VMware Cloud Community
horningj
Contributor
Contributor
Jump to solution

Get-VIEvent - How do I export the event type ? error, warning, or info

Hi,

I know the Get-VIEvent  cmd lets you specify the type of events to retrieve...   i.e [-Types <EventCategory[]>]

but, I want to extract all events and export them to a CSV...I want one of the columns to be 'EventCategory' which will be either ERROR, WARNING, or INFO but I can't seem to find it.  $_.Gettype().Name gets me the event type but not the category.  I know I can have my script run 3 times (each time specifying the -Types parameter) but I want to run just once.  Any ideas?

Thanks!

Jeff

Reply
0 Kudos
1 Solution

Accepted Solutions
mattboren
Expert
Expert
Jump to solution

Hello, horningj-

I worked out a couple of items that should grab the event category.  The first selects a few properties, including a calculated property that gets the event category:

## works well if no events of type 'EventEx'
## get the .Net View object of the EventManager (used for getting the event Category)
$viewEventMgr = Get-View EventManager
## get some VIEvents, select a few properties, including a calculated property for EventCategory
Get-VIEvent | Select FullFormattedMessage, CreatedTime, @{n="EventCategory"; e={$strThisEventType = $_.GetType().Name; ($viewEventMgr.Description.EventInfo | ?{$_.Key -eq $strThisEventType}).Category}}

This gets VIEvents (the latest 100, as I did not specify the -MaxSamples parameter), and returns the given properties.  The "EventCategory" calculated property uses the VIEvent object's type to look in the collection of EventDescriptionEventDetail items in the eventInfo property found in the .Net View object for the EventManager.  It then grabs the "Category" property of the corresponding EventDescriptionEventDetail item.

Works pretty well unless you have any VIEvents of type "EventEx" -- then, this method of "lookup" in the EventDescriptionEventDetail collection fails, as there are more than one item of that type (there are 91 of them at the moment).

This led me to the next bit.  It is similar to the previous method, but it handles EventEx events, too:

## get the .Net View object of the EventManager (used for getting the event Category)
$viewEventMgr = Get-View EventManager

## get some VIEvents (the last 100, as "-MaxSamples" is not specified)
Get-VIEvent | %{
    ## put the pipeline varible into another variable; get its type
    $oThisEvent = $_; $strThisEventType = $_.GetType().Name
    ## if this event is of type "EventEx"
    if ($strThisEventType -eq "EventEx") {
        $strEventTypeId = $oThisEvent.EventTypeId;
        ## get the EventInfo item (of type EventDescriptionEventDetail) whose "FullFormat" property begins with the EventTypeId of the VIEvent at hand, and get its "Category" property
        $strCategory = ($viewEventMgr.Description.EventInfo | ?{$strRegexPattern = "^$strEventTypeId\|.*"; $_.FullFormat -match $strRegexPattern}).Category
    }
## end if
    ## else, can just grab the EventInfo item whose "Key" is the same as this event's type
    else {$strCategory = ($viewEventMgr.Description.EventInfo | ?{$_.Key -eq $strThisEventType}).Category}
    ## add a NoteProperty "EventCategory" to this event
    $oThisEvent | Add-Member -MemberType NoteProperty -Name EventCategory -Value $strCategory -PassThru
} |
Select FullFormattedMessage, CreatedTime, EventCategory

It appears that the EventTypeId of the event returned from Get-VIEvent is included as the first part of the FullFormat property of EventDescriptionEventDetail items with the key EventEx, delimited from the rest of the value by a vertical pipe.  So, the EventTypeId from the VIEvents can be used to do a match on the EventEx types of events from the EventManager .Net View object to get the event "category" (info, warning, error, user).

You can, of course, change up the Select statements to pick/choose the pieces of info that you would like to export, and then export them to some data file as you please.

How does that do for you?

* Message was edited by mattboren on 05 Apr 2011 -- added line to start of second piece of code "$viewEventMgr = Get-View EventManager".  This was already in the first piece and assumed that user was running both pieces in same session, but added for completeness.

View solution in original post

Reply
0 Kudos
38 Replies
LucD
Leadership
Leadership
Jump to solution

Try it like this (works for me)

Get-VIEvent | %{
    if($_.GetTYpe().Name -like "*warning*"){
        $type = "Warning"
    }    
elseif($_.Datacenter){         $type = "Error"
    }     else{         $type = "Info"
    }    
Add-Member -InputObject $_ -Name EventCategory -Value $type -MemberType NoteProperty -PassThru
} | Export-Csv "C:\events-category.csv" -NoTypeInformation -UseCulture


Blog: lucd.info  Twitter: @LucD22  Co-author PowerCLI Reference

Reply
0 Kudos
horningj
Contributor
Contributor
Jump to solution

Hi,

Thanks for your help... this doesn't seem to work for me, it doesn't categorize any as ERROR.  for example, when I query for -Types ERROR, I see some "NoAccessUserEvent" events but they get categorizes as INFO.    What is ($_.DC) exactly?

Thanks!

Jeff

Reply
0 Kudos
LucD
Leadership
Leadership
Jump to solution

Sorry, $_.DC should have been $_.Datacenter.

Try again please.


Blog: lucd.info  Twitter: @LucD22  Co-author PowerCLI Reference

Reply
0 Kudos
horningj
Contributor
Contributor
Jump to solution

nope, same problem.  I see a bunch of errors with no DataCenter listed.

Reply
0 Kudos
LucD
Leadership
Leadership
Jump to solution

Can you give me some of the error types that do not have a datacenter MoRef ?


Blog: lucd.info  Twitter: @LucD22  Co-author PowerCLI Reference

Reply
0 Kudos
horningj
Contributor
Contributor
Jump to solution

sure...

BadUsernameSessionEvent
ScheduledTaskFailedEvent
HostCnxFailedBadUsernameEvent
LicenseServerUnavailableEvent
NoAccessUserEvent

I'm thinking there has to be a better way... like knowing exactly how vmware categories them. whether there is some way to surface that atrribute, or knowing the exact rules vmware uses to categorize them.

Reply
0 Kudos
LucD
Leadership
Leadership
Jump to solution

Strange, tested with BadUsernameSessionEvent and that has a Datacenter value.

I don't think there is a better way.

On the EventCollector you can specify the Severity, but the property is not in the regular Event object.

Only in the EventEx object there is a severity property.

That's why I came up with that script, but apparently it doesn't work in all cases.

Btw, I tested with

Get-VIEvent -Types Error -MaxSamples 9999 | %{
    if($_.GetTYpe().Name -like "*warning*"){
        $type = "Warning"    }
    elseif($_.Datacenter){
        $type = "Error"    }
    else{
        $type = "Info"    }
    Add-Member -InputObject $_ -Name EventCategory -Value $type -MemberType NoteProperty -PassThru
} |
Group-Object -Property EventCategory

In all cases, I only get 1 group with 9999 entries.


Blog: lucd.info  Twitter: @LucD22  Co-author PowerCLI Reference

Reply
0 Kudos
mattboren
Expert
Expert
Jump to solution

Hello, horningj-

I worked out a couple of items that should grab the event category.  The first selects a few properties, including a calculated property that gets the event category:

## works well if no events of type 'EventEx'
## get the .Net View object of the EventManager (used for getting the event Category)
$viewEventMgr = Get-View EventManager
## get some VIEvents, select a few properties, including a calculated property for EventCategory
Get-VIEvent | Select FullFormattedMessage, CreatedTime, @{n="EventCategory"; e={$strThisEventType = $_.GetType().Name; ($viewEventMgr.Description.EventInfo | ?{$_.Key -eq $strThisEventType}).Category}}

This gets VIEvents (the latest 100, as I did not specify the -MaxSamples parameter), and returns the given properties.  The "EventCategory" calculated property uses the VIEvent object's type to look in the collection of EventDescriptionEventDetail items in the eventInfo property found in the .Net View object for the EventManager.  It then grabs the "Category" property of the corresponding EventDescriptionEventDetail item.

Works pretty well unless you have any VIEvents of type "EventEx" -- then, this method of "lookup" in the EventDescriptionEventDetail collection fails, as there are more than one item of that type (there are 91 of them at the moment).

This led me to the next bit.  It is similar to the previous method, but it handles EventEx events, too:

## get the .Net View object of the EventManager (used for getting the event Category)
$viewEventMgr = Get-View EventManager

## get some VIEvents (the last 100, as "-MaxSamples" is not specified)
Get-VIEvent | %{
    ## put the pipeline varible into another variable; get its type
    $oThisEvent = $_; $strThisEventType = $_.GetType().Name
    ## if this event is of type "EventEx"
    if ($strThisEventType -eq "EventEx") {
        $strEventTypeId = $oThisEvent.EventTypeId;
        ## get the EventInfo item (of type EventDescriptionEventDetail) whose "FullFormat" property begins with the EventTypeId of the VIEvent at hand, and get its "Category" property
        $strCategory = ($viewEventMgr.Description.EventInfo | ?{$strRegexPattern = "^$strEventTypeId\|.*"; $_.FullFormat -match $strRegexPattern}).Category
    }
## end if
    ## else, can just grab the EventInfo item whose "Key" is the same as this event's type
    else {$strCategory = ($viewEventMgr.Description.EventInfo | ?{$_.Key -eq $strThisEventType}).Category}
    ## add a NoteProperty "EventCategory" to this event
    $oThisEvent | Add-Member -MemberType NoteProperty -Name EventCategory -Value $strCategory -PassThru
} |
Select FullFormattedMessage, CreatedTime, EventCategory

It appears that the EventTypeId of the event returned from Get-VIEvent is included as the first part of the FullFormat property of EventDescriptionEventDetail items with the key EventEx, delimited from the rest of the value by a vertical pipe.  So, the EventTypeId from the VIEvents can be used to do a match on the EventEx types of events from the EventManager .Net View object to get the event "category" (info, warning, error, user).

You can, of course, change up the Select statements to pick/choose the pieces of info that you would like to export, and then export them to some data file as you please.

How does that do for you?

* Message was edited by mattboren on 05 Apr 2011 -- added line to start of second piece of code "$viewEventMgr = Get-View EventManager".  This was already in the first piece and assumed that user was running both pieces in same session, but added for completeness.

Reply
0 Kudos
LucD
Leadership
Leadership
Jump to solution

Great find, didn't think of that.


Blog: lucd.info  Twitter: @LucD22  Co-author PowerCLI Reference

Reply
0 Kudos
horningj
Contributor
Contributor
Jump to solution

well, I tried both methods against a few vSphere servers and EventCategory is always blank.

wondering if it's a permissions thing or library not installed thing maybe...

Reply
0 Kudos
mattboren
Expert
Expert
Jump to solution

Hey, horningj-

There was a line in the first piece of code that was assumed to have been run in the same session in which the second piece of code was run.  The

$viewEventMgr = Get-View EventManager

line.  I have now added that to my previous post for completeness.  If you had started a new session or connected to a new vCenter server, and had run that second section of code without this line, you would surely have gotten all blanks for EventCategory.  So, if you have not, try it again with that line included.

Another thing -- are you running this when connected to a vCenter server, or are you connected directly to an ESX/ESXi host?  If the latter, you may need to amend this aforementioned line to be as follows:

$viewEventMgr = Get-View (Get-View 'ServiceInstance').Content.EventManager


What kind of results does that give you?

Reply
0 Kudos
horningj
Contributor
Contributor
Jump to solution

Hi,

I'm connecting to a vCenter server... still not working for me , eventcategory is always blank.  hmmm... I'll see if I can get elevated privs to see if that is the issue.

Thanks,

Jeff

Reply
0 Kudos
horningj
Contributor
Contributor
Jump to solution

that was it!  when I was granted temporary admin access, I was able to see EventCategory... but as a 'Read-Only' user, I was not.  now... I wonder what privs need to be set to be able to see the eventcategories...obviously, read-only doesn't cut it, and I should have to be admin. any ideas?

Reply
0 Kudos
KUMARNILAY
Contributor
Contributor
Jump to solution

Hi LucD,

     I want to extract Event log for a particular ESX host for a particular time range. like

Want logs for the server VATLKESX1VMP039 of below dates .Want to see if there were any network issues with this server during the mentioned time.

03/21/11 00:19:04

03/20/11 17:23:59

03/07/11 01:18:43

Please let me know if its works

Reply
0 Kudos
LucD
Leadership
Leadership
Jump to solution

I'm afraid you can't specify multiple time ranges with the Get-VIEvent cmdlet.

It means you have to make multiple calls to the cmdlet and combine the resturned events.


Blog: lucd.info  Twitter: @LucD22  Co-author PowerCLI Reference

Reply
0 Kudos
KUMARNILAY
Contributor
Contributor
Jump to solution

Sorry for the confusion  i want to extract for a particular month and for a particular ESX like March ist to 31ist March.
since i am not good in powerCli script pls let me know the script for extracting the logs

Want logs for the server VATLKESX1VMP039 of below dates .Want to see if there were any network issues with this server during the mentioned time.

Reply
0 Kudos
LucD
Leadership
Leadership
Jump to solution

If you want the month of March, you could do

Get-VIEvent -Entity VATLKESX1VMP039* -Start (Get-Date 03/01/2011) -Finish (Get-Date 04/01/2011)

Is that what you are looking for ?


Blog: lucd.info  Twitter: @LucD22  Co-author PowerCLI Reference

Reply
0 Kudos
KUMARNILAY
Contributor
Contributor
Jump to solution

Yes that i am looking I appreciate your prompt help  but its  shows error
[vSphere PowerCLI] C:\> Get-VIEvent -Entity VATLKESX1VMP039 -Start (Get-Date 03/
01/2011) -Finish (Get-Date 04/01/2011)
Get-VIEvent : Cannot bind parameter 'Entity'. Cannot convert the "VATLKESX1VMP0
39" value of type "System.String" to type "VMware.VimAutomation.Sdk.Types.V1.VI
Object".
At line:1 char:20
+ Get-VIEvent -Entity <<<<  VATLKESX1VMP039 -Start (Get-Date 03/01/2011) -Finis
h (Get-Date 04/01/2011)
    + CategoryInfo          : InvalidArgument: (:) [Get-VIEvent], ParameterBin
   dingException
    + FullyQualifiedErrorId : CannotConvertArgumentNoMessage,VMware.VimAutomat
   ion.ViCore.Cmdlets.Commands.GetEvent

Any thing need to edit ?

Reply
0 Kudos
LucD
Leadership
Leadership
Jump to solution

Try using the asterisk (*) behind the name of the server as I showed in my sample line.


Blog: lucd.info  Twitter: @LucD22  Co-author PowerCLI Reference

Reply
0 Kudos