Event Manager UTC time (Get-VIEventPlus)

[LittleNickey]

I'm using Luc's Get-VIEventPlus function to monitor HA failover events.

However, when exporting the events I noticed that the Event Manager used by this function has the time in UTC, which gives me an offset of 2 hours during summer time.

PowerCLI C:\> (Get-View EventManager).LatestEvent.CreatedTime.Kind

Utc

While the regular Get-VIEvent command uses local time (I'm guessing time on vCenter Server):

PowerCLI C:\> (Get-VIEvent | Select -First 1).CreatedTime.Kind

Local

I solve this "issue" by using the .NET method .ToLocalTime() so I get reports that isn't misleading to people not aware of the UTC format:

$Event.CreatedTime.ToLocalTime()

But I wonder if anyone knows why Event Manager uses UTC while Get-VIEvent uses local time and if you can change this somehow? From where does the Event Manger get the time stamps?

And a bonus would be if anyone knows if I can see which ESX Host the HA restarted VM was placed on before the restart?

[LucD · Accepted solution]

The vSphere servers track the events in UTC because these servers could be in different timezones.

The Get-VIEvent cmdlet converts that UTC into localtime.

Afaik this behavior is not configurable.

From the investigations I did for my HA VM failover tracking post, there is no easy way to find where a VM was hosted before the HA event.

You could run a daily inventory and record where a VM is running.

An alternative is to find which ESXi node failed and that made HA take those actions. But that is not foolproof.

[LittleNickey]

Allright, I suspected that it might be the ESXi UTC time it used, but I didn't know that Get-VIEvent translated the time - that explains a lot.

Well, the important thing is to find which VMs that rebooted by HA without manually having to identifying them. The regular monitoring of the ESXi should tell us which host crashed.

Thanks for the input Luc!

[LucD]

I suspect I might have created some confusion, it's not the actual cmdlet that converts the time, but it is the default way that PowerShell displays a DateTime object.

In other words in local time.

[LittleNickey]

I see, but not when calling upon the Event Manager (as for example your Get-VIEventPlus function does)?

[LucD]

That's what I suspect, but I'll have to look into this a bit deeper to make sure.

[LittleNickey]

Alright, thanks a lot. Anyway, I've made up for the time difference already so my reports should be ok. :smileydevil: