VMware Cloud Community
Bgaru
Contributor
Contributor
Jump to solution

Powercli get event details from vcenter

Hi All,

I would like to capture below information from active triggered vcenter alarms via powercli

Target:

Previous Status:

New Status:

Alarm Definition:

Current values for metric/state: 

Description:

Event details:

Vcenter Name

below what i have, need expert assistance on this.

foreach($dc in (Get-Datacenter | where {$_.ExtensionData.triggeredAlarmState})){

`   $dc.ExtensionData.TriggeredAlarmState |

    Select @{N='vCenter';E={$vcenter = $dc.Uid.Split('@:')[1]; $vcenter}},

     @{N="Entity";E={Get-View $_.Entity -Server $vcenter | Select -ExpandProperty Name}},

     @{N="Alarm";E={Get-View $_.Alarm -Server $vcenter  | Select -ExpandProperty Info | Select -ExpandProperty Name}},

           Time,OverallStatus |

    Where-object{$_.Alarm -notmatch 'Virtual machine cpu usage' -and

                 $_.Alarm -notmatch 'Host IPMI System Event Log status*'}

}

Example out put as below

Target: zak99.southzone.sa

Previous Status: Green

New Status: Red

Alarm Definition:

([Red state Is equal to notResponding] AND [Red state Not equal to standBy])

Current values for metric/state:

State = Not responding AND State = Unknown

Description:

Alarm 'Host connection and power state' on zak99.southzone.sa changed from Green to Red

Target: zak99.southzone.sa

Previous Status: Green

New Status: Red

Alarm Definition:

([Event alarm expression: Lost Network Redundancy; Status = Red] OR [Event alarm expression: Restored uplink redundancy to portgroups; Status = Green] OR [Event alarm expression: Lost Network Redundancy on DVPorts; Status = Red] OR [Event alarm expression: Restored Network Redundancy to DVPorts; Status = Green])

Event details:

Lost uplink redundancy on virtual switch "vSwitch0". Physical NIC vmnic4 is down. Affected portgroups:"Vmotion", "Mgmt".

1 Solution

Accepted Solutions
LucD
Leadership
Leadership
Jump to solution

The current Get-VIEvent cmdlet can not retrieve datastore related events.

As an alternative try using my Get-VIEventPlus function from Get The VMotion/SvMotion History

That seems to work for me, also for Datastore alarms.

function Get-VIEventPlus {

    <#  

    .SYNOPSIS  Returns vSphere events   

    .DESCRIPTION The function will return vSphere events. With

    the available parameters, the execution time can be

    improved, compered to the original Get-VIEvent cmdlet.

    .NOTES  Author:  Luc Dekens  

    .PARAMETER Entity

    When specified the function returns events for the

    specific vSphere entity. By default events for all

    vSphere entities are returned.

    .PARAMETER EventType

    This parameter limits the returned events to those

    specified on this parameter.

    .PARAMETER Start

    The start date of the events to retrieve

    .PARAMETER Finish

    The end date of the events to retrieve.

    .PARAMETER Recurse

    A switch indicating if the events for the children of

    the Entity will also be returned

    .PARAMETER User

    The list of usernames for which events will be returned

    .PARAMETER System

    A switch that allows the selection of all system events.

    .PARAMETER ScheduledTask

    The name of a scheduled task for which the events

    will be returned

    .PARAMETER FullMessage

    A switch indicating if the full message shall be compiled.

    This switch can improve the execution speed if the full

    message is not needed.  

    .EXAMPLE

    PS> Get-VIEventPlus -Entity $vm

    .EXAMPLE

    PS> Get-VIEventPlus -Entity $cluster -Recurse:$true

    #>

    param(

        [VMware.VimAutomation.ViCore.Impl.V1.Inventory.InventoryItemImpl[]]$Entity,

        [string[]]$EventType,

        [DateTime]$Start,

        [DateTime]$Finish = (Get-Date),

        [switch]$Recurse,

        [string[]]$User,

        [Switch]$System,

        [string]$ScheduledTask,

        [switch]$FullMessage = $false

    )

    process {

        $eventnumber = 100

        $events = @()

        $eventMgr = Get-View EventManager

        $eventFilter = New-Object VMware.Vim.EventFilterSpec

        $eventFilter.disableFullMessage = ! $FullMessage

        $eventFilter.entity = New-Object VMware.Vim.EventFilterSpecByEntity

        $eventFilter.entity.recursion = & { if ($Recurse) { "all" }else { "self" } }

        $eventFilter.eventTypeId = $EventType

        if ($Start -or $Finish) {

            $eventFilter.time = New-Object VMware.Vim.EventFilterSpecByTime

            if ($Start) {

                $eventFilter.time.beginTime = $Start

            }

            if ($Finish) {

                $eventFilter.time.endTime = $Finish

            }

        }

        if ($User -or $System) {

            $eventFilter.UserName = New-Object VMware.Vim.EventFilterSpecByUsername

            if ($User) {

                $eventFilter.UserName.userList = $User

            }

            if ($System) {

                $eventFilter.UserName.systemUser = $System

            }

        }

        if ($ScheduledTask) {

            $si = Get-View ServiceInstance

            $schTskMgr = Get-View $si.Content.ScheduledTaskManager

            $eventFilter.ScheduledTask = Get-View $schTskMgr.ScheduledTask |

            where { $_.Info.Name -match $ScheduledTask } |

            select -First 1 |

            select -ExpandProperty MoRef

        }

        if (!$Entity) {

            $Entity = @(Get-Folder -Name Datacenters)

        }

        $entity | ForEach-Object {

            $eventFilter.entity.entity = $_.ExtensionData.MoRef

            $eventCollector = Get-View ($eventMgr.CreateCollectorForEvents($eventFilter))

            $eventsBuffer = $eventCollector.ReadNextEvents($eventnumber)

            while ($eventsBuffer) {

                $events += $eventsBuffer

                $eventsBuffer = $eventCollector.ReadNextEvents($eventnumber)

            }

            $eventCollector.DestroyCollector()

        }

        $events

    }

}

  

  

foreach ($dc in (Get-Datacenter | where { $_.ExtensionData.triggeredAlarmState })) {

    foreach ($alarmState in $dc.ExtensionData.TriggeredAlarmState) {

        $entity = Get-View $alarmState.Entity -Server $vcenter | Get-VIObjectByVIView

        $alarm = Get-View $alarmState.Alarm -Server $vcenter

        $event = Get-VIEventPlus -Entity $entity -EventType AlarmStatusChangedEvent -Start $alarmState.Time -Finish $alarmState.Time.AddSeconds(1)

        $alarmState | select @{N = 'vCenter'; E = { $vcenter = $dc.Uid.Split('@:')[1]; $vcenter } },

        @{N = "Entity"; E = { $entity.Name } },

        @{N = "Alarm"; E = { $alarm.Info.Name } },

        @{N = 'Description'; E = { $alarm.Info.Description } },

        @{N = 'Previous State'; E = { $event.From } },

        @{N = 'New State'; E = { $event.To } },

        @{N = 'Message'; E = { $event.FullFormattedMessage } },

        Time, OverallStatus

    }

}

  


Blog: lucd.info  Twitter: @LucD22  Co-author PowerCLI Reference

View solution in original post

Reply
0 Kudos
11 Replies
LucD
Leadership
Leadership
Jump to solution

What assistance do you need?

Are you seeing errors?

Is your script not returning what you want?


Blog: lucd.info  Twitter: @LucD22  Co-author PowerCLI Reference

Reply
0 Kudos
Bgaru
Contributor
Contributor
Jump to solution

I am not able to fetch the details what i want.

below is the code i am using

foreach($dc in (Get-Datacenter | where {$_.ExtensionData.triggeredAlarmState})){

`   $dc.ExtensionData.TriggeredAlarmState |

    Select @{N='vCenter';E={$vcenter = $dc.Uid.Split('@:')[1]; $vcenter}},

     @{N="Entity";E={Get-View $_.Entity -Server $vcenter | Select -ExpandProperty Name}},

     @{N="Alarm";E={Get-View $_.Alarm -Server $vcenter  | Select -ExpandProperty Info | Select -ExpandProperty Name}},

           Time,OverallStatus |

    Where-object{$_.Alarm -notmatch 'Virtual machine cpu usage' -and

                 $_.Alarm -notmatch 'Host IPMI System Event Log status*'}

}

Below is the Result i am getting

vCenter       : zakvcszone.southzone.sa

Entity        : zak_LUN01

Alarm         : Datastore usage on disk

Time          : 4/16/2020 8:04:49 AM

OverallStatus : yellow

I am looking to fetch the details with below values too.


Previous Status:

New Status:

Alarm Definition:

Current values for metric/state:

Description:

Event details:

Reply
0 Kudos
Bgaru
Contributor
Contributor
Jump to solution

when a vcenter alert trigger i am getting the below information as email, in fact would like to fetch the same detail via powercli

Target: zak99.southzone.sa

Previous Status: Green

New Status: Red

Alarm Definition:

([Event alarm expression: Lost Network Redundancy; Status = Red] OR [Event alarm expression: Restored uplink redundancy to portgroups; Status = Green] OR [Event alarm expression: Lost Network Redundancy on DVPorts; Status = Red] OR [Event alarm expression: Restored Network Redundancy to DVPorts; Status = Green])

Event details:

Lost uplink redundancy on virtual switch "vSwitch0". Physical NIC vmnic4 is down. Affected portgroups:"Vmotion", "Mgmt".

Reply
0 Kudos
LucD
Leadership
Leadership
Jump to solution

Something like this?

foreach ($dc in (Get-Datacenter | where { $_.ExtensionData.triggeredAlarmState })) {

    foreach ($alarmState in $dc.ExtensionData.TriggeredAlarmState) {

        $esx = Get-View $alarmState.Entity -Server $vcenter | Get-VIObjectByVIView

        $alarm = Get-View $alarmState.Alarm -Server $vcenter

        $event = Get-VIEvent -Entity $esx -Start $alarmState.Time -Finish ($alarmState.Time).AddSeconds(2) |

        where { $_ -is [VMware.Vim.AlarmStatusChangedEvent] }

        $alarmState | select @{N = 'vCenter'; E = { $vcenter = $dc.Uid.Split('@:')[1]; $vcenter } },

        @{N = "Entity"; E = { $esx.Name } },

        @{N = "Alarm"; E = { $alarm.Info.Name } },

        @{N = 'Description'; E = { $alarm.Info.Description } },

        @{N = 'Previous State'; E = { $event.From } },

        @{N = 'New State'; E = { $event.To } },

        @{N = 'Message'; E = { $event.FullFormattedMessage } },

        Time, OverallStatus

    }

}


Blog: lucd.info  Twitter: @LucD22  Co-author PowerCLI Reference

Bgaru
Contributor
Contributor
Jump to solution

Few values are empty and below are the errors too.

Get-VIEvent Events can be retrieved only for inventory objects. The entity of type

'VMware.VimAutomation.ViCore.Impl.V1.DatastoreManagement.VmfsDatastoreImpl' will be ignored.

At line:8 char:18

+ ...    $event = Get-VIEvent -Entity $esx -Start $alarmState.Time -Finish  ...

+                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    + CategoryInfo          : InvalidArgument: (:) [Get-VIEvent], InvalidArgument

    + FullyQualifiedErrorId : Core_GetEvent_DoWork_InvalidEntityType,VMware.VimAutomation.ViCore.Cmdlets.Commands.GetEvent

vCenter        : zakvcszone.southzone.sa

Entity         : zak_LUN01

Alarm          : Datastore usage on disk

Description    : Default alarm to monitor datastore disk usage

Previous State :

New State      :

Message        :

Time           : 4/16/2020 9:06:44 AM

OverallStatus  : yellow

Reply
0 Kudos
LucD
Leadership
Leadership
Jump to solution

The current Get-VIEvent cmdlet can not retrieve datastore related events.

As an alternative try using my Get-VIEventPlus function from Get The VMotion/SvMotion History

That seems to work for me, also for Datastore alarms.

function Get-VIEventPlus {

    <#  

    .SYNOPSIS  Returns vSphere events   

    .DESCRIPTION The function will return vSphere events. With

    the available parameters, the execution time can be

    improved, compered to the original Get-VIEvent cmdlet.

    .NOTES  Author:  Luc Dekens  

    .PARAMETER Entity

    When specified the function returns events for the

    specific vSphere entity. By default events for all

    vSphere entities are returned.

    .PARAMETER EventType

    This parameter limits the returned events to those

    specified on this parameter.

    .PARAMETER Start

    The start date of the events to retrieve

    .PARAMETER Finish

    The end date of the events to retrieve.

    .PARAMETER Recurse

    A switch indicating if the events for the children of

    the Entity will also be returned

    .PARAMETER User

    The list of usernames for which events will be returned

    .PARAMETER System

    A switch that allows the selection of all system events.

    .PARAMETER ScheduledTask

    The name of a scheduled task for which the events

    will be returned

    .PARAMETER FullMessage

    A switch indicating if the full message shall be compiled.

    This switch can improve the execution speed if the full

    message is not needed.  

    .EXAMPLE

    PS> Get-VIEventPlus -Entity $vm

    .EXAMPLE

    PS> Get-VIEventPlus -Entity $cluster -Recurse:$true

    #>

    param(

        [VMware.VimAutomation.ViCore.Impl.V1.Inventory.InventoryItemImpl[]]$Entity,

        [string[]]$EventType,

        [DateTime]$Start,

        [DateTime]$Finish = (Get-Date),

        [switch]$Recurse,

        [string[]]$User,

        [Switch]$System,

        [string]$ScheduledTask,

        [switch]$FullMessage = $false

    )

    process {

        $eventnumber = 100

        $events = @()

        $eventMgr = Get-View EventManager

        $eventFilter = New-Object VMware.Vim.EventFilterSpec

        $eventFilter.disableFullMessage = ! $FullMessage

        $eventFilter.entity = New-Object VMware.Vim.EventFilterSpecByEntity

        $eventFilter.entity.recursion = & { if ($Recurse) { "all" }else { "self" } }

        $eventFilter.eventTypeId = $EventType

        if ($Start -or $Finish) {

            $eventFilter.time = New-Object VMware.Vim.EventFilterSpecByTime

            if ($Start) {

                $eventFilter.time.beginTime = $Start

            }

            if ($Finish) {

                $eventFilter.time.endTime = $Finish

            }

        }

        if ($User -or $System) {

            $eventFilter.UserName = New-Object VMware.Vim.EventFilterSpecByUsername

            if ($User) {

                $eventFilter.UserName.userList = $User

            }

            if ($System) {

                $eventFilter.UserName.systemUser = $System

            }

        }

        if ($ScheduledTask) {

            $si = Get-View ServiceInstance

            $schTskMgr = Get-View $si.Content.ScheduledTaskManager

            $eventFilter.ScheduledTask = Get-View $schTskMgr.ScheduledTask |

            where { $_.Info.Name -match $ScheduledTask } |

            select -First 1 |

            select -ExpandProperty MoRef

        }

        if (!$Entity) {

            $Entity = @(Get-Folder -Name Datacenters)

        }

        $entity | ForEach-Object {

            $eventFilter.entity.entity = $_.ExtensionData.MoRef

            $eventCollector = Get-View ($eventMgr.CreateCollectorForEvents($eventFilter))

            $eventsBuffer = $eventCollector.ReadNextEvents($eventnumber)

            while ($eventsBuffer) {

                $events += $eventsBuffer

                $eventsBuffer = $eventCollector.ReadNextEvents($eventnumber)

            }

            $eventCollector.DestroyCollector()

        }

        $events

    }

}

  

  

foreach ($dc in (Get-Datacenter | where { $_.ExtensionData.triggeredAlarmState })) {

    foreach ($alarmState in $dc.ExtensionData.TriggeredAlarmState) {

        $entity = Get-View $alarmState.Entity -Server $vcenter | Get-VIObjectByVIView

        $alarm = Get-View $alarmState.Alarm -Server $vcenter

        $event = Get-VIEventPlus -Entity $entity -EventType AlarmStatusChangedEvent -Start $alarmState.Time -Finish $alarmState.Time.AddSeconds(1)

        $alarmState | select @{N = 'vCenter'; E = { $vcenter = $dc.Uid.Split('@:')[1]; $vcenter } },

        @{N = "Entity"; E = { $entity.Name } },

        @{N = "Alarm"; E = { $alarm.Info.Name } },

        @{N = 'Description'; E = { $alarm.Info.Description } },

        @{N = 'Previous State'; E = { $event.From } },

        @{N = 'New State'; E = { $event.To } },

        @{N = 'Message'; E = { $event.FullFormattedMessage } },

        Time, OverallStatus

    }

}

  


Blog: lucd.info  Twitter: @LucD22  Co-author PowerCLI Reference

Reply
0 Kudos
Bgaru
Contributor
Contributor
Jump to solution

I am able to fetch the details now, seems we missed to add few values such as Alarm Definition,Current values for metric/state:Event details:(please find the below in red as example)

How to exclude vm alerts, and need to fetch the alerts only past 1hour

Example

Alarm Definition:

([Yellow metric Is above 90%; Red metric Is above 95%])

Current values for metric/state:

Metric Memory Host consumed % = 90%

Alarm Definition:

([Event alarm expression: Lost Network Redundancy; Status = Red] OR [Event alarm expression: Restored uplink redundancy to portgroups; Status = Green] OR [Event alarm expression: Lost Network Redundancy on DVPorts; Status = Red] OR [Event alarm expression: Restored Network Redundancy to DVPorts; Status = Green])

Event details:

Lost uplink redundancy on virtual switch "vSwitch0". Physical NIC vmnic4 is down. Affected portgroups:"Vmotion", "Mgmt".

Below are the details i am able to fetch now

vCenter        : zakvcszone.southzone.sa

Entity         : zakesxiprod01.southzone.sa

Alarm          : Host CPU usage

Description    : Default alarm to monitor host CPU usage

Previous State : green

New State      : yellow

Message        : Alarm 'Host CPU usage' on zakesxiprod01.southzone.sa changed from Green to Yellow

Time           : 4/21/2020 10:02:33 AM

OverallStatus  : yellow

Reply
0 Kudos
LucD
Leadership
Leadership
Jump to solution

Setting a time range can be done through a Where-clause.
For example

$startFrom = (Get-Date).AddHours(-1)

foreach($dc in (Get-Datacenter | where {$_.ExtensionData.triggeredAlarmState})){

   foreach($alarmState in ($dc.ExtensionData.TriggeredAlarmState | where{$_.Time.ToLocalTime() -ge $startFrom})){


How do you want to exclude Alarms?

Based on the Alarm name, on the Entity, on the trigger type ...?


The Alarm definition can be obtained by the Get-AlarmDefinition and the trigger details with the Get-AlarmTrigger cmdlets.

The current value for a metric can be obtained by the Get-Stat cmdlet.

Btw, this is far beyond a question for a problem you encounter.
This is a full script project and this is not an "Order your script" service I'm afraid.

To better understand the workings of this forum have a read of Chip's document How To Ask For Help On Tech Forums


Blog: lucd.info  Twitter: @LucD22  Co-author PowerCLI Reference

Bgaru
Contributor
Contributor
Jump to solution

would like to exclude the virtual machine alerts with alarm name Like 

$_.Alarm -notmatch 'Virtual machine cpu usage

Reply
0 Kudos
Bgaru
Contributor
Contributor
Jump to solution

Thanks for your valuable time and help Lucd Smiley Happy

Reply
0 Kudos
LucD
Leadership
Leadership
Jump to solution

To skip specific alarms, you could do

$startFrom = (Get-Date).AddHours(-1)

$excludeAlarm = 'Test Alarm'

 

foreach ($dc in (Get-Datacenter | where { $_.ExtensionData.triggeredAlarmState })) {

    foreach ($alarmState in ($dc.ExtensionData.TriggeredAlarmState | where { $_.Time.ToLocalTime() -ge $startFrom })) {

        $alarm = Get-View $alarmState.Alarm -Server $vcenter

        if ($alarm.Info.Name -ne $excludeAlarm) {

            $entity = Get-View $alarmState.Entity -Server $vcenter | Get-VIObjectByVIView

            $event = Get-VIEventPlus -Entity $entity -EventType AlarmStatusChangedEvent -Start $alarmState.Time -Finish $alarmState.Time.AddSeconds(1)

            $alarmState | select @{N = 'vCenter'; E = { $vcenter = $dc.Uid.Split('@:')[1]; $vcenter } },

            @{N = "Entity"; E = { $entity.Name } },

            @{N = "Alarm"; E = { $alarm.Info.Name } },

            @{N = 'Description'; E = { $alarm.Info.Description } },

            @{N = 'Previous State'; E = { $event.From } },

            @{N = 'New State'; E = { $event.To } },

            @{N = 'Message'; E = { $event.FullFormattedMessage } },

            @{N = 'Local Time'; E = { $_.Time.ToLocalTime() } },

            OverallStatus

        }

    }

}


Blog: lucd.info  Twitter: @LucD22  Co-author PowerCLI Reference