Last entry in VMKernel log

[Pilu1978]

Hi,

Recently we have come across issue where we found that there are no new messages being logged in the vmkernel log on a VxRail host. Now Dell has advised us to scan all the vxrail hosts in the environment to find date and time of the last entry in the vmkernel log. 

I know we can use the Get-Log cmdlet to get the vmkernel log entries however I am struggling to fetch the date and time of the last entry/message in the vmkernel.log.

Please help. 

[LucD]

Do you have SSH access to the ESXi nodes?

[Pilu1978]

Yes but there is a challenge as each host has different password.

[LucD]

Is there any way you can provide a list with hostnames and credentials?
Otherwise, it will have to be via Get-Log,  which will take quite a bit longer

[Pilu1978]

Yes it is possible to provide a list with hostnames and credentials however I would request if you can show me both SSH and Get-Log.

[LucD · Accepted solution]

This is the Get-Log based one

Get-VMHost -PipelineVariable esx |
ForEach-Object -Process {
    Get-Log -Key vmkernel -VMHost $esx |
    Select @{N='VMHost';E={$_.Host.Name}},
        @{N='LastLine';E={$_.Entries[$_.LastLineNum - 1]}}
}

[Pilu1978]

Thanks LucD. Much appreciated. It is working like a charm. 

[Pilu1978]

Hi, 

I need further help on this so posting my query here.

I am trying to fetch Date and time from this last entry of host vmkrnel log like below but I am getting the exception mentioned below. Please let me know how can I convert it to Date and Time format so that I can find out the time difference with the current date and time.

$lastLine = Get-Log -Key vmkernel -VMHost $esx | Select @{N='VMHost';E={$_.Host.Name}},@{N='LastLine';E={$_.Entries[$_.LastLineNum - 1]}}

$lastDateTime = $lastLine.LastLine.Split("Z ")[0].ToDateTime($_)

Exception calling "ToDateTime" with "1" argument(s): "String was not recognized as a valid DateTime."
At D:\PNF-Morning-Checks\VSAN-MorningCheck-Daily.ps1:761 char:6
+ ... $lastTime = $lastLine.LastLine.Split("Z ")[0].ToDateTime( ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [], MethodInvocationException
+ FullyQualifiedErrorId : FormatException

[LucD]

Not sure what you have in $lastLine.LastLine, but assuming it is the last line fo the vmkernel log, can you try casting with DateTime?
You do not have to drop the 'Z' at the end, rather split on the blank.

$lastDateTime = [DateTime]($lastLine.LastLine.Split(' ')[0])

[Pilu1978]

Thanks Lucd for your reply.

$lastLine.LastLine is giving the last entry of the vmkernel log like below:

2023-05-15T04:47:37.814Z cpu40:16672)WARNING: LinScsi: SCSILinuxAbortCommands:1816:Failed, Driver hpsa, for vmhba0

I have tried as you advised but getting the following error:

Cannot convert value "" to type "System.DateTime". Error: "String was not recognized as a valid DateTime."
At D:\PNF-Morning-Checks\VSAN-MorningCheck-Daily.ps1:761 char:6
+ ... $lastDateTime = [DateTime]($lastLine.LastLine.Split(' ')[ ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidArgument: (:) [], RuntimeException
+ FullyQualifiedErrorId : InvalidCastParseTargetInvocationWithFormatProvider 

[LucD]

Seems to work for me

Do you have a String in $lastLine.LastLine or output from a Select-Object cmdlet?

[Pilu1978]

It is the output of the following command

$lastLine = Get-Log -Key vmkernel -VMHost $esx | Select @{N='VMHost';E={$_.Host.Name}},@{N='LastLine';E={$_.Entries[$_.LastLineNum - 1]}}

[LucD · Accepted solution]

That is exactly what I just did, and it works for me.

It could be that your station has regional settings that are not en-US.
And unfortunately, the DateTime casting uses the en-US setting by default.
What does the following return?

Get-Culture

If that is not en-US, you can force the DateTime conversion to use en-US (as the VMKernel log uses)

$c = [cultureInfo]::GetCultureInfo('en-US')
$lastLine.LastLine.Split(' ')[0].ToDateTime($c) 

[Pilu1978]

Hi LucD,

You are just awesome.

Yes the server is using the regional setting as en-GB.