Linklight
Contributor
Contributor

Logging Help

I had an event on the 11th of July where I lost one of my ESXi hosts in my vCenter briefly. It automatically restarted itself and started up the VMs that were running on it. I need to get a list of VMs that were impacted by the restart. Is there a quick and dirty way to pull some logs that would show that?

Tags (4)
6 Replies
pratjain
VMware Employee
VMware Employee

There is no quick or dirty way to it , you would have to dig in the logs to figure this out

You need to check the hostd and fdm logs for the host for that time to find the name of the VM's that restarted because of HA Failover.

Note - Host logs would be in UTC Time

Regards, PJ If you find this or any other answer useful please mark the answer as correct or helpful.
Linklight
Contributor
Contributor

Figured, I did the quick and dirty way. I sorted by Uptime on the data center and pulled all VMs that only had an up time of 72 hours. I was hoping I could just open Hostd and do a grep or something of <vm started because hardware sucked>. Thanks for the help though. I will use that when I have some more time.

pratjain
VMware Employee
VMware Employee

Collect the logs though just to ensure its not late to check the logs as they might get rolled over

Regards, PJ If you find this or any other answer useful please mark the answer as correct or helpful.
0 Kudos
Linklight
Contributor
Contributor

Good call. Already done.

0 Kudos
warring
Enthusiast
Enthusiast

Dig for some powercli scripts on the net.

VCP510-DCV
0 Kudos
grasshopper
Virtuoso
Virtuoso

Hi Linklight,

You really need to try and react to issues such as these within the first 24 hours for best results.  These events are logged to the vCenter database and the the best technique is using a PowerCLI script such as the following:

Get-VIEvent -start (Get-Date).adddays(-1) -MaxSamples 500000 | Where-Object {$_.eventtypeid -eq "com.vmware.vc.ha.VmRestartedByHAEvent"} | Select ObjectName,CreatedTime

In your case, you may need to increase the number of days to go back (i.e. "-4" or "-5") and you may need to increase the MaxSamples even higher.  I use the script above saved to a .ps1 as part of my normal health checks, but you can just also just paste it right into a PowerCLI session that's connected to the vCenter in question.

More Details on the above command (see the section called "update2" in Jon's blog below)

http://www.jonathanmedd.net/2012/03/which-vms-restarted-after-a-vsphere-ha-event.html

More Detail from Duncan's KB:

http://www.yellow-bricks.com/2012/09/20/a-host-has-failed-which-vms-were-impacted-and-restarted-by-h...

As for Windows VMs, you can also check their uptime (requires admin and WMI access) to cross-check your findings:

http://www.bhargavs.com//?s=Get-Uptime.ps1

0 Kudos