Is there a powershell script which shows VM which have been created/deployed in virtual centre in the past 6 months. We want a list of VM's as there should be an approval procedure but I think many admins have deployed VM's without permission.
Can we get a report on the VM's created/deployed and the date they were deployed in the last 12 months, if not then the last 6 months.
It will of course depend on how long you keep the events in your vCenter database.
Have a look at Script to find when and who created a VM
You will have to adjust the $start variable.
$start = (Get-Date).AddMonths(-12)
Blog: lucd.info Twitter: @LucD22 Co-author PowerCLI Reference
Hi Lucd,
Thanks for the reply.
I ran the below script :
# How many days in the past to start from
$start = (Get-Date).AddDays(-10)
# The more days back, the higher this number should be.
t$eventNr = 9999
$report = @()
Get-VIEvent -Start $start -MaxSamples $eventNr | `Where-Object {$_.GetType().Name -eq "VmCreatedEvent"} | % { $row = "" | Select Date, Msg, User, Cluster, Host
$row.Date = $_.createdTime
$row.Msg = $_.fullFormattedMessage
$row.User = $_.userName
$row.Cluster = (Get-View $_.computeResource.computeResource).Name
$row.Host = (Get-View $_.Host.Hostt).Name
$report += $row}
$report
BUt when it runs , i get no error message nor any output. Is there something i am missing.
Were there any VMs created during the last 10 days ?
If new VMs are cloned or deployed from a template, you will have to filter on other eventtypes (VMClonedEvent,VMDeployedEvent,VMRegisteredEvent...)
See if this list of events has any other types that would indicate VM creations.
Warning, this might take a long time to run !
$start = (Get-Date).AddMonths(-12) $eventNr = [int]::MaxValue
Get-VIEvent -Start $start -MaxSamples $eventNr | Group-Object -Property {$_.GetType().Name}
The following version will look back 12 months and check for some other events as well.
Do you get any output ?
# How many days in the past to start from
$start = (Get-Date).AddMonths(-12) $events = "VmCreatedEvent","VMClonedEvent","VMDeployedEVent"
$eventNr = [int]::MaxValue
$report = @() Get-VIEvent -Start $start -MaxSamples $eventNr | Where-Object {$events -contains $_.GetType().Name} | % { $row = "" | Select Date, Msg, User, Cluster, VMHost $row.Date = $_.createdTime $row.Msg = $_.fullFormattedMessage $row.User = $_.userName $row.Cluster = (Get-View $_.computeResource.computeResource).Name $row.VMHost = (Get-View $_.Host.Host).Name $report += $row
} $report
Blog: lucd.info Twitter: @LucD22 Co-author PowerCLI Reference
Hi LucD,
Thanks for this script. I have a quick question, is it possible to get the lun or datastore which the VM resided on .
Thanks
Yes and no
Let me expand, in another event type ("VmBeingCreatedEvent") you have access to part of the ConfigSpec.
In there you can find ("Files.VmPathName") the full path of the VMX file.
There are 2 problems here:
Blog: lucd.info Twitter: @LucD22 Co-author PowerCLI Reference
Hi Lucd,
Thanks for the prompt response. I am happy with the path name.
I can map the names. I tried to include ds in the select statement but all the response comeback blank.
Can you please show me what I am missing.
Regards,
Did you capture the VmBeingCreatedEvent instead of the VmCreatedEvent ?
Blog: lucd.info Twitter: @LucD22 Co-author PowerCLI Reference
Hello,
So sorry. Should have mentioned, I am looking for deleted VMs. I am using vmremovedevent.
Sorry about that.
Regards,
I see, that means you need to capture the VmRemovedEvent.
But I'm afraid that there is no indication of the datastore in the event.
Blog: lucd.info Twitter: @LucD22 Co-author PowerCLI Reference
Thanks for your help and much appreciated