VMware Cloud Community
Guv
Enthusiast
Enthusiast

Report of list of VM's created in the last year.

Is there a powershell script which shows VM which have been created/deployed in virtual centre in the past 6 months.  We want a list of VM's as there should be an approval procedure but I think many admins have deployed VM's without permission.

Can we get a report on the VM's created/deployed and the date they were deployed in the last 12 months, if not then the last 6 months.

0 Kudos
10 Replies
LucD
Leadership
Leadership

It will of course depend on how long you keep the events in your vCenter database.

Have a look at Script to find when and who created a VM

You will have to adjust the $start variable.

$start = (Get-Date).AddMonths(-12)


Blog: lucd.info  Twitter: @LucD22  Co-author PowerCLI Reference

0 Kudos
Guv
Enthusiast
Enthusiast

Hi Lucd,

Thanks for the reply.

I ran the below script :

# How many days in the past to start from

$start = (Get-Date).AddDays(-10)

# The more days back, the higher this number should be.

t$eventNr = 9999

$report = @()

Get-VIEvent -Start $start -MaxSamples $eventNr | `Where-Object {$_.GetType().Name -eq "VmCreatedEvent"} | % {     $row = "" | Select Date, Msg, User, Cluster, Host  

$row.Date = $_.createdTime   

$row.Msg = $_.fullFormattedMessage   

$row.User = $_.userName   

$row.Cluster = (Get-View $_.computeResource.computeResource).Name   

$row.Host = (Get-View $_.Host.Hostt).Name   

$report += $row}

$report

BUt when it runs , i get no error message nor any output.   Is there something i am missing.

0 Kudos
LucD
Leadership
Leadership

Were there any VMs created during the last 10 days ?

If new VMs are cloned or deployed from a template, you will have to filter on other eventtypes (VMClonedEvent,VMDeployedEvent,VMRegisteredEvent...)

See if this list of events has any other types that would indicate VM creations.

Warning, this might take a long time to run !

$start = (Get-Date).AddMonths(-12)
$eventNr = [int]::MaxValue 
Get-VIEvent
-Start $start -MaxSamples $eventNr | Group-Object -Property {$_.GetType().Name}

The following version will look back 12 months and check for some other events as well.

Do you get any output ?

# How many days in the past to start from 
$start
= (Get-Date).AddMonths(-12) $events = "VmCreatedEvent","VMClonedEvent","VMDeployedEVent"
$eventNr
= [int]::MaxValue

$report = @() Get-VIEvent -Start $start -MaxSamples $eventNr |     Where-Object {$events -contains $_.GetType().Name} | % {     $row = "" | Select Date, Msg, User, Cluster, VMHost      $row.Date = $_.createdTime       $row.Msg = $_.fullFormattedMessage       $row.User = $_.userName       $row.Cluster = (Get-View $_.computeResource.computeResource).Name       $row.VMHost = (Get-View $_.Host.Host).Name       $report += $row
} $report


Blog: lucd.info  Twitter: @LucD22  Co-author PowerCLI Reference

0 Kudos
BPCUE1
Contributor
Contributor

Hi LucD,

Thanks for this script. I have a quick question, is it possible to get the lun or datastore which the VM resided on .

Thanks

0 Kudos
LucD
Leadership
Leadership

Yes and no Smiley Wink

Let me expand, in another event type ("VmBeingCreatedEvent") you have access to part of the ConfigSpec.

In there you can find ("Files.VmPathName") the full path of the VMX file.

There are 2 problems here:

  1. The path is an URL path ("ds:///vmfs/volumes/498c2c1b-c38301e4-dabc-0015174b788c/TestVM/TestVM.vmx"). Not too obvious, but possible, to find the datastore name
  2. If that datastore doesn't exist anymore, you're stuck with the URL name, which most of the time is less meaningfull to an administrator compared to the datastore name


Blog: lucd.info  Twitter: @LucD22  Co-author PowerCLI Reference

0 Kudos
BPCUE1
Contributor
Contributor

Hi Lucd,

Thanks for the prompt response. I am happy with the path name.

I can map the names. I tried to include ds in the select statement but all the response comeback blank.

Can you please show me what I am missing.

Regards, 

0 Kudos
LucD
Leadership
Leadership

Did you capture the VmBeingCreatedEvent instead of the VmCreatedEvent ?


Blog: lucd.info  Twitter: @LucD22  Co-author PowerCLI Reference

0 Kudos
BPCUE1
Contributor
Contributor

Hello,

So sorry. Should have mentioned, I am looking for deleted VMs. I am using vmremovedevent.

Sorry about that.

Regards,

0 Kudos
LucD
Leadership
Leadership

I see, that means you need to capture the VmRemovedEvent.

But I'm afraid that there is no indication of the datastore in the event.


Blog: lucd.info  Twitter: @LucD22  Co-author PowerCLI Reference

0 Kudos
BPCUE1
Contributor
Contributor

Thanks for your help and much appreciated

0 Kudos