Need some assistance in formatting a one line PowerCLI command to track snapshots

[JJarvis1]

hello,

I am using Vshpere 5.1 and i need help with using PowerCLI to output some information in order to audit some VM backups.

My end goal is to be able to audit what machines are being backed up.  Our Backup tool uses VMware snapshots to run incremental backups so if we can track what VM's have had snapshots taken/ removed then we can better audit the backups.

With my inexperience with PowerCLI i decided it would be best for me to try out a few smaller commands to see if i could get some decent results.

The Line of code i am starting with is     Get-VM * | Get-VIEvent -MaxSamples 20 | Where-Object {$_.FullFormattedMessage -eq "Task: Remove snapshot"}  

For the most part that script does work however the output is interesting to me.

Info                 : VMware.Vim.TaskInfo

Key                  : 5360442

ChainId              : 5360442

CreatedTime          : 6/20/2014 10:32:31 PM

UserName             : JJarvis

Datacenter           : VMware.Vim.DatacenterEventArgument

ComputeResource      : VMware.Vim.ComputeResourceEventArgument

Host                 : VMware.Vim.HostEventArgument

Vm                   : VMware.Vim.VmEventArgument

Ds                   :

Net                  :

Dvs                  :

FullFormattedMessage : Task: Remove snapshot

ChangeTag            :

DynamicType          :

DynamicProperty      :

Frankly i was excited that i was able to output anything at all however I am confused as to why under "VM :  "  it says "Vm    : VMware.Vim.VmEventArgument"  instead of the actual VM name.

If i can get this to output the actual name of the Virtual Machine then i can start playing around with formatting and exporting got CSV files.  Any assistance you can offer would be great appreciated.

thank you,

[snoopj]

If you dig into that VMEventArgument object, there's a Name property that you can use to display the name of the VM in question.  You can also get the Managed Object Reference to it as well.

Here's an example output of a similar request in my test lab:

PowerCLI C:\> $stuff[0]

Info                 : VMware.Vim.TaskInfo

Key                  : 25191955

ChainId              : 25191955

CreatedTime          : 6/25/2014 4:36:51 PM

UserName             : <Removed>

Datacenter           : VMware.Vim.DatacenterEventArgument

ComputeResource      : VMware.Vim.ComputeResourceEventArgument

Host                 : VMware.Vim.HostEventArgument

Vm                   : VMware.Vim.VmEventArgument

Ds                   :

Net                  :

Dvs                  :

FullFormattedMessage : Task: Remove snapshot

ChangeTag            :

DynamicType          :

DynamicProperty      :

PowerCLI C:\> $stuff[0].Vm

Vm              : VirtualMachine-vm-75153

LinkedView      :

Name            : 0000091-137094

DynamicType     :

DynamicProperty :

You can easily pull the value out.  In this case, calling  $stuff[0].Vm.Name would bring back that string with the VM's name.

[JJarvis1]

Thank you for your reply.  So i think i am following what your are saying, the data string I am looking for is contained inside of the VMware.Vim.VmEventArgument object.

So with with my limited knowledge it seems like i need to output the results of       Get-VM * | Get-VIEvent -MaxSamples 20 | Where-Object {$_.FullFormattedMessage -eq "Task: Remove snapshot"}   into a array called stuff[0]?  I apologize if I am missing something that is both obvious / rudimentary  my Google-Fu seems to be lacking today.

[snoopj]

My $stuff variable is just something I created to store the contents of the Get-VM one liner you had.  Since it's an array, I just pulled the first value, hence the [0] to look at the contents and dig through to find that VMware.Vim.VmEventArgument object.

You are correct in that the data string you are looking for is in the object.  I'm not the best at one-liners, so I'm sure there's someone who could help in crafting exactly what is needed, but the good news is there's not much that needs to be done to pull the VM name.

I'm not a Powershell guru by any shape of the imagination, so my explanation may end up causing more confusion than help sometimes. 

[LucD · Accepted solution]

I suspect a calculated property might be the way to go.

Something like this

Get-VM * | Get-VIEvent -MaxSamples 20 | Where-Object {$_.FullFormattedMessage -eq "Task: Remove snapshot"}  |

Select @{N="VM Name";E={$_.Vm.Name}}

You can of course display other properties from the returned events on the same Select-Object cmdlet.

[JJarvis1]

Thank you so much.  "Get-VM * | Get-VIEvent | Where-Object {$_.FullFormattedMessage -eq "Task: Remove snapshot"}  | Select @{N="VM Name";E={$_.Vm.Name}}"    did exactly what i needed it too.  Now that i have this foundation i can continue to build off it.

Thank you again!

[snoopj]

Told you someone would be able to come along and put it together into a one-liner.  One of these days I'll start working on my one-liner abilities. 

[JJarvis1]

For any interested i was actually able to use "snoopj"  advice.  For some reason when i would store the information my one line liner in either $stuff or $stuff[0]  and then try to call it with $stuff.Vm or $stuff[0].Vm  i would receive no output, but it i only called $stuff  or $stuff[#] (depending on array location) then it would output all the data that was stored in the original one liner.  After Much googling i found the | -ExpandedProperty  cmdlet and that yielded the results that "snoopj"  achieved.

$stuff = Get-VM * | Get-VIEvent -MaxSamples 20 | Where-Object {$_.FullFormattedMessage -eq "Task: Remove snapshot"}

$stuff | Select -ExpandProperty Vm

If anyone has any idea as to why the early notation of $stuff.VM did not work i would appreciate it.

[LucD]

In the Event objects, the VM property holds a complex object itself.

The default output routine doesn't know how to handle this.

With the ExpandProperty switch on the Select-Object cmdlet, you ask the cmdlet to try and expand that specific property.

In this case it will expand the object behind the VM property in such a way that it will display all the properties of that object.

[JJarvis1]

Thank you for that explanation it was Extremely helpful and made perfect sense.