD22 Co-author PowerCLI Reference
I do see the events under the Tasks & Events tab, but the script doesn't detect them.
PowerCLI Version
-
VMware vSphere PowerCLI 4.1 build 264274
I just tried it again and I can see the event with both PowerCLU 4u1 and 4.1
Do you see a "DatastoreFileDeletedEvent" line when you do
Get-VIEvent -Start (Get-Date).AddHours(-6) | Group-Object -Property {$_.GetType().Name}
If not then there must be something wrong.
Does the
$defaultVIserver
variable show your vCenter ?
____________
Blog: LucD notes
Twitter: lucd22
Blog: lucd.info Twitter: @LucD22 Co-author PowerCLI Reference
I don't see "DatastoreFileDeletedEvent", but some other events are there.such as DrsVmMigratedEvent, VmBeingHotMigratedEvent, Taskevent
$defaultviserver returns the vcenter server that I'm connected to.
Are you by any chance runnign this against Virtual Center 2.5 and/or ESX 3.5 ?
The Datastore events are introduced with API 4.i which means vCenter 4 and ESX(i) 4.
____________
Blog: LucD notes
Twitter: lucd22
Blog: lucd.info Twitter: @LucD22 Co-author PowerCLI Reference
OMG. That explains it. Thanks anyway!!
Hi LUCD,
I dont see the any datastore file events. When i ran the Get-VIEvent -Start (Get-Date).Adddays(-300) | Group-Object -Property {$_.GetType().Name}.
See snapshot below. I am running PS version 5.1 with VMware POwercli 11.5 module. THe VC is 6.7 U3.
Can you please help me with the command i need to run to get the deleted/modified/copied events of files/folders in a Datastore.
Thanks
Bikash
You left out the MaxSamples parameter, without that one you will only get 100 events returned.
Blog: lucd.info Twitter: @LucD22 Co-author PowerCLI Reference
I still dont see those datastore related events.
I don't see your file
Blog: lucd.info Twitter: @LucD22 Co-author PowerCLI Reference