Contributor
Contributor

Get a list of vm names experiencing an event

Jump to solution

I'm trying to get a list of vms from the prior day (or any time period) where a specific event has occurred. I'm very much a novice at Powershell.

This is the event filter and I'll post a result:

Get-VIEvent -start 06/24/2020 | ?{$_.fullFormattedMessage -match "reload"}

Info                 : VMware.Vim.TaskInfo

Key                  : 6776769

ChainId              : 6776769

CreatedTime          : 6/26/2020 1:00:22 AM

UserName             : com.springpath.sysmgmt.domain-c67

Datacenter           : VMware.Vim.DatacenterEventArgument

ComputeResource      : VMware.Vim.ComputeResourceEventArgument

Host                 : VMware.Vim.HostEventArgument

Vm                   : VMware.Vim.VmEventArgument

Ds                   :

Net                  :

Dvs                  :

FullFormattedMessage : Task: Reload virtual machine

ChangeTag            :

As shown, the VM property doesn't contain useful information, so I thought I'd try to use the Key or ChainId to retrieve information, but querying these returns nothing.

get-vievent | ?{$_.key -eq 6776769}

Tags (1)
0 Kudos
1 Solution

Accepted Solutions
Leadership
Leadership

In any case, then, if you only want the VM names, try something like this

Get-VIEvent -Entity den* -Start 06/29/2020 -MaxSamples ([int]::MaxValue) |

Where{$_.fullFormattedMessage -match "reload"} |

ForEach-Object -Process {

    $_.Info.EntityName

}


Blog: lucd.info  Twitter: @LucD22  Co-author PowerCLI Reference

View solution in original post

0 Kudos
17 Replies
Leadership
Leadership

Have you looked inside the Info property?

Get-VIEvent -start 06/24/2020 | ?{$_.fullFormattedMessage -match "reload"} |

Select -ExpandProperty Info

As an alternative, try

Get-VIEvent -start 06/24/2020 | Where{$_ -is [VMware.Vim.VmReloadFromPathEvent]}


Blog: lucd.info  Twitter: @LucD22  Co-author PowerCLI Reference

0 Kudos
Contributor
Contributor

Both options produced no output at all.

0 Kudos
Contributor
Contributor

I added -entity to my command and now get extra info. i'm unsure of how to "get" the vm name?

Get-VIEvent -entity den* -start 06/24/2020 | ?{$_.fullFormattedMessage -match "reload"} | select -expandproperty info

Key           : task-45390

Task          : Task-task-45390

Description   :

Name          : Reload

DescriptionId : VirtualMachine.reload

Entity        : VirtualMachine-vm-788

EntityName    : denxxxxxxxx

Locked        :

State         : queued

Cancelled     : False

Cancelable    : True

Error         :

Result        :

Progress      :

Reason        : VMware.Vim.TaskReasonUser

QueueTime     : 6/24/2020 6:00:16 AM

StartTime     :

CompleteTime  :

EventChainId  : 0

ChangeTag     :

ParentTaskKey :

RootTaskKey   :

ActivationId  :

LinkedView    :

0 Kudos
Leadership
Leadership

Isn't the EntityName showing the VM's name?

Btw, you will have to use the MaxSamples parameter, by default only 100 events are returned.

Get-VIEvent -start 06/24/2020 -MaxSamples ([int]::MaxValue) |

Where{$_ -is [VMware.Vim.VmReloadFromPathEvent]}


Blog: lucd.info  Twitter: @LucD22  Co-author PowerCLI Reference

0 Kudos
Contributor
Contributor

It is, though I'm trying to return just a list of vms. Since I already have  a select, I'm unsure of how to get just a list of names.

0 Kudos
Leadership
Leadership

You mean lie this?

Get-VIEvent -start 06/24/2020 -MaxSamples ([int]::MaxValue) |

Where{$_ -is [VMware.Vim.VmReloadFromPathEvent]} | %{

    $_.VM.Name

}


Blog: lucd.info  Twitter: @LucD22  Co-author PowerCLI Reference

0 Kudos
Contributor
Contributor

This didn't return anything, so I went back a few posts....

This returns many records:

Get-VIEvent -entity den* -start 06/24/2020 | ?{$_.fullFormattedMessage -match "reload"} | select -expandproperty info

Running any of the others didn't return anything:

Get-VIEvent -start 06/24/2020 -MaxSamples ([int]::MaxValue) |

Where{$_ -is [VMware.Vim.VmReloadFromPathEvent]} | %{

    $_.VM.Name

}

I also tried just in case:

Get-VIEvent -entity den* -start 06/24/2020 -MaxSamples ([int]::MaxValue) | Where{$_ -is [VMware.Vim.VmReloadFromPathEvent]} | %{ $_.VM.Name}

0 Kudos
Leadership
Leadership

Are you sure there were reloads done that day?


Blog: lucd.info  Twitter: @LucD22  Co-author PowerCLI Reference

0 Kudos
Leadership
Leadership

A handy way to get an overview of the events that are present for a specific time range, is the following

Get-VIEvent -start 06/24/2020 -MaxSamples ([int]::MaxValue) |

Group-Object -Property {$_.GetType().Name}


Blog: lucd.info  Twitter: @LucD22  Co-author PowerCLI Reference

0 Kudos
Contributor
Contributor

Yes. Modifying this to show only today:

Get-VIEvent -entity den* -start 06/29/2020 | ?{$_.fullFormattedMessage -match "reload"} | select -expandproperty info

I get more than 40 results.

Trying any of these returns nothing:

Get-VIEvent -start 06/29/2020 -MaxSamples ([int]::MaxValue) | Where{$_ -is [VMware.Vim.VmReloadFromPathEvent]} | %{ $_.VM.Name}

0 Kudos
Leadership
Leadership

Perhaps that is the wrong type of event.

Can you check which ones we should be looking at?

Get-VIEvent -entity den* -start 06/29/2020 -MaxSamples ([int]::MaxValue) |

Where{$_.fullFormattedMessage -match "reload"} |

ForEach-Object -Process {

    $_.GetType().Name

}


Blog: lucd.info  Twitter: @LucD22  Co-author PowerCLI Reference

0 Kudos
Contributor
Contributor

When running this I get many results, one of which is below. Get-VIEvent -entity den* -start 06/29/2020 | ?{$_.fullFormattedMessage -match "reload"} | select -expandproperty info

Key           : task-47732

Task          : Task-task-47732

Description   :

Name          : Reload

DescriptionId : VirtualMachine.reload

Entity        : VirtualMachine-vm-795

EntityName    : denxxxxxxxxx

Locked        :

State         : queued

Cancelled     : False

Cancelable    : True

Error         :

Result        :

Progress      :

Reason        : VMware.Vim.TaskReasonUser

QueueTime     : 6/29/2020 6:00:29 AM

StartTime     :

CompleteTime  :

EventChainId  : 0

ChangeTag     :

ParentTaskKey :

RootTaskKey   :

ActivationId  :

LinkedView    :

Running the last command:

Get-VIEvent -entity den* -start 06/29/2020 -MaxSamples ([int]::MaxValue) | Where{$_.fullFormattedMessage -match "reload"} | ForEach-Object -Process {$_.GetType().Name}

TaskEvent

TaskEvent

TaskEvent......... and it repeated until I broke the command.

0 Kudos
Leadership
Leadership

Ok, so it is a TaskEvent.

How are you actually doing these 'reloads' of the VMs?


Blog: lucd.info  Twitter: @LucD22  Co-author PowerCLI Reference

0 Kudos
Contributor
Contributor

That's a great question! "We" aren't..... and that is part of why I'm trying to determine which vms are having this event. It appears to be occurring in most cases in conjunction with a snapshot, but not in all cases.

0 Kudos
Leadership
Leadership

Are the VMs involved by any chance sittings on an NFS datastore?

And is Changed Block Tracking enabled for the backup tool?

There were issues in the past where there were long locks on the .ctk file.
In the Tasks you could see: create snapshot - reload VM - remove snapshot.

The VM appeared frozen for the duration of the 'reload VM' task.

But this quite some time ago and for an old version of ESX.


Blog: lucd.info  Twitter: @LucD22  Co-author PowerCLI Reference

0 Kudos
Leadership
Leadership

In any case, then, if you only want the VM names, try something like this

Get-VIEvent -Entity den* -Start 06/29/2020 -MaxSamples ([int]::MaxValue) |

Where{$_.fullFormattedMessage -match "reload"} |

ForEach-Object -Process {

    $_.Info.EntityName

}


Blog: lucd.info  Twitter: @LucD22  Co-author PowerCLI Reference

View solution in original post

0 Kudos
Contributor
Contributor

I'm very familiar with that issue, but yes and yes. The issue doesn't appear to be entirely related to that problem though, as we also have some vms that are not seeing the reload issue in conjunction with snaps or nfs. The vms themselves don't seem to have an issue, with the stun duration lasting only a few ms, but we do see the event in the logs and in the case of a virtual ASA, the firewall fails over to the partner node.

The last command works great! THANK YOU!

I continue to learn powershell and frequently use many of your replies to others.

0 Kudos