<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Power off information from vmware.log in VMware PowerCLI Discussions</title>
    <link>https://communities.vmware.com/t5/VMware-PowerCLI-Discussions/Power-off-information-from-vmware-log/m-p/2877395#M104100</link>
    <description>&lt;P&gt;Nearly, but in 1 string&lt;BR /&gt;&lt;BR /&gt;&lt;/P&gt;
&lt;LI-CODE lang="csharp"&gt;Get-Content -Path $tempFile | where {$_ -match 'VMX has left the building|CPU reset:|power|Power|vmotion|Vmotion' } |&lt;/LI-CODE&gt;</description>
    <pubDate>Wed, 10 Nov 2021 21:28:07 GMT</pubDate>
    <dc:creator>LucD</dc:creator>
    <dc:date>2021-11-10T21:28:07Z</dc:date>
    <item>
      <title>Power off information from vmware.log</title>
      <link>https://communities.vmware.com/t5/VMware-PowerCLI-Discussions/Power-off-information-from-vmware-log/m-p/2877362#M104095</link>
      <description>&lt;P&gt;&lt;A href="https://kb.vmware.com/s/article/1019064" target="_blank" rel="noopener"&gt;https://kb.vmware.com/s/article/1019064&lt;/A&gt; taught me quite a bit about what logs in vmware.log for power-down of a machine.I knew about "VMX has left the building" for power down and vmotions. The KB taught me a few others.&lt;/P&gt;&lt;P&gt;See attached code which has been plagiarized from a stun time script. This will be used to confirm VMs have indeed been powered off for greater than 90 days. The last time I did this exercise users claimed they powered on their VMs since the date I stated the VM was powered off. This time, I'm gathering my evidence first. &lt;img class="lia-deferred-image lia-image-emoji" src="https://communities.vmware.com/html/@7C3D0D4F3D0C13B20C3EB7851BC0A38B/emoticons/1f914.png" alt=":thinking_face:" title=":thinking_face:" /&gt;&lt;/P&gt;&lt;P&gt;1) I'm not strong (yet) in regex. I want to search vmware.log for the following strings.&amp;nbsp; I'm not sure how to do multiple (greater than 2) or statements.&lt;/P&gt;&lt;P&gt;VMX has left the building&lt;/P&gt;&lt;P&gt;CPU reset&lt;/P&gt;&lt;P&gt;Power&lt;/P&gt;&lt;P&gt;power&lt;/P&gt;&lt;P&gt;vmotion&lt;/P&gt;&lt;P&gt;2) What is this line of code doing: Duration = $fields[2].Split(' ')[6]&amp;nbsp;&amp;nbsp;&amp;nbsp;&lt;/P&gt;&lt;P&gt;It doesn't give me a duration in days, but something like this (note: the following is a paste from the export-csv output and is a cell). I added the variable Row as that's more useful to me but still want to learn from the plagiarized code.&lt;/P&gt;&lt;TABLE border="0" width="132" cellspacing="0" cellpadding="0"&gt;&lt;TBODY&gt;&lt;TR&gt;&lt;TD width="132" height="20"&gt;building:&lt;/TD&gt;&lt;/TR&gt;&lt;/TBODY&gt;&lt;/TABLE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;VM Timestamp Duration Row&lt;BR /&gt;-- --------- -------- ---&lt;BR /&gt;TAM_Health_Amalyzer-5.5.4 11/4/2021 11:26:27 AM 2) {2021-11-04T17:26:27.845Z, vcpu-0, I125: CPU reset: hard...&lt;BR /&gt;TAM_Health_Amalyzer-5.5.4 11/4/2021 12:29:08 PM building: {2021-11-04T18:29:08.516Z, vmx, W115: VMX has left the b...&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Wed, 10 Nov 2021 20:07:31 GMT</pubDate>
      <guid>https://communities.vmware.com/t5/VMware-PowerCLI-Discussions/Power-off-information-from-vmware-log/m-p/2877362#M104095</guid>
      <dc:creator>vmCalgary</dc:creator>
      <dc:date>2021-11-10T20:07:31Z</dc:date>
    </item>
    <item>
      <title>Re: Power off information from vmware.log</title>
      <link>https://communities.vmware.com/t5/VMware-PowerCLI-Discussions/Power-off-information-from-vmware-log/m-p/2877377#M104096</link>
      <description>&lt;P&gt;1.&lt;BR /&gt;You can combine multiple targets strings with an OR&amp;nbsp;in a RegEx with the vertical bar ('|').&lt;BR /&gt;for example, the following "one|two|three", will match the target on 'one' or 'two' or 'three'&lt;BR /&gt;&lt;BR /&gt;2.&lt;BR /&gt;Without seeing the code where the content of $fields is created, I can't really explain what the split method is doing.&lt;BR /&gt;But it looks as if it splits the string on a dot, and then takes the 7th field.&lt;BR /&gt;For example, if the content is "1.2.3.4.5.6.7.8", then it would return "7"&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Wed, 10 Nov 2021 20:42:23 GMT</pubDate>
      <guid>https://communities.vmware.com/t5/VMware-PowerCLI-Discussions/Power-off-information-from-vmware-log/m-p/2877377#M104096</guid>
      <dc:creator>LucD</dc:creator>
      <dc:date>2021-11-10T20:42:23Z</dc:date>
    </item>
    <item>
      <title>Re: Power off information from vmware.log</title>
      <link>https://communities.vmware.com/t5/VMware-PowerCLI-Discussions/Power-off-information-from-vmware-log/m-p/2877381#M104097</link>
      <description>&lt;P&gt;&lt;a href="https://communities.vmware.com/t5/user/viewprofilepage/user-id/256147"&gt;@LucD&lt;/a&gt;,&lt;/P&gt;&lt;P&gt;The script was attached. I guess I should have mentioned that. Turns out my Row variable didn't work well.&lt;/P&gt;&lt;P&gt;$vmList = Get-Content C:\users\jm\VMware_scripts\SpringCleaning\PoweredOff\all-Nov10.txt # list VMs in txt file&lt;/P&gt;&lt;P&gt;$report = @()&lt;/P&gt;&lt;P&gt;foreach ($vmName in $vmList) {Get-VM -Name $vmName -PipelineVariable vm |&lt;/P&gt;&lt;P&gt;ForEach-Object -Process {&lt;/P&gt;&lt;P&gt;$vmxPath = $vm.ExtensionData.Config.Files.VmpathName&lt;/P&gt;&lt;P&gt;$dsObj = Get-Datastore -Name $vmxPath.Split(']')[0].TrimStart('[')&lt;/P&gt;&lt;P&gt;New-PSDrive -Location $dsObj -Name DS -PSProvider VimDatastore -Root "\" | Out-Null&lt;/P&gt;&lt;P&gt;$tempFile = [System.IO.Path]::GetTempFileName()&lt;/P&gt;&lt;P&gt;Copy-DatastoreItem -Item "DS:\$($vm.Name)\vmware.log" -Destination $tempFile&lt;/P&gt;&lt;P&gt;Get-Content -Path $tempFile | where {($_ -match 'VMX has left the building' -or $_ -match 'CPU reset:')} |&lt;/P&gt;&lt;P&gt;ForEach-Object -Process {&lt;/P&gt;&lt;P&gt;$fields = $_.Split('|')&lt;/P&gt;&lt;P&gt;New-Object -TypeName PSObject -Property @{&lt;/P&gt;&lt;P&gt;VM = $vm.Name&lt;/P&gt;&lt;P&gt;Timestamp = [DateTime]$fields[0]&lt;/P&gt;&lt;P&gt;CPU = $fields[1].Trim(' ')&lt;/P&gt;&lt;P&gt;Duration = $fields[2].Split(' ')[6]&lt;BR /&gt;&lt;BR /&gt;Row = $fields&lt;/P&gt;&lt;P&gt;}&lt;/P&gt;&lt;P&gt;}&lt;/P&gt;&lt;P&gt;Remove-Item -Path $tempFile -Confirm:$false&lt;/P&gt;&lt;P&gt;Remove-PSDrive -Name DS -Confirm:$false&lt;/P&gt;&lt;P&gt;} | Select-Object VM,Timestamp,Duration,Row }&lt;/P&gt;&lt;P&gt;&lt;SPAN&gt;&amp;nbsp;&lt;/SPAN&gt;&lt;/P&gt;</description>
      <pubDate>Wed, 10 Nov 2021 20:45:54 GMT</pubDate>
      <guid>https://communities.vmware.com/t5/VMware-PowerCLI-Discussions/Power-off-information-from-vmware-log/m-p/2877381#M104097</guid>
      <dc:creator>vmCalgary</dc:creator>
      <dc:date>2021-11-10T20:45:54Z</dc:date>
    </item>
    <item>
      <title>Re: Power off information from vmware.log</title>
      <link>https://communities.vmware.com/t5/VMware-PowerCLI-Discussions/Power-off-information-from-vmware-log/m-p/2877383#M104098</link>
      <description>&lt;P&gt;I'm not sure why you split each line on a vertical bar, in the example lines I don't see any&lt;/P&gt;</description>
      <pubDate>Wed, 10 Nov 2021 20:49:38 GMT</pubDate>
      <guid>https://communities.vmware.com/t5/VMware-PowerCLI-Discussions/Power-off-information-from-vmware-log/m-p/2877383#M104098</guid>
      <dc:creator>LucD</dc:creator>
      <dc:date>2021-11-10T20:49:38Z</dc:date>
    </item>
    <item>
      <title>Re: Power off information from vmware.log</title>
      <link>https://communities.vmware.com/t5/VMware-PowerCLI-Discussions/Power-off-information-from-vmware-log/m-p/2877386#M104099</link>
      <description>&lt;BLOCKQUOTE&gt;&lt;HR /&gt;&lt;a href="https://communities.vmware.com/t5/user/viewprofilepage/user-id/256147"&gt;@LucD&lt;/a&gt;&amp;nbsp;wrote:&lt;BR /&gt;&lt;P&gt;I'm not sure why you split each line on a vertical bar, in the example lines I don't see any&lt;/P&gt;&lt;HR /&gt;&lt;/BLOCKQUOTE&gt;&lt;P&gt;I wasn't sure what that line was doing in the original code.&lt;/P&gt;&lt;P&gt;VMware.log looks like this, as you well know.&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;2021-11-04T17:16:28.362Z| vmx| I125: Vix: [956803 mainDispatch.c:4253]: VMAutomation: Ignoring ReportPowerOpFinished because the VMX is shutting down.
2021-11-04T17:16:28.362Z| vmx| I125: Transitioned vmx/execState/val to poweredOff
2021-11-04T17:16:28.362Z| vmx| I125: Vigor_ClientRequestCb: failed to do op=5 on unregistered device 'ConfigParams' (cmd=(null))
2021-11-04T17:16:28.362Z| vmx| I125: VMX idle exit
2021-11-04T17:16:28.378Z| vmx| I125: Vix: [956803 mainDispatch.c:834]: VMAutomation_LateShutdown()
2021-11-04T17:16:28.378Z| vmx| I125: Vix: [956803 mainDispatch.c:783]: VMAutomationCloseListenerSocket. Closing listener socket.
2021-11-04T17:16:28.380Z| vmx| I125: Flushing VMX VMDB connections
2021-11-04T17:16:28.380Z| vmx| I125: VigorTransport_ServerCloseClient: Closing transport 1CB4529850 (err = 0)
2021-11-04T17:16:28.380Z| vmx| I125: VigorTransport_ServerDestroy: server destroyed.
2021-11-04T17:16:28.380Z| vmx| I125: VMX exit (0).
2021-11-04T17:16:28.381Z| vmx| I125: AIOMGR-S : stat o=153 r=308 w=59 i=125 br=4458660 bw=338807
2021-11-04T17:16:28.381Z| vmx| I125: AIOMGR-U : stat o=14 r=12 w=127 i=0 br=96 bw=214512
2021-11-04T17:16:28.381Z| vmx| I125: OBJLIB-LIB: ObjLib cleanup done.
2021-11-04T17:16:28.381Z| vmx| W115: VMX has left the building: 0.&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;I'll focus on what I want to get from the log. I want timestamp and the message.&lt;/P&gt;&lt;P&gt;Timestamp&lt;/P&gt;&lt;P&gt;VMX has left the building: 0.&lt;/P&gt;&lt;P&gt;Transitioned vmx/execState/val to poweredOff&lt;/P&gt;&lt;P&gt;VMX exit (0).&lt;/P&gt;&lt;P&gt;Is this how I'd write my regex?&lt;/P&gt;&lt;LI-CODE lang="markup"&gt; Get-Content -Path $tempFile | where {$_ -match 'VMX has left the building'|'CPU reset:'|'power|'Power'|'vmotion'|'Vmotion' } |&lt;/LI-CODE&gt;&lt;BLOCKQUOTE&gt;&lt;HR /&gt;&lt;/BLOCKQUOTE&gt;</description>
      <pubDate>Wed, 10 Nov 2021 21:00:32 GMT</pubDate>
      <guid>https://communities.vmware.com/t5/VMware-PowerCLI-Discussions/Power-off-information-from-vmware-log/m-p/2877386#M104099</guid>
      <dc:creator>vmCalgary</dc:creator>
      <dc:date>2021-11-10T21:00:32Z</dc:date>
    </item>
    <item>
      <title>Re: Power off information from vmware.log</title>
      <link>https://communities.vmware.com/t5/VMware-PowerCLI-Discussions/Power-off-information-from-vmware-log/m-p/2877395#M104100</link>
      <description>&lt;P&gt;Nearly, but in 1 string&lt;BR /&gt;&lt;BR /&gt;&lt;/P&gt;
&lt;LI-CODE lang="csharp"&gt;Get-Content -Path $tempFile | where {$_ -match 'VMX has left the building|CPU reset:|power|Power|vmotion|Vmotion' } |&lt;/LI-CODE&gt;</description>
      <pubDate>Wed, 10 Nov 2021 21:28:07 GMT</pubDate>
      <guid>https://communities.vmware.com/t5/VMware-PowerCLI-Discussions/Power-off-information-from-vmware-log/m-p/2877395#M104100</guid>
      <dc:creator>LucD</dc:creator>
      <dc:date>2021-11-10T21:28:07Z</dc:date>
    </item>
    <item>
      <title>Re: Power off information from vmware.log</title>
      <link>https://communities.vmware.com/t5/VMware-PowerCLI-Discussions/Power-off-information-from-vmware-log/m-p/2877404#M104102</link>
      <description>&lt;P&gt;I'm not sure how you calculate $duration.&lt;BR /&gt;&lt;BR /&gt;Also, you have to escape special characters in a RegEx.&lt;BR /&gt;This seems to work for me (tested with the sample vmware.log extract you posted).&lt;/P&gt;
&lt;LI-CODE lang="csharp"&gt;Get-Content -Path .\vmware.log |
where {$_ -match 'VMX has left the building|VMX exit \(0\).|Transitioned vmx/execState/val to poweredOff' } |
ForEach-Object -Process {
    $date,$dummy,$text = $_.Split('|')
    New-Object -TypeName PSObject -Property @{
        Date = [DateTime]$date
        Duration = '?'
    }
}&lt;/LI-CODE&gt;</description>
      <pubDate>Wed, 10 Nov 2021 21:47:00 GMT</pubDate>
      <guid>https://communities.vmware.com/t5/VMware-PowerCLI-Discussions/Power-off-information-from-vmware-log/m-p/2877404#M104102</guid>
      <dc:creator>LucD</dc:creator>
      <dc:date>2021-11-10T21:47:00Z</dc:date>
    </item>
    <item>
      <title>Re: Power off information from vmware.log</title>
      <link>https://communities.vmware.com/t5/VMware-PowerCLI-Discussions/Power-off-information-from-vmware-log/m-p/2877406#M104103</link>
      <description>&lt;P&gt;Thank you (as always) Luc. Works much better.&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;Copy-DatastoreItem : 11/10/2021 2:41:01 PM      Copy-DatastoreItem              Cannot find path 'DS:\TAM_Data_collector.sjrb.ad\vmware.log' because it does not
exist.
At C:\users\jmamer\VMware_scripts\SpringCleaning\PoweredOff\VMX-left-the-building.ps1:27 char:5
+     Copy-DatastoreItem -Item "DS:\$($vm.Name)\vmware.log" -Destinatio ...
+     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidArgument: (System.Object[]:Object[]) [Copy-DatastoreItem], VimException
    + FullyQualifiedErrorId : Core_CopyDatastoreItem_TryValidateSourceItem_InvalidSourceItem,VMware.VimAutomation.ViCore.Cmdlets.Commands.CopyD
   atastoreItem&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;I get this is because the script couldn't find a vmware.log file, often the case if the VM has never been powered up, but how do i get a log file of&amp;nbsp; VM names where vmware.log could not be read?&lt;/P&gt;&lt;P&gt;When I export-csv, the output looks like:&lt;/P&gt;&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="2021-11-10_14-44-34.jpg" style="width: 811px;"&gt;&lt;img src="https://communities.vmware.com/t5/image/serverpage/image-id/91990i1D93ACEA045277BD/image-dimensions/811x167/is-moderation-mode/true?v=v2" width="811" height="167" role="button" title="2021-11-10_14-44-34.jpg" alt="2021-11-10_14-44-34.jpg" /&gt;&lt;/span&gt;&lt;/P&gt;&lt;P&gt;When I run on the command line it looks like this:&lt;/P&gt;&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="2021-11-10_14-46-36.jpg" style="width: 881px;"&gt;&lt;img src="https://communities.vmware.com/t5/image/serverpage/image-id/91991iFC2B270DBB76D548/image-dimensions/881x152/is-moderation-mode/true?v=v2" width="881" height="152" role="button" title="2021-11-10_14-46-36.jpg" alt="2021-11-10_14-46-36.jpg" /&gt;&lt;/span&gt;&lt;/P&gt;&lt;P&gt;Why?&lt;/P&gt;&lt;P&gt;Joy&lt;/P&gt;&lt;P&gt;PS. I'll use Excel to calculate duration.&lt;/P&gt;</description>
      <pubDate>Wed, 10 Nov 2021 21:49:27 GMT</pubDate>
      <guid>https://communities.vmware.com/t5/VMware-PowerCLI-Discussions/Power-off-information-from-vmware-log/m-p/2877406#M104103</guid>
      <dc:creator>vmCalgary</dc:creator>
      <dc:date>2021-11-10T21:49:27Z</dc:date>
    </item>
    <item>
      <title>Re: Power off information from vmware.log</title>
      <link>https://communities.vmware.com/t5/VMware-PowerCLI-Discussions/Power-off-information-from-vmware-log/m-p/2877407#M104104</link>
      <description>&lt;P&gt;Use a try-catch construct around the Copy-DatastoreItem.&lt;BR /&gt;If the file does not exist, your script will go to the catch block, where you can log the name of the VM.&lt;BR /&gt;&lt;BR /&gt;The System.STring[] in a CSV indicates that the variable you are exporting contains an array of strings, not a single string.&lt;BR /&gt;Export-Csv can't handle that, while the default output formatter to the console can.&lt;BR /&gt;&lt;BR /&gt;An easy fix could be to use the -join operator: &lt;STRONG&gt;$field -join '|'&lt;/STRONG&gt;&lt;/P&gt;</description>
      <pubDate>Wed, 10 Nov 2021 21:56:00 GMT</pubDate>
      <guid>https://communities.vmware.com/t5/VMware-PowerCLI-Discussions/Power-off-information-from-vmware-log/m-p/2877407#M104104</guid>
      <dc:creator>LucD</dc:creator>
      <dc:date>2021-11-10T21:56:00Z</dc:date>
    </item>
    <item>
      <title>Re: Power off information from vmware.log</title>
      <link>https://communities.vmware.com/t5/VMware-PowerCLI-Discussions/Power-off-information-from-vmware-log/m-p/2877413#M104105</link>
      <description>&lt;P&gt;I'm going to let Excel do some heavy lifting. I'll use out-file and send to txt. Then copy and paste into excel and use the 'convert text to columns' feature.&lt;/P&gt;&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="2021-11-10_15-22-51.jpg" style="width: 956px;"&gt;&lt;img src="https://communities.vmware.com/t5/image/serverpage/image-id/91992i9F3644B900FCF47A/image-size/large/is-moderation-mode/true?v=v2&amp;amp;px=999" role="button" title="2021-11-10_15-22-51.jpg" alt="2021-11-10_15-22-51.jpg" /&gt;&lt;/span&gt;&lt;/P&gt;&lt;P&gt;Final code (for now):&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;$vmList = Get-Content C:\users\jmamer\VMware_scripts\SpringCleaning\PoweredOff\all-Nov10.txt # list VMs in txt file 

$report = @()

foreach ($vmName in $vmList) {Get-VM -Name $vmName -PipelineVariable vm |

ForEach-Object -Process {

    $vmxPath = $vm.ExtensionData.Config.Files.VmpathName

    $dsObj = Get-Datastore -Name $vmxPath.Split(']')[0].TrimStart('[')

    New-PSDrive -Location $dsObj -Name DS -PSProvider VimDatastore -Root "\" | Out-Null

    $tempFile = [System.IO.Path]::GetTempFileName()

    Copy-DatastoreItem -Item "DS:\$($vm.Name)\vmware.log" -Destination $tempFile

    Get-Content -Path $tempFile | where {$_ -match 'VMX has left the building|CPU reset:|power|Power|vmotion|Vmotion' } |

    ForEach-Object -Process {

 $fields = $_.Split('|')

    New-Object -TypeName PSObject -Property @{

     VM = $vm.Name

     Timestamp = [DateTime]$fields[0]
          
     Row = $fields

        }

    }

    Remove-Item -Path $tempFile -Confirm:$false

    Remove-PSDrive -Name DS -Confirm:$false

 } |  Select-Object VM,Timestamp,Row }&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;I'll run a function in Excel to see which VMs are missing (no vmware.log).&lt;/P&gt;&lt;P&gt;It could be prettier but I need to get to the analysis part of the problem I'm working on with reclaiming resources. Thanks so much Luc.&lt;/P&gt;</description>
      <pubDate>Wed, 10 Nov 2021 22:28:56 GMT</pubDate>
      <guid>https://communities.vmware.com/t5/VMware-PowerCLI-Discussions/Power-off-information-from-vmware-log/m-p/2877413#M104105</guid>
      <dc:creator>vmCalgary</dc:creator>
      <dc:date>2021-11-10T22:28:56Z</dc:date>
    </item>
  </channel>
</rss>

