Get snapshot deleted date/time

[esxadmin76]

I've browsed the forum and have gotten some great scripts to get vm information on snapshots created/reverted but I would also

like to know how I can see the Snapshots that have been deleted in the past x amount of days.

I see vim.vm.Snapshot.remove in the logs and thought something like the following would work:

Get-VIEvent -MaxSamples ([int]::MaxValue) -Start $start |
  where {($_ -is "VMware.Vim.EventEx" -and "vim.vm.Snapshot.remove" -eq $_.Info.DescriptionId)} |
Select CreatedTime,UserName,@{N="VM";E={$_.Vm.Name}},FullFormattedMessage

But it returns nothing. Any assistance would be greatly appreciated.

Thanks

[LucD · Accepted solution]

You were nearly there, but you should look for a TaskEvent and the DescriptionId is slightly different.

Get-VIEvent -MaxSamples ([int]::MaxValue) -Start $start |
where {($_ -is "VMware.Vim.TaskEvent" -and "vm.Snapshot.remove" -eq $_.Info.DescriptionId)} |
Select CreatedTime,UserName,@{N="VM";E={$_.Vm.Name}},FullFormattedMessage

[esxadmin76]

I did try it with "VMware.Vim.TaskEvent" but my DescriptionId was off.

Is there a place to find all of the info on getting DescriptionId's and what events can be searched for?

Thanks!

[LucD]

Have a look at The Making of section in my HA VM failover tracking post.

It shows how to find the available events.

[vmCalgary]

@LucD 

Is this still valid syntax for reporting on deleted snapshots? I'd like to add who deleted the snapshot and what was the snapshot size.

[LucD]

It should be, and the Username is in there.