Get a list of vm names experiencing an event

[mattj2020]

I'm trying to get a list of vms from the prior day (or any time period) where a specific event has occurred. I'm very much a novice at Powershell.

This is the event filter and I'll post a result:

Get-VIEvent -start 06/24/2020 | ?{$_.fullFormattedMessage -match "reload"}

Info                 : VMware.Vim.TaskInfo

Key                  : 6776769

ChainId              : 6776769

CreatedTime          : 6/26/2020 1:00:22 AM

UserName             : com.springpath.sysmgmt.domain-c67

Datacenter           : VMware.Vim.DatacenterEventArgument

ComputeResource      : VMware.Vim.ComputeResourceEventArgument

Host                 : VMware.Vim.HostEventArgument

Vm                   : VMware.Vim.VmEventArgument

Ds                   :

Net                  :

Dvs                  :

FullFormattedMessage : Task: Reload virtual machine

ChangeTag            :

As shown, the VM property doesn't contain useful information, so I thought I'd try to use the Key or ChainId to retrieve information, but querying these returns nothing.

get-vievent | ?{$_.key -eq 6776769}

[LucD]

Have you looked inside the Info property?

Get-VIEvent -start 06/24/2020 | ?{$_.fullFormattedMessage -match "reload"} |

Select -ExpandProperty Info

As an alternative, try

Get-VIEvent -start 06/24/2020 | Where{$_ -is [VMware.Vim.VmReloadFromPathEvent]}

[mattj2020]

Both options produced no output at all.

[mattj2020]

I added -entity to my command and now get extra info. i'm unsure of how to "get" the vm name?

Get-VIEvent -entity den* -start 06/24/2020 | ?{$_.fullFormattedMessage -match "reload"} | select -expandproperty info

Key           : task-45390

Task          : Task-task-45390

Description   :

Name          : Reload

DescriptionId : VirtualMachine.reload

Entity        : VirtualMachine-vm-788

EntityName    : denxxxxxxxx

Locked        :

State         : queued

Cancelled     : False

Cancelable    : True

Error         :

Result        :

Progress      :

Reason        : VMware.Vim.TaskReasonUser

QueueTime     : 6/24/2020 6:00:16 AM

StartTime     :

CompleteTime  :

EventChainId  : 0

ChangeTag     :

ParentTaskKey :

RootTaskKey   :

ActivationId  :

LinkedView    :

[LucD]

Isn't the EntityName showing the VM's name?

Btw, you will have to use the MaxSamples parameter, by default only 100 events are returned.

Get-VIEvent -start 06/24/2020 -MaxSamples ([int]::MaxValue) |

Where{$_ -is [VMware.Vim.VmReloadFromPathEvent]}

[mattj2020]

It is, though I'm trying to return just a list of vms. Since I already have  a select, I'm unsure of how to get just a list of names.

[LucD]

You mean lie this?

Get-VIEvent -start 06/24/2020 -MaxSamples ([int]::MaxValue) |

Where{$_ -is [VMware.Vim.VmReloadFromPathEvent]} | %{

    $_.VM.Name

}

[mattj2020]

This didn't return anything, so I went back a few posts....

This returns many records:

Get-VIEvent -entity den* -start 06/24/2020 | ?{$_.fullFormattedMessage -match "reload"} | select -expandproperty info

Running any of the others didn't return anything:

Get-VIEvent -start 06/24/2020 -MaxSamples ([int]::MaxValue) |

Where{$_ -is [VMware.Vim.VmReloadFromPathEvent]} | %{

    $_.VM.Name

}

I also tried just in case:

Get-VIEvent -entity den* -start 06/24/2020 -MaxSamples ([int]::MaxValue) | Where{$_ -is [VMware.Vim.VmReloadFromPathEvent]} | %{ $_.VM.Name}

[LucD]

Are you sure there were reloads done that day?

[LucD]

A handy way to get an overview of the events that are present for a specific time range, is the following

Get-VIEvent -start 06/24/2020 -MaxSamples ([int]::MaxValue) |

Group-Object -Property {$_.GetType().Name}

[mattj2020]

Yes. Modifying this to show only today:

Get-VIEvent -entity den* -start 06/29/2020 | ?{$_.fullFormattedMessage -match "reload"} | select -expandproperty info

I get more than 40 results.

Trying any of these returns nothing:

Get-VIEvent -start 06/29/2020 -MaxSamples ([int]::MaxValue) | Where{$_ -is [VMware.Vim.VmReloadFromPathEvent]} | %{ $_.VM.Name}

[LucD]

Perhaps that is the wrong type of event.

Can you check which ones we should be looking at?

Get-VIEvent -entity den* -start 06/29/2020 -MaxSamples ([int]::MaxValue) |

Where{$_.fullFormattedMessage -match "reload"} |

ForEach-Object -Process {

    $_.GetType().Name

}

[mattj2020]

When running this I get many results, one of which is below. Get-VIEvent -entity den* -start 06/29/2020 | ?{$_.fullFormattedMessage -match "reload"} | select -expandproperty info

Key           : task-47732

Task          : Task-task-47732

Description   :

Name          : Reload

DescriptionId : VirtualMachine.reload

Entity        : VirtualMachine-vm-795

EntityName    : denxxxxxxxxx

Locked        :

State         : queued

Cancelled     : False

Cancelable    : True

Error         :

Result        :

Progress      :

Reason        : VMware.Vim.TaskReasonUser

QueueTime     : 6/29/2020 6:00:29 AM

StartTime     :

CompleteTime  :

EventChainId  : 0

ChangeTag     :

ParentTaskKey :

RootTaskKey   :

ActivationId  :

LinkedView    :

Running the last command:

Get-VIEvent -entity den* -start 06/29/2020 -MaxSamples ([int]::MaxValue) | Where{$_.fullFormattedMessage -match "reload"} | ForEach-Object -Process {$_.GetType().Name}

TaskEvent

TaskEvent

TaskEvent......... and it repeated until I broke the command.

[LucD]

Ok, so it is a TaskEvent.

How are you actually doing these 'reloads' of the VMs?

[mattj2020]

That's a great question! "We" aren't..... and that is part of why I'm trying to determine which vms are having this event. It appears to be occurring in most cases in conjunction with a snapshot, but not in all cases.

[LucD]

Are the VMs involved by any chance sittings on an NFS datastore?

And is Changed Block Tracking enabled for the backup tool?

There were issues in the past where there were long locks on the .ctk file.
In the Tasks you could see: create snapshot - reload VM - remove snapshot.

The VM appeared frozen for the duration of the 'reload VM' task.

But this quite some time ago and for an old version of ESX.

[LucD · Accepted solution]

In any case, then, if you only want the VM names, try something like this

Get-VIEvent -Entity den* -Start 06/29/2020 -MaxSamples ([int]::MaxValue) |

Where{$_.fullFormattedMessage -match "reload"} |

ForEach-Object -Process {

    $_.Info.EntityName

}

[mattj2020]

I'm very familiar with that issue, but yes and yes. The issue doesn't appear to be entirely related to that problem though, as we also have some vms that are not seeing the reload issue in conjunction with snaps or nfs. The vms themselves don't seem to have an issue, with the stun duration lasting only a few ms, but we do see the event in the logs and in the case of a virtual ASA, the firewall fails over to the partner node.

The last command works great! THANK YOU!

I continue to learn powershell and frequently use many of your replies to others.