Use Get-VIEvent to get ESXi host error events

[rririmia]

Hello,

How can I retrieve only the 'error' events of a specific ESXi host?

I try the following command but it doesn't return a thing. Even with "Warning" as a type I have the same result. Only the type "Info" is returning some logs.

Get-VIEvent -Entity (Get-VMHost -Name "Myhost01") -Types Error

The Events that I want to retrieve are the ones that I can see when I select the Esxi host \ Task & Events \ Events.

vSphere 5.5

PowerCLI 6.5 Release 1 build 4624819

Thank you in advance.

[LucD]

Are you actually seeing "error" events in the client?

Can you show us an example of which specific error event you want to extract?

Most events are "info" events, and you need to analyse the content of the event object.

[rririmia]

Hi LucD,

Yes. I see errors events in the client.

I don't want to retrieve a specific error event. I want to retrieve all the events of the type "error" from the last week.

Is this possible with GET-VIEvent command?

[LucD]

Can you show us an example of such an "error" event?

[rririmia]

I've made a print screen. I hope it helps.

[LucD]

Seems to be working fine for me.

Could it be that the events are reported on another object than the ESXi node, for example the vCenter?

Try without the Entity parameter (and don't forget the MaxSamples parameter).

For example

Get-VIEvent -Types Error -MaxSamples ([int]::MaxValue)

[rririmia]

This command return all the "Error" from the vCenter. How can I correlate each Error event to a specific host?

[LucD · Accepted solution]

Did you also try with the Entity and the MaxSamples parameter?

Get-VIEvent -Entity $esx -Types Error -MaxSamples ([int]::MaxValue)

[rririmia]

Thank you. It's working.

foreach ($esxiHost in Get-VMHost)

     {

      $esxiHost.Name

      Get-VIEvent -Entity $esxiHost -Types Error -MaxSamples 10000 -Start (Get-Date).AddDays(–14) | select CreatedTime, FullFormattedMessage

     }

[CharuK]

Need both Errror and Warning Events.

Below command works fine for me,

Get-VIevent -Entity $esxi1 -Types Error -MaxSamples 20 

But, I am trying to get both Error and Warning Events, I tried like below but now working(getting no error either):

Get-VIevent -Entity $esxi1 -MaxSamples 20  | Where-Object {($_.Types -eq 'Error') -or ($_.Types -eq 'Warning')}

Thanks,

[LucD]

There is no property named Types on Events, so there is probably nothing returned.
Which kind of error and warning events are you looking for?

Can you show an example that you see under Monitor-Events for an ESXi node in the Web Client?

[CharuK]

Correct, I have seen gm but didn't found any such Property. I am looking for all events having Type Warning and Error on ESXi hosts in last one day.

If any way is there to get both Error & Warnings, it would be great.

[LucD]

Can you show such an event of type error or warning from the Web Client?
I'm not sure you are in fact looking for events.

[CharuK]

Sure, PFA.

I am trying to get Error and Warnings under Type.

[LucD]

Ok, got it.
Try like this

$esx = Get-VMHost

Get-VIEvent -Entity $esx -MaxSamples ([int]::MaxValue) -Types Error, Warning -Start (Get-Date).AddDays(-1)

[CharuK]

Two Things:

1. Output of below script is same, if I only using -Types as Warning i.e. getting no error details as shown in previously shared screenshot

Get-VIEvent -Entity $esx -MaxSamples ([int]::MaxValue) -Types Error, Warning -Start (Get-Date).AddDays(-1)

2. I noticed, Errors where description starts with "Alarm" is not showing through this script. 

[LucD]

There might be an issue with the Types parameter.
Perhaps leave that parameter out, and then filter on the returned events.

[schuermannkl]

The Eventerrors from UI are not in the output of Get-VIEvent. the Type parameter does not work. If i dont use any parameters execpt -Entity , i get many events but not the one i am looking for. Is there any other possibility to get the whole list of events of an esx-host or of a vm?

[LucD]

To check what is available I use my Event-O-Matic, and then generate code from there for Get-VIEventPlus.

[schuermannkl]

I found out that the message in the GUI was combined from subelements of the MessageInfo Field.

So i have searched an eventmessage with same timestamp on the same vm and had a look on the MessageInfo field:

(Get-VIEvent -Start "23/10/2022 20:42:33" -Finish "23/10/2022 20:42:37" | where { $_.FullFormattedMessage -like '*NVRAM: write failed*' } | select *).MessageInfo
Id Argument Text
-- -------- ----
msg.literal {5 (Input/output error)} 5 (Input/output error)
msg.nvram.write NVRAM: write failed.

"Input/output error" was the Text inside the Vcenter GUI. So recreated my Event-Query like this:

Get-VIEvent -Start "23/10/2022 20:42:33" -Finish "23/10/2022 20:42:37" | where { ($_.MessageInfo | ?{$_.id -like "msg.literal"} ) -and ($_.MessageInfo | ?{$_.Text -like "5 (Input/output error)"} ) } | select CreatedTime, @{Name='Host';Expression={$_.Host.Name}}, @{Name='Vm';Expression={$_.Vm.Name}}