Hi All,
I would like to capture below information from active triggered vcenter alarms via powercli
Target:
Previous Status:
New Status:
Alarm Definition:
Current values for metric/state:
Description:
Event details:
Vcenter Name
below what i have, need expert assistance on this.
foreach($dc in (Get-Datacenter | where {$_.ExtensionData.triggeredAlarmState})){
` $dc.ExtensionData.TriggeredAlarmState |
Select @{N='vCenter';E={$vcenter = $dc.Uid.Split('@:')[1]; $vcenter}},
@{N="Entity";E={Get-View $_.Entity -Server $vcenter | Select -ExpandProperty Name}},
@{N="Alarm";E={Get-View $_.Alarm -Server $vcenter | Select -ExpandProperty Info | Select -ExpandProperty Name}},
Time,OverallStatus |
Where-object{$_.Alarm -notmatch 'Virtual machine cpu usage' -and
$_.Alarm -notmatch 'Host IPMI System Event Log status*'}
}
Example out put as below
Target: zak99.southzone.sa
Previous Status: Green
New Status: Red
Alarm Definition:
([Red state Is equal to notResponding] AND [Red state Not equal to standBy])
Current values for metric/state:
State = Not responding AND State = Unknown
Description:
Alarm 'Host connection and power state' on zak99.southzone.sa changed from Green to Red
Target: zak99.southzone.sa
Previous Status: Green
New Status: Red
Alarm Definition:
([Event alarm expression: Lost Network Redundancy; Status = Red] OR [Event alarm expression: Restored uplink redundancy to portgroups; Status = Green] OR [Event alarm expression: Lost Network Redundancy on DVPorts; Status = Red] OR [Event alarm expression: Restored Network Redundancy to DVPorts; Status = Green])
Event details:
Lost uplink redundancy on virtual switch "vSwitch0". Physical NIC vmnic4 is down. Affected portgroups:"Vmotion", "Mgmt".
The current Get-VIEvent cmdlet can not retrieve datastore related events.
As an alternative try using my Get-VIEventPlus function from Get The VMotion/SvMotion History
That seems to work for me, also for Datastore alarms.
<#
.SYNOPSIS Returns vSphere events
.DESCRIPTION The function will return vSphere events. With
the available parameters, the execution time can be
improved, compered to the original Get-VIEvent cmdlet.
.NOTES Author: Luc Dekens
.PARAMETER Entity
When specified the function returns events for the
specific vSphere entity. By default events for all
vSphere entities are returned.
.PARAMETER EventType
This parameter limits the returned events to those
specified on this parameter.
.PARAMETER Start
The start date of the events to retrieve
.PARAMETER Finish
The end date of the events to retrieve.
.PARAMETER Recurse
A switch indicating if the events for the children of
the Entity will also be returned
.PARAMETER User
The list of usernames for which events will be returned
.PARAMETER System
A switch that allows the selection of all system events.
.PARAMETER ScheduledTask
The name of a scheduled task for which the events
will be returned
.PARAMETER FullMessage
A switch indicating if the full message shall be compiled.
This switch can improve the execution speed if the full
message is not needed.
.EXAMPLE
PS> Get-VIEventPlus -Entity $vm
.EXAMPLE
PS> Get-VIEventPlus -Entity $cluster -Recurse:$true
#>
param(
[VMware.VimAutomation.ViCore.Impl.V1.Inventory.InventoryItemImpl[]]$Entity,
[string[]]$EventType,
[DateTime]$Start,
[DateTime]$Finish = (Get-Date),
[switch]$Recurse,
[string[]]$User,
[Switch]$System,
[string]$ScheduledTask,
[switch]$FullMessage = $false
)
process {
$eventnumber = 100
$events = @()
$eventMgr = Get-View EventManager
$eventFilter = New-Object VMware.Vim.EventFilterSpec
$eventFilter.disableFullMessage = ! $FullMessage
$eventFilter.entity = New-Object VMware.Vim.EventFilterSpecByEntity
$eventFilter.entity.recursion = & { if ($Recurse) { "all" }else { "self" } }
$eventFilter.eventTypeId = $EventType
if ($Start -or $Finish) {
$eventFilter.time = New-Object VMware.Vim.EventFilterSpecByTime
if ($Start) {
$eventFilter.time.beginTime = $Start
}
if ($Finish) {
$eventFilter.time.endTime = $Finish
}
}
if ($User -or $System) {
$eventFilter.UserName = New-Object VMware.Vim.EventFilterSpecByUsername
if ($User) {
$eventFilter.UserName.userList = $User
}
if ($System) {
$eventFilter.UserName.systemUser = $System
}
}
if ($ScheduledTask) {
$si = Get-View ServiceInstance
$schTskMgr = Get-View $si.Content.ScheduledTaskManager
$eventFilter.ScheduledTask = Get-View $schTskMgr.ScheduledTask |
where { $_.Info.Name -match $ScheduledTask } |
select -First 1 |
select -ExpandProperty MoRef
}
if (!$Entity) {
$Entity = @(Get-Folder -Name Datacenters)
}
$entity | ForEach-Object {
$eventFilter.entity.entity = $_.ExtensionData.MoRef
$eventCollector = Get-View ($eventMgr.CreateCollectorForEvents($eventFilter))
$eventsBuffer = $eventCollector.ReadNextEvents($eventnumber)
while ($eventsBuffer) {
$events += $eventsBuffer
$eventsBuffer = $eventCollector.ReadNextEvents($eventnumber)
}
$eventCollector.DestroyCollector()
}
$events
}
}
foreach ($dc in (Get-Datacenter | where { $_.ExtensionData.triggeredAlarmState })) {
foreach ($alarmState in $dc.ExtensionData.TriggeredAlarmState) {
$entity = Get-View $alarmState.Entity -Server $vcenter | Get-VIObjectByVIView
$alarm = Get-View $alarmState.Alarm -Server $vcenter
$event = Get-VIEventPlus -Entity $entity -EventType AlarmStatusChangedEvent -Start $alarmState.Time -Finish $alarmState.Time.AddSeconds(1)
$alarmState | select @{N = 'vCenter'; E = { $vcenter = $dc.Uid.Split('@:')[1]; $vcenter } },
@{N = "Entity"; E = { $entity.Name } },
@{N = "Alarm"; E = { $alarm.Info.Name } },
@{N = 'Description'; E = { $alarm.Info.Description } },
@{N = 'Previous State'; E = { $event.From } },
@{N = 'New State'; E = { $event.To } },
@{N = 'Message'; E = { $event.FullFormattedMessage } },
Time, OverallStatus
}
}
Blog: lucd.info Twitter: @LucD22 Co-author PowerCLI Reference
What assistance do you need?
Are you seeing errors?
Is your script not returning what you want?
Blog: lucd.info Twitter: @LucD22 Co-author PowerCLI Reference
I am not able to fetch the details what i want.
below is the code i am using
foreach($dc in (Get-Datacenter | where {$_.ExtensionData.triggeredAlarmState})){
` $dc.ExtensionData.TriggeredAlarmState |
Select @{N='vCenter';E={$vcenter = $dc.Uid.Split('@:')[1]; $vcenter}},
@{N="Entity";E={Get-View $_.Entity -Server $vcenter | Select -ExpandProperty Name}},
@{N="Alarm";E={Get-View $_.Alarm -Server $vcenter | Select -ExpandProperty Info | Select -ExpandProperty Name}},
Time,OverallStatus |
Where-object{$_.Alarm -notmatch 'Virtual machine cpu usage' -and
$_.Alarm -notmatch 'Host IPMI System Event Log status*'}
}
Below is the Result i am getting
vCenter : zakvcszone.southzone.sa
Entity : zak_LUN01
Alarm : Datastore usage on disk
Time : 4/16/2020 8:04:49 AM
OverallStatus : yellow
I am looking to fetch the details with below values too.
Previous Status:
New Status:
Alarm Definition:
Current values for metric/state:
Description:
Event details:
when a vcenter alert trigger i am getting the below information as email, in fact would like to fetch the same detail via powercli
Target: zak99.southzone.sa
Previous Status: Green
New Status: Red
Alarm Definition:
([Event alarm expression: Lost Network Redundancy; Status = Red] OR [Event alarm expression: Restored uplink redundancy to portgroups; Status = Green] OR [Event alarm expression: Lost Network Redundancy on DVPorts; Status = Red] OR [Event alarm expression: Restored Network Redundancy to DVPorts; Status = Green])
Event details:
Lost uplink redundancy on virtual switch "vSwitch0". Physical NIC vmnic4 is down. Affected portgroups:"Vmotion", "Mgmt".
Something like this?
foreach ($alarmState in $dc.ExtensionData.TriggeredAlarmState) {
$esx = Get-View $alarmState.Entity -Server $vcenter | Get-VIObjectByVIView
$alarm = Get-View $alarmState.Alarm -Server $vcenter
$event = Get-VIEvent -Entity $esx -Start $alarmState.Time -Finish ($alarmState.Time).AddSeconds(2) |
where { $_ -is [VMware.Vim.AlarmStatusChangedEvent] }
$alarmState | select @{N = 'vCenter'; E = { $vcenter = $dc.Uid.Split('@:')[1]; $vcenter } },
@{N = "Entity"; E = { $esx.Name } },
@{N = "Alarm"; E = { $alarm.Info.Name } },
@{N = 'Description'; E = { $alarm.Info.Description } },
@{N = 'Previous State'; E = { $event.From } },
@{N = 'New State'; E = { $event.To } },
@{N = 'Message'; E = { $event.FullFormattedMessage } },
Time, OverallStatus
}
}
Blog: lucd.info Twitter: @LucD22 Co-author PowerCLI Reference
Few values are empty and below are the errors too.
Get-VIEvent Events can be retrieved only for inventory objects. The entity of type
'VMware.VimAutomation.ViCore.Impl.V1.DatastoreManagement.VmfsDatastoreImpl' will be ignored.
At line:8 char:18
+ ... $event = Get-VIEvent -Entity $esx -Start $alarmState.Time -Finish ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidArgument: (:) [Get-VIEvent], InvalidArgument
+ FullyQualifiedErrorId : Core_GetEvent_DoWork_InvalidEntityType,VMware.VimAutomation.ViCore.Cmdlets.Commands.GetEvent
vCenter : zakvcszone.southzone.sa
Entity : zak_LUN01
Alarm : Datastore usage on disk
Description : Default alarm to monitor datastore disk usage
Previous State :
New State :
Message :
Time : 4/16/2020 9:06:44 AM
OverallStatus : yellow
The current Get-VIEvent cmdlet can not retrieve datastore related events.
As an alternative try using my Get-VIEventPlus function from Get The VMotion/SvMotion History
That seems to work for me, also for Datastore alarms.
<#
.SYNOPSIS Returns vSphere events
.DESCRIPTION The function will return vSphere events. With
the available parameters, the execution time can be
improved, compered to the original Get-VIEvent cmdlet.
.NOTES Author: Luc Dekens
.PARAMETER Entity
When specified the function returns events for the
specific vSphere entity. By default events for all
vSphere entities are returned.
.PARAMETER EventType
This parameter limits the returned events to those
specified on this parameter.
.PARAMETER Start
The start date of the events to retrieve
.PARAMETER Finish
The end date of the events to retrieve.
.PARAMETER Recurse
A switch indicating if the events for the children of
the Entity will also be returned
.PARAMETER User
The list of usernames for which events will be returned
.PARAMETER System
A switch that allows the selection of all system events.
.PARAMETER ScheduledTask
The name of a scheduled task for which the events
will be returned
.PARAMETER FullMessage
A switch indicating if the full message shall be compiled.
This switch can improve the execution speed if the full
message is not needed.
.EXAMPLE
PS> Get-VIEventPlus -Entity $vm
.EXAMPLE
PS> Get-VIEventPlus -Entity $cluster -Recurse:$true
#>
param(
[VMware.VimAutomation.ViCore.Impl.V1.Inventory.InventoryItemImpl[]]$Entity,
[string[]]$EventType,
[DateTime]$Start,
[DateTime]$Finish = (Get-Date),
[switch]$Recurse,
[string[]]$User,
[Switch]$System,
[string]$ScheduledTask,
[switch]$FullMessage = $false
)
process {
$eventnumber = 100
$events = @()
$eventMgr = Get-View EventManager
$eventFilter = New-Object VMware.Vim.EventFilterSpec
$eventFilter.disableFullMessage = ! $FullMessage
$eventFilter.entity = New-Object VMware.Vim.EventFilterSpecByEntity
$eventFilter.entity.recursion = & { if ($Recurse) { "all" }else { "self" } }
$eventFilter.eventTypeId = $EventType
if ($Start -or $Finish) {
$eventFilter.time = New-Object VMware.Vim.EventFilterSpecByTime
if ($Start) {
$eventFilter.time.beginTime = $Start
}
if ($Finish) {
$eventFilter.time.endTime = $Finish
}
}
if ($User -or $System) {
$eventFilter.UserName = New-Object VMware.Vim.EventFilterSpecByUsername
if ($User) {
$eventFilter.UserName.userList = $User
}
if ($System) {
$eventFilter.UserName.systemUser = $System
}
}
if ($ScheduledTask) {
$si = Get-View ServiceInstance
$schTskMgr = Get-View $si.Content.ScheduledTaskManager
$eventFilter.ScheduledTask = Get-View $schTskMgr.ScheduledTask |
where { $_.Info.Name -match $ScheduledTask } |
select -First 1 |
select -ExpandProperty MoRef
}
if (!$Entity) {
$Entity = @(Get-Folder -Name Datacenters)
}
$entity | ForEach-Object {
$eventFilter.entity.entity = $_.ExtensionData.MoRef
$eventCollector = Get-View ($eventMgr.CreateCollectorForEvents($eventFilter))
$eventsBuffer = $eventCollector.ReadNextEvents($eventnumber)
while ($eventsBuffer) {
$events += $eventsBuffer
$eventsBuffer = $eventCollector.ReadNextEvents($eventnumber)
}
$eventCollector.DestroyCollector()
}
$events
}
}
foreach ($dc in (Get-Datacenter | where { $_.ExtensionData.triggeredAlarmState })) {
foreach ($alarmState in $dc.ExtensionData.TriggeredAlarmState) {
$entity = Get-View $alarmState.Entity -Server $vcenter | Get-VIObjectByVIView
$alarm = Get-View $alarmState.Alarm -Server $vcenter
$event = Get-VIEventPlus -Entity $entity -EventType AlarmStatusChangedEvent -Start $alarmState.Time -Finish $alarmState.Time.AddSeconds(1)
$alarmState | select @{N = 'vCenter'; E = { $vcenter = $dc.Uid.Split('@:')[1]; $vcenter } },
@{N = "Entity"; E = { $entity.Name } },
@{N = "Alarm"; E = { $alarm.Info.Name } },
@{N = 'Description'; E = { $alarm.Info.Description } },
@{N = 'Previous State'; E = { $event.From } },
@{N = 'New State'; E = { $event.To } },
@{N = 'Message'; E = { $event.FullFormattedMessage } },
Time, OverallStatus
}
}
Blog: lucd.info Twitter: @LucD22 Co-author PowerCLI Reference
I am able to fetch the details now, seems we missed to add few values such as Alarm Definition,Current values for metric/state:Event details:(please find the below in red as example)
How to exclude vm alerts, and need to fetch the alerts only past 1hour
Example
Alarm Definition:
([Yellow metric Is above 90%; Red metric Is above 95%])
Current values for metric/state:
Metric Memory Host consumed % = 90%
Alarm Definition:
([Event alarm expression: Lost Network Redundancy; Status = Red] OR [Event alarm expression: Restored uplink redundancy to portgroups; Status = Green] OR [Event alarm expression: Lost Network Redundancy on DVPorts; Status = Red] OR [Event alarm expression: Restored Network Redundancy to DVPorts; Status = Green])
Event details:
Lost uplink redundancy on virtual switch "vSwitch0". Physical NIC vmnic4 is down. Affected portgroups:"Vmotion", "Mgmt".
Below are the details i am able to fetch now
vCenter : zakvcszone.southzone.sa
Entity : zakesxiprod01.southzone.sa
Alarm : Host CPU usage
Description : Default alarm to monitor host CPU usage
Previous State : green
New State : yellow
Message : Alarm 'Host CPU usage' on zakesxiprod01.southzone.sa changed from Green to Yellow
Time : 4/21/2020 10:02:33 AM
OverallStatus : yellow
Setting a time range can be done through a Where-clause.
For example
foreach($dc in (Get-Datacenter | where {$_.ExtensionData.triggeredAlarmState})){
foreach($alarmState in ($dc.ExtensionData.TriggeredAlarmState | where{$_.Time.ToLocalTime() -ge $startFrom})){
How do you want to exclude Alarms?
Based on the Alarm name, on the Entity, on the trigger type ...?
The Alarm definition can be obtained by the Get-AlarmDefinition and the trigger details with the Get-AlarmTrigger cmdlets.
The current value for a metric can be obtained by the Get-Stat cmdlet.
Btw, this is far beyond a question for a problem you encounter.
This is a full script project and this is not an "Order your script" service I'm afraid.
To better understand the workings of this forum have a read of Chip's document How To Ask For Help On Tech Forums
Blog: lucd.info Twitter: @LucD22 Co-author PowerCLI Reference
would like to exclude the virtual machine alerts with alarm name Like
$_.Alarm -notmatch 'Virtual machine cpu usage
Thanks for your valuable time and help Lucd
To skip specific alarms, you could do
$excludeAlarm = 'Test Alarm'
foreach ($dc in (Get-Datacenter | where { $_.ExtensionData.triggeredAlarmState })) {
foreach ($alarmState in ($dc.ExtensionData.TriggeredAlarmState | where { $_.Time.ToLocalTime() -ge $startFrom })) {
$alarm = Get-View $alarmState.Alarm -Server $vcenter
if ($alarm.Info.Name -ne $excludeAlarm) {
$entity = Get-View $alarmState.Entity -Server $vcenter | Get-VIObjectByVIView
$event = Get-VIEventPlus -Entity $entity -EventType AlarmStatusChangedEvent -Start $alarmState.Time -Finish $alarmState.Time.AddSeconds(1)
$alarmState | select @{N = 'vCenter'; E = { $vcenter = $dc.Uid.Split('@:')[1]; $vcenter } },
@{N = "Entity"; E = { $entity.Name } },
@{N = "Alarm"; E = { $alarm.Info.Name } },
@{N = 'Description'; E = { $alarm.Info.Description } },
@{N = 'Previous State'; E = { $event.From } },
@{N = 'New State'; E = { $event.To } },
@{N = 'Message'; E = { $event.FullFormattedMessage } },
@{N = 'Local Time'; E = { $_.Time.ToLocalTime() } },
OverallStatus
}
}
}
Blog: lucd.info Twitter: @LucD22 Co-author PowerCLI Reference