I had an event on the 11th of July where I lost one of my ESXi hosts in my vCenter briefly. It automatically restarted itself and started up the VMs that were running on it. I need to get a list of VMs that were impacted by the restart. Is there a quick and dirty way to pull some logs that would show that?
There is no quick or dirty way to it , you would have to dig in the logs to figure this out
You need to check the hostd and fdm logs for the host for that time to find the name of the VM's that restarted because of HA Failover.
Note - Host logs would be in UTC Time
Figured, I did the quick and dirty way. I sorted by Uptime on the data center and pulled all VMs that only had an up time of 72 hours. I was hoping I could just open Hostd and do a grep or something of <vm started because hardware sucked>. Thanks for the help though. I will use that when I have some more time.
Collect the logs though just to ensure its not late to check the logs as they might get rolled over
Good call. Already done.
Dig for some powercli scripts on the net.
Hi Linklight,
You really need to try and react to issues such as these within the first 24 hours for best results. These events are logged to the vCenter database and the the best technique is using a PowerCLI script such as the following:
Get-VIEvent -start (Get-Date).adddays(-1) -MaxSamples 500000 | Where-Object {$_.eventtypeid -eq "com.vmware.vc.ha.VmRestartedByHAEvent"} | Select ObjectName,CreatedTime
In your case, you may need to increase the number of days to go back (i.e. "-4" or "-5") and you may need to increase the MaxSamples even higher. I use the script above saved to a .ps1 as part of my normal health checks, but you can just also just paste it right into a PowerCLI session that's connected to the vCenter in question.
More Details on the above command (see the section called "update2" in Jon's blog below)
http://www.jonathanmedd.net/2012/03/which-vms-restarted-after-a-vsphere-ha-event.html
More Detail from Duncan's KB:
As for Windows VMs, you can also check their uptime (requires admin and WMI access) to cross-check your findings: