I'm trying to get a list of vms from the prior day (or any time period) where a specific event has occurred. I'm very much a novice at Powershell.
This is the event filter and I'll post a result:
Get-VIEvent -start 06/24/2020 | ?{$_.fullFormattedMessage -match "reload"}
Info : VMware.Vim.TaskInfo
Key : 6776769
ChainId : 6776769
CreatedTime : 6/26/2020 1:00:22 AM
UserName : com.springpath.sysmgmt.domain-c67
Datacenter : VMware.Vim.DatacenterEventArgument
ComputeResource : VMware.Vim.ComputeResourceEventArgument
Host : VMware.Vim.HostEventArgument
Vm : VMware.Vim.VmEventArgument
Ds :
Net :
Dvs :
FullFormattedMessage : Task: Reload virtual machine
ChangeTag :
As shown, the VM property doesn't contain useful information, so I thought I'd try to use the Key or ChainId to retrieve information, but querying these returns nothing.
get-vievent | ?{$_.key -eq 6776769}
In any case, then, if you only want the VM names, try something like this
Where{$_.fullFormattedMessage -match "reload"} |
ForEach-Object -Process {
$_.Info.EntityName
}
Blog: lucd.info Twitter: @LucD22 Co-author PowerCLI Reference
Have you looked inside the Info property?
Select -ExpandProperty Info
As an alternative, try
Get-VIEvent -start 06/24/2020 | Where{$_ -is [VMware.Vim.VmReloadFromPathEvent]}
Blog: lucd.info Twitter: @LucD22 Co-author PowerCLI Reference
Both options produced no output at all.
I added -entity to my command and now get extra info. i'm unsure of how to "get" the vm name?
Get-VIEvent -entity den* -start 06/24/2020 | ?{$_.fullFormattedMessage -match "reload"} | select -expandproperty info
Key : task-45390
Task : Task-task-45390
Description :
Name : Reload
DescriptionId : VirtualMachine.reload
Entity : VirtualMachine-vm-788
EntityName : denxxxxxxxx
Locked :
State : queued
Cancelled : False
Cancelable : True
Error :
Result :
Progress :
Reason : VMware.Vim.TaskReasonUser
QueueTime : 6/24/2020 6:00:16 AM
StartTime :
CompleteTime :
EventChainId : 0
ChangeTag :
ParentTaskKey :
RootTaskKey :
ActivationId :
LinkedView :
Isn't the EntityName showing the VM's name?
Btw, you will have to use the MaxSamples parameter, by default only 100 events are returned.
Where{$_ -is [VMware.Vim.VmReloadFromPathEvent]}
Blog: lucd.info Twitter: @LucD22 Co-author PowerCLI Reference
It is, though I'm trying to return just a list of vms. Since I already have a select, I'm unsure of how to get just a list of names.
You mean lie this?
Where{$_ -is [VMware.Vim.VmReloadFromPathEvent]} | %{
$_.VM.Name
}
Blog: lucd.info Twitter: @LucD22 Co-author PowerCLI Reference
This didn't return anything, so I went back a few posts....
This returns many records:
Get-VIEvent -entity den* -start 06/24/2020 | ?{$_.fullFormattedMessage -match "reload"} | select -expandproperty info
Running any of the others didn't return anything:
Get-VIEvent -start 06/24/2020 -MaxSamples ([int]::MaxValue) |
Where{$_ -is [VMware.Vim.VmReloadFromPathEvent]} | %{
$_.VM.Name
}
I also tried just in case:
Get-VIEvent -entity den* -start 06/24/2020 -MaxSamples ([int]::MaxValue) | Where{$_ -is [VMware.Vim.VmReloadFromPathEvent]} | %{ $_.VM.Name}
Are you sure there were reloads done that day?
Blog: lucd.info Twitter: @LucD22 Co-author PowerCLI Reference
A handy way to get an overview of the events that are present for a specific time range, is the following
Group-Object -Property {$_.GetType().Name}
Blog: lucd.info Twitter: @LucD22 Co-author PowerCLI Reference
Yes. Modifying this to show only today:
Get-VIEvent -entity den* -start 06/29/2020 | ?{$_.fullFormattedMessage -match "reload"} | select -expandproperty info
I get more than 40 results.
Trying any of these returns nothing:
Get-VIEvent -start 06/29/2020 -MaxSamples ([int]::MaxValue) | Where{$_ -is [VMware.Vim.VmReloadFromPathEvent]} | %{ $_.VM.Name}
Perhaps that is the wrong type of event.
Can you check which ones we should be looking at?
Where{$_.fullFormattedMessage -match "reload"} |
ForEach-Object -Process {
$_.GetType().Name
}
Blog: lucd.info Twitter: @LucD22 Co-author PowerCLI Reference
When running this I get many results, one of which is below. Get-VIEvent -entity den* -start 06/29/2020 | ?{$_.fullFormattedMessage -match "reload"} | select -expandproperty info
Key : task-47732
Task : Task-task-47732
Description :
Name : Reload
DescriptionId : VirtualMachine.reload
Entity : VirtualMachine-vm-795
EntityName : denxxxxxxxxx
Locked :
State : queued
Cancelled : False
Cancelable : True
Error :
Result :
Progress :
Reason : VMware.Vim.TaskReasonUser
QueueTime : 6/29/2020 6:00:29 AM
StartTime :
CompleteTime :
EventChainId : 0
ChangeTag :
ParentTaskKey :
RootTaskKey :
ActivationId :
LinkedView :
Running the last command:
Get-VIEvent -entity den* -start 06/29/2020 -MaxSamples ([int]::MaxValue) | Where{$_.fullFormattedMessage -match "reload"} | ForEach-Object -Process {$_.GetType().Name}
TaskEvent
TaskEvent
TaskEvent......... and it repeated until I broke the command.
Ok, so it is a TaskEvent.
How are you actually doing these 'reloads' of the VMs?
Blog: lucd.info Twitter: @LucD22 Co-author PowerCLI Reference
That's a great question! "We" aren't..... and that is part of why I'm trying to determine which vms are having this event. It appears to be occurring in most cases in conjunction with a snapshot, but not in all cases.
Are the VMs involved by any chance sittings on an NFS datastore?
And is Changed Block Tracking enabled for the backup tool?
There were issues in the past where there were long locks on the .ctk file.
In the Tasks you could see: create snapshot - reload VM - remove snapshot.
The VM appeared frozen for the duration of the 'reload VM' task.
But this quite some time ago and for an old version of ESX.
Blog: lucd.info Twitter: @LucD22 Co-author PowerCLI Reference
In any case, then, if you only want the VM names, try something like this
Where{$_.fullFormattedMessage -match "reload"} |
ForEach-Object -Process {
$_.Info.EntityName
}
Blog: lucd.info Twitter: @LucD22 Co-author PowerCLI Reference
I'm very familiar with that issue, but yes and yes. The issue doesn't appear to be entirely related to that problem though, as we also have some vms that are not seeing the reload issue in conjunction with snaps or nfs. The vms themselves don't seem to have an issue, with the stun duration lasting only a few ms, but we do see the event in the logs and in the case of a virtual ASA, the firewall fails over to the partner node.
The last command works great! THANK YOU!
I continue to learn powershell and frequently use many of your replies to others.