Reporting on the date a virtual machine was created

[TheVMinator]

Is it possible to report on the date that a virtual machine was created?  Is this info stored anywhere with the virtual machine?  If not, can it be obtained from the logs within VMware Server to report on say how many virtual machines were created in the last year?

Thanks

[RvdNieuwendijk]

The date a virtual machine was created is stored in the VMware logs. The get the date a virtual machine was created you can do:

Get-VM YourVM | `
Get-VIEvent -MaxSamples 100000 | `
Where-Object {$_.GetType().Name -eq "VmCreatedEvent" -or 
  $_.GetType().Name -eq "VmBeingClonedEvent" -or 
  $_.GetType().Name -eq "VmBeingDeployedEvent"} | `
Select-Object CreatedTime

To get the number of virtual machines created in the last year you can do:

Get-VIEvent -maxsamples 100000 -Start (Get-Date).AddDays(-14) | `
Where-Object {$_.Gettype().Name-eq "VmCreatedEvent" -or 
  $_.Gettype().Name-eq "VmBeingClonedEvent" -or 
  $_.Gettype().Name-eq "VmBeingDeployedEvent"} | `
Measure-Object | Select-Object Count

Regards, Robert

[TheVMinator]

OK thanks.  When I get the information on when a virtual machine was created - am I getting that from the virtual machine's files - or is that information only being pulled from inside vCenter Server's log files?

Thanks

[RvdNieuwendijk]

The Get-VIEvent cmdlet doesn't use the virtual machine's files but uses the vCenter Server's logfiles or vCenter Server database.

[TheVMinator]

This code seems to work very well - thanks.   Although it only goes back as far as vCenter Server has been keeping logs.  Which in this case is less than a year.  So it doesn't look like it will be possible to get this info.  Unless you have another idea?  Thanks.

[avlieshout · Accepted solution]

The Get-VIEvent cmdlet gets its information from the vCenter database. To be precise from the VPX_EVENT table. You can only go back in time as far as the first record in this table. To retrieve this date, you can use the following code:

$eventMgr = Get-View EventManager
$filter = New-Object VMware.Vim.EventFilterSpec
$eventCollector = Get-View ($eventMgr.CreateCollectorForEvents($filter))
$eventCollector.RewindCollector | Out-Null 
$eventCollection = $eventCollector.ReadNextEvents(1)
$eventCollection[0].createdTime
$eventCollector.DestroyCollector() 

The drawback to using the Get-VIEvent cmdlet is that you must specify how many records must be returned (100 by default) with the -MaxSamples parameter, and that all these records are fetched from the database. If you have to search for events and don't have a time frame, you need to provide enough samples to include yours and this could take forever. The events table can get quite large. In my environment there are 8million+ records in this table.

For searching the events database I prefer using the SDK instead of the Get-VIEvent cmdlet. This way I can start searching until my records are found, and I can use specific filters to fetch only records that are of interest. I also have to fetch only as many records from the database as necessary. You can search for the created time of a VM using the code below:

$vm = Get-VM "myVM"

$eventNumber = 100
$eventMgr = Get-View EventManager

$filter = New-Object VMware.Vim.EventFilterSpec
$filter.Entity = New-Object VMware.Vim.EventFilterSpecByEntity
$filter.Entity.Entity = $vm.ExtensionData.MoRef
$filter.EventTypeId = "vim.event.VmCreatedEvent","vim.event.VmClonedEvent","vim.event.VmDeployedEvent"

$eventCollector = Get-View ($eventMgr.CreateCollectorForEvents($filter))
$eventCollector.RewindCollector | Out-Null 
$eventCollection = $eventCollector.ReadNextEvents($eventNumber)
$matches=@()
While ($eventCollection) {
  $matches += $eventCollection
  $eventCollection = $eventCollector.ReadNextEvents($eventNumber)
}
$eventCollector.DestroyCollector() 
$matches 

Cheers,

Arnim

[TheVMinator]

OK great thanks again