Creator of Snapshot

[pamiller21]

I currently have a report showing me old snaps, but I would like to add who created the snap if possible.  Here is what I have:

#############################
# Variables #
#############################
$date = Get-Date -format "yyyy-MMM-d"
$datetime = Get-Date
$filelocation = "\var\www\Snapshots\snapshot-$date.htm"

#############################
# Content #
#############################
$tgtDate = (Get-Date).AddDays(-2)
$report = Get-VM | Get-Snapshot |
where { $_.vm -NotLike "*_replica*" -and $_.Created -lt $tgtDate } |
Select-Object vm, name, sizeGB, created, powerstate

#############################
# Add Text to the HTML file #
#############################
$report | ConvertTo-Html –title "VMware Snapshot Check " –body "<H1>VMware Snapshot Check</H1>" -head "<link rel='stylesheet' href='style.css' type='text/css' />" | Out-File $filelocation
ConvertTo-Html –title "VMware Snapshot Check " –body "<H4>Date and time</H4>",$datetime -head "<link rel='stylesheet' href='style.css' type='text/css' />" | Out-File -Append $filelocation
ConvertTo-Html –title "VMware Snapshot Check " –body "<H4>VM Count</H4>",$report.Count -head "<link rel='stylesheet' href='style.css' type='text/css' />" | Out-File -Append $filelocation

[LucD]

That has to go via the events, have a look at PowerCLI SnapShot Creator in Report - VMware Technology Network VMTN

Read till the end 😁

[pamiller21]

I messed around with what you had there, and I got it to spit out the following:

Name : VMware-Util.it
SnapShot : 02.01.2021|2.1.21
SnapShot Created : 2/2/2021 5:30:09 AM,2/1/2021 6:28:46 PM
Days Old :
Created By :

Name : isd4000-cinas
SnapShot : 1.7.21
SnapShot Created : 01/07/2021 18:11:48
Days Old : 25
Created By :

Name : processmaker.it.
SnapShot : 1.28.21
SnapShot Created : 01/28/2021 20:52:31
Days Old : 4
Created By :

Name : Cloudfax2.
SnapShot : 12.31.20|cloudfax2
SnapShot Created : 1/1/2021 12:00:01 AM,6/23/2020 5:45:08 AM
Days Old :
Created By :

And to be clear this is what I ran:

Get-View -ViewType VirtualMachine -Filter @{'Runtime.PowerState'='poweredOn';'Snapshot'=".+"} |
 Select -First 50 Name,
 @{N='SnapShot';E={
 function Get-Snap{
 param([PSObject]$snap)
 $snap
 if($snap.ChildSnapshotList){
 $snap.ChildSnapshotList | %{
 Get-Snap -Snap $_
 }
 }
 }
 $script:snaps = $_.Snapshot.RootSnapshotList | %{
 Get-Snap -Snap $_
 }
 ($script:snaps | sort-Object -property Name).Name -join '|'}},
 @{N='SnapShot Created';E={($script:snaps | sort-Object -property Name).CreateTime -join ','}},
 @{N="Days Old";E={(New-TimeSpan -End (Get-Date) -Start $script:snaps.CreateTime).Days}},
 @{N='Created By';E={$snapevent = Get-VIEvent -Entity $_ -Types Info -Finish $_.created -MaxSamples 1 | Where-Object {$_.FullFormattedMessage -imatch 'Task: Create virtual machine snapshot'}
 $snapevent.UserName}}

[LucD]

You left out the part where the script looks for the corresponding TaskEvent.
You need to do that because that is where the User comes from.

[pamiller21]

Thank you for your help on this, I got this almost perfect, but I am trying to find a way to only report snapshots 5 days older but I am not sure how do this via Get-View 😕  This is what I got so far:

#############################
# Variables #
#############################
$date = Get-Date -format "yyyy-MMM-d"
$datetime = Get-Date
$filelocation = "\var\www\Snapshots\snapshot-$date.htm"

#############################
# Content #
#############################

$timeDiff = 2
$report = Get-View -ViewType VirtualMachine -Filter @{'Runtime.PowerState'='poweredOn';'Snapshot'=".+"} |
Select -First 50 Name,
@{N='SnapShot';E={
function Get-Snap{
param([PSObject]$snap)
$snap
if($snap.ChildSnapshotList){
$snap.ChildSnapshotList | %{
Get-Snap -Snap $_
}
}
}
$script:snaps = $_.Snapshot.RootSnapshotList | %{
Get-Snap -Snap $_
}
($script:snaps | sort-Object -property Name).Name -join '|'}},
@{N='SnapShot Created';E={($script:snaps | sort-Object -property Name).CreateTime -join '|'}},
@{N="Days Old";E={
$now = Get-Date
($script:snaps | %{(New-TimeSpan -End $now -Start $_.CreateTime).Days}) -join '|'}},
@{N='Created By';E={
$startEvents = $script:snaps.CreateTime
$start = $startEvents | Sort-Object | Select -First 1
(Get-VIEvent -Entity $_.Name -Start $start.AddSeconds(- $timeDiff) -MaxSamples ([int]::MaxValue) |
Where-Object {$_ -is [VMware.Vim.TaskEvent] -and $_.Info.DescriptionId -eq 'VirtualMachine.createSnapshot'} |
ForEach-Object -Process {
$event = $_
$startEvents | ForEach-Object -Process {
if([math]::Abs((New-TimeSpan -Start $event.CreatedTime -End $_.ToLocalTime()).TotalSeconds) -lt $timeDiff){
$event
}
}
} | Select-Object -ExpandProperty UserName) -join '|'}}

#############################
# Add Text to the HTML file #
#############################
$report | ConvertTo-Html –title "VMware Snapshot Check " –body "<H1>VMware Snapshot Check</H1>" -head "<link rel='stylesheet' href='style.css' type='text/css' />" | Out-File $filelocation
ConvertTo-Html –title "VMware Snapshot Check " –body "<H4>Date and time</H4>",$datetime -head "<link rel='stylesheet' href='style.css' type='text/css' />" | Out-File -Append $filelocation
ConvertTo-Html –title "VMware Snapshot Check " –body "<H4>VM Count</H4>",$report.Count -head "<link rel='stylesheet' href='style.css' type='text/css' />" | Out-File -Append $filelocation

[LucD]

You could try adding a Where-clause

      $script:snaps = $_.Snapshot.RootSnapshotList | 
      where{$_.CreateTime -le (Get-Date).AddDays(-5) | % {
        Get-Snap -Snap $_
      }

[pamiller21]

This mostly worked, it removed the fields of some but not the name, here is a screen shot.

[LucD]

If you don't want to see those VMs at all, you will have to add an additional Where-clause after the initial Get-View.
But that would require some basic changes to the code.
Perhaps easier to filter out those entries at the end.

$report | 
where{$_.Snapshot -ne ''} |
ConvertTo-Html –Title "VMware Snapshot Check " –Body "<H1>VMware Snapshot Check</H1>" -Head "<link rel='stylesheet' href='style.css' type='text/css' />" | Out-File $filelocation