Use PowerCLI to determine when a VM was powered off

[G_e_r_g]

{new user - first post}

Using the vCenter web client, the power off event / task for a VM is listed.  (top half of attachment)

Using PowerCLI, the VM can be located, but there are NO events associated with it.  (bottom half of attachment)
  Get-VM xxx
  Get-VM xxx | Get-VIEvent -MaxSamples ([int]::MaxValue) -Verbose

Variations like Get-VIEvent -Entity xxx return no results either...

Using the same command against a PoweredOn VM returns pages of results.
  Get-VM yyy | Get-VIEvent

Why doesn't the Get-VIEvent cmdlet return results when the VM is powered off?  Is there some additional parameter for dealing with powered off devices?

[LucD]

No, there is no parameter for a powered off VM.
These events come from the VCSA, they are kept in the VCSA DB.

Do you see the same behaviour for all your powered off VMs?
How long does your VCSA keeps Tasks and Events?

[G_e_r_g]

Thanks for responding!!  (I just started a new job.  I am still learning my way around the new environment.)

It looks like there are about 200 powered off VMs.  I spot-checked about 20 of those.  I can see events for about half of them.  The other half return no events.

The database is configured to save tasks and events for 7 days.

In my example, the VM was turned off more than 7 days ago.  If that task/event is no longer in the database, how is the GUI able to report it?

[LucD]

Afaik, the Web Client has some kind of cache for this.
But I'm afraid I don't know the details of this

[G_e_r_g]

I wrote a little script to find all the VMs that were powered off - 217 VMs  (using Get-VM)

I then looped through those 217 VMs, looking for "power off" events - 6 VMs  (using Get-VIEvent)

I was able to find the date/time and username for the 6 VMs (all within the past couple of days actually).

So the Get-VIEvent cmdlet works, if the events are in the database.  However, since vCenter only maintain 7 days of tasks and events in the database, there isn't enough detail to tell if the VMs have been powered off for 8 days or 80 days or 800 days.

I found a handful of VMs where the WebClient under Tasks (back to my example in the original attachment) DOES include the power off details, but at this point, I don't know how to access the same details using PowerCLI.  (And in the WebClient under Events, there are no details.)  It would really be nice to find out where the WebClient saves those tasks...

I am struggling to understand the difference between Tasks and Events.  And why Tasks linger even though the config is set to only keep 7 days in the database.

[LucD · Accepted solution]

The difference between Task and Events, in short, is the following.
Task: something is done in a vSphere server. See View Tasks for more info.
Event: a record of user or system actions on a vSphere server. And yes, starting a Task generates a TaskEvent.

An Event can trigger other events.
Those related events are available through the ChainId property.
A Task also has a ChainId property that points to events related to the Task.

In fact, in my answer yesterday, I forgot about the TaskHistoryCollector.
Via that Managed Object, one can access those Tasks you see in the Web Client for powered off VMs.
There are no PowerCLI cmdlets to access that information. It requires using the API methods.
For example

$vmName = 'MyPoweredOffVM'

$vm = Get-Vm -Name $vmName
$taskMgr = Get-View TaskManager

$filter = New-Object -TypeName VMware.Vim.TaskFilterSpec
$filter.Entity = New-Object -TypeName VMware.Vim.TaskFilterSpecByEntity
$filter.Entity.Entity = $vm.ExtensionData.MoRef

$tCol = Get-View -Id $taskMgr.CreateCollectorForTasks($filter)
$tcol.LatestPage | Select Name,State,StartTime,CompletedTime

I hope this helped to clarify the confusion and find the data you see in the Web Client.

[G_e_r_g]

YES!!  Excellent!!

I tweaked the last line to include the username, too.
$tcol.LatestPage | where {$_.name -like '*power*off*'} | Select Name,State,StartTime,CompletedTime,@{N='UserName';E={$_.Reason.UserName}}

This is what I was looking for.

THANK YOU!!

(How do I close this and mark it as completed?)

[LucD]

I think you just did 😀