Get-VIEvent --- "VmCreatedEvent","VmDeployedEvent","VmClonedEvent"

[johndavidd]

I'm trying to speed these queries up and wondering what entity i can specify in the Get-VIEvent for events of the type below:

"VmCreatedEvent","VmDeployedEvent","VmClonedEvent"

Specifying a cluster or datacenter does not work as apparently they are not logged there.

Thanks,

JD

[Grzesiekk]

Hi John,

"

PARAMETERS
   -Entity <VIObject[]>
       Specify objects (such as virtual machine, virtual machine host, resource pool, and so on) for which you want to collect events.

"

i#17:51:59> Get-Cluster test-cluster |Get-VIEvent | ?{$_ -is [Vmware.vim.VmCreatedEvent]}  -> NO OUTPUT
#17:52:52> get-vm testvm9999 |Get-VIEvent | ?{$_ -is [Vmware.vim.VmCreatedEvent]}  -> GOT OUTPUT

Template             : False
Key                  : 26428108
ChainId              : 26428099
CreatedTime          : 11/9/2012 5:52:24 PM
UserName             : xxxx
Datacenter           : VMware.Vim.DatacenterEventArgument
ComputeResource      : VMware.Vim.ComputeResourceEventArgument
Host                 : VMware.Vim.HostEventArgument
Vm                   : VMware.Vim.VmEventArgument
Ds                   :
Net                  :
Dvs                  :
FullFormattedMessage : Created virtual machine testvm9999 on yxxx  in xxx casdfadfasd
ChangeTag            :

so what i mean is that if you will be passing cluster to get-vievent you will not see creation vm events. it would work if you would do

get-cluster XXX | get-vm | get-vievent    -> this will check those events for vms in this cluster and not for cluster object.

you can make a specific list with vms and then pass them to get-vievent , that will help i suppose

make sure that when you query for this event you query on vm object not cluster or folder.

[johndavidd]

Is this any faster than my current syntax?

Get-VIEvent -MaxSamples ([int]::MaxValue) -Start $start -Types info | ? {$_.gettype().name -eq "vmcreatedevent"}

What property are you calling here?

I saw you post this in an earlier topic.

?{$_ -is [Vmware.vim.VmCreatedEvent]}

Disregard ... I see it here

PowerCLI E:\> $event | gm


   TypeName: VMware.Vim.VmCreatedEvent

Name                 MemberType Definition
----                 ---------- ----------
Equals               Method     bool Equals(System.Object obj)
GetHashCode          Method     int GetHashCode()
GetType              Method     type GetType()
ToString             Method     string ToString()
ChainId              Property   System.Int32 ChainId {get;set;}
ChangeTag            Property   System.String ChangeTag {get;set;}
ComputeResource      Property   VMware.Vim.ComputeResourceEventArgument Comp...
CreatedTime          Property   System.DateTime CreatedTime {get;set;}
Datacenter           Property   VMware.Vim.DatacenterEventArgument Datacente...
Ds                   Property   VMware.Vim.DatastoreEventArgument Ds {get;set;}
Dvs                  Property   VMware.Vim.DvsEventArgument Dvs {get;set;}
DynamicProperty      Property   VMware.Vim.DynamicProperty[] DynamicProperty...
DynamicType          Property   System.String DynamicType {get;set;}
FullFormattedMessage Property   System.String FullFormattedMessage {get;set;}
Host                 Property   VMware.Vim.HostEventArgument Host {get;set;}
Key                  Property   System.Int32 Key {get;set;}
Net                  Property   VMware.Vim.NetworkEventArgument Net {get;set;}
SourceVm             Property   VMware.Vim.VmEventArgument SourceVm {get;set;}
Template             Property   System.Boolean Template {get;set;}
UserName             Property   System.String UserName {get;set;}
Vm                   Property   VMware.Vim.VmEventArgument Vm {get;set;}

[Grzesiekk]

John,

  you can compare your approaches using

measure-command {

your script goes here

}

giving -Types does not make it faster already tried that. IT is faster when u want to make just a dump from events. Then yeah, its twice faster with only info than with all.

Well i made serveral tests, different ones , the best one i came up with was this one

#18:52:11> measure-command {get-view -viewtype virtualmachine -Filter @{'name'='testvm9999'}|get-viobjectbyviview|Get-VIEvent|?{$_ -is [Vmware.vim.VmCreatedEvent]} }

Days              : 0
Hours             : 0
Minutes           : 0
Seconds           : 2
Milliseconds      : 907
Ticks             : 29077235

Other approaches were giving me 5seconds +  where as this one only 2. So summarizing,  get-vievent is very fast , it's more like how fast can you give him the vm object.

if you do it like this it's even worse:

i#18:19:14> measure-command {Get-VIEvent -entity testvm9999 |?{$_ -is [Vmware.vim.VmCreatedEvent]} }

Days              : 0
Hours             : 0
Minutes           : 0
Seconds           : 14
Milliseconds      : 657
Ticks             : 146578400

the sandard approach

#18:18:45> measure-command {get-vm testvm9999|Get-VIEvent|?{$_ -is [Vmware.vim.VmCreatedEvent]} }

Days              : 0
Hours             : 0
Minutes           : 0
Seconds           : 6
Milliseconds      : 860
Ticks             : 68601261

Regards,

Greg

[johndavidd]

Yes, that seems to be the problem here, right?

The objects in question are unknown so I can't pipe a get-vm or get-view to it.

I have to dig through all the logs searching for that VM.

Lengthy, lengthy process when you have a busy VC. Even lengthier when you specify a start/finish date.

JD

[Grzesiekk]

Why do you mean they are unknown ? Those types will be only on VMs that are in your inventory right ? So what is uknown ? even if you would do get-vm then you would have all possible vms. What do you want to check in that case?

[Grzesiekk · Accepted solution]

Ok i think i get you. You just don't want to specify the VMs. Is that correct ? you just want to go through ALLL SERIOUSLY ALLL events, and then check which events where the creation ones ? Take a look on that one

$si=get-view serviceinstance
$em= get-view $si.Content.EventManager
$EventFilterSpec = New-Object VMware.Vim.EventFilterSpec
$EventFilterSpec.Type = "VmCreatedEvent"
$em.QueryEvents($EventFilterSpec)

#19:20:19> measure-command { $em.QueryEvents($EventFilterSpec) }

Days              : 0
Hours             : 0
Minutes           : 0
Seconds           : 0
Milliseconds      : 271

Seriously it's not a bug It's just how fast it is below 0 seconds . Querying ALL events for your type

names can be extracted from

$em.QueryEvents($EventFilterSpec)[0].vm.name

Time frome $_.createdtime

if you want to search through other methods, like in your first post then

$si=get-view serviceinstance
$em= get-view $si.Content.EventManager
$EventFilterSpec = New-Object VMware.Vim.EventFilterSpec
$EventFilterSpec.Type = "VmCreatedEvent","VmDeployedEvent","VmClonedEvent"
$em.QueryEvents($EventFilterSpec)

I hope this is what you wanted to achieve

[johndavidd]

What I mean is in your examples above you are specifying a certain VM.

Sure, I can do a get-vm | get-vievent but I have a very large environment with thousands of VM's. This takes a very long time.

I'm simply wondering if there is a way to speed things up.

For example, a vmremoved event has to reside in an entity. Since the VM is gone... what entity holds that event?

[Grzesiekk]

Yep, got that take a look on post above with solution

[johndavidd]

Wow...

Yep... that did the trick

Why they wouldn't work that into get-vievent I'm not sure!

Thanks so much for your help.

[Grzesiekk]

Don't ask me John I'm glad that helped.

Written function for that:

http://wp.me/AXaY

Greg