snapshot report script returns empty report

[vmk2014]

Hi All,

I was trying to pull the report from the snapshot report but its returns empty but in RV tools report shows that there is a snapshot for the VM exists.

Amy help will be much appreciated on this. I am using PowerCLI 6.0 Release 1 build 2548067.

Get-VIEvent -MaxSamples ([int]::MaxValue) |

Where-Object {$_.FullFormattedMessage -imatch 'Task: Create virtual machine snapshot'} |

Select CreatedTime,Name,UserName,@{N='VM';E={Get-View $_.VM.VM | Select -ExpandProperty Name}} | Export-Csv report.csv -NoTypeInformation -UseCulture

Thanks

vmk2014

[LucD]

That code seems to be working for me.
Are you connected to the vCenter? Check $global:defaultviservers.

Do you keep the events? Check the vCenter settings (retention) for Tasks and Events

Are you looking at the correct report.csv? Check in the folder where you are currently located.

[kwhornlcs]

Code returned every snapshot event not report for snapshots that exist (really long list with our backup software) - were you looking for all events or all existing?

LucD will probably come up with something that runs faster , this was quick and dirty, but in the short-term try something like this:

$snapshotlist = Get-VM|Get-Snapshot
$snapshotout = @()
ForEach($snapshot in $snapshotlist){
  $start = $start = ($snapshot.Created).AddMinutes(-1)
  $finish = ($snapshot.Created).AddMinutes(1)
  $event = Get-VIEvent -Start $start -Finish $finish -Entity $snapshot.VM | Where {$_.FullFormattedMessage -imatch 'Task: Create virtual machine snapshot'}
  $snapshotout += New-Object PSObject -Property @{vmname = $snapshot.VM.Name; created = $snapshot.created; username = $event.UserName}
}
$snapshotout|Export-Csv c:\SnapshotReport.csv -NoTypeInformation -UseCulture

[vmk2014]

Hi kwhornics,

I was able to pull the report, but user column is blank. Any idea why ?

Thanks

vmk2014

[kwhornlcs]

This may relate back to your original problem. I suspect the Get-VIEvent is coming back empty - hence your original empty report.

Thinking the snapshot might be old enough to have fallen out of retention.

Are the snapshots recent?

Do you get any output if you try to get events for a VM that has a snapshot? Something like below, replacing "vmname" for the vm with a snapshot.

$start = (Get-Date).AddDay(-1)
Get-VM vmname | Get-VIEvents -Start $start

[vmk2014]

Yes, there multiple VM's with the snapshot. Recently, we created 3 snapshot and i tried the command for one of the vm's

PowerCLI C:\temp> Get-VM USVIX-NMUKP01 | Get-VIEvents -Start $start

Get-VIEvents : The term 'Get-VIEvents' is not recognized as the name of a

cmdlet, function, script file, or operable program. Check the spelling of the

name, or if a path was included, verify that the path is correct and try again.

At line:1 char:24

+ Get-VM USVIA-NMUMP01 | Get-VIEvents -Start $start

+                        ~~~~~~~~~~~~

    + CategoryInfo          : ObjectNotFound: (Get-VIEvents:String) [], Comman

   dNotFoundException

    + FullyQualifiedErrorId : CommandNotFoundException

Thanks

vmk2014

[kwhornlcs]

Sorry, my fault on that one should be Get-VIEvent, not Events and adddays, not addday.

Like this:

$start = (Get-Date).AddDays(-1)
Get-VM vmname | Get-VIEvent -Start $start 

Just trying to make sure you get some events back at all..

[vmk2014]

Hi,

Please find the output from the command :-

$start = (Get-Date).AddDays(-1) 

Get-VM VIA-NMHTB02 | Get-VIEvent -Start $start

CreatedTime          : 3/6/2017 2:11:37 AM

UserName             : TECH\svc_backups

Datacenter           : VMware.Vim.DatacenterEventArgument

ComputeResource      : VMware.Vim.ComputeResourceEventArgument

Host                 : VMware.Vim.HostEventArgument

Vm                   : VMware.Vim.VmEventArgument

Ds                   :

Net                  :

Dvs                  :

FullFormattedMessage : Task: host.DiskManager.Lease.MapDiskRegion

ChangeTag            :

Info                 : VMware.Vim.TaskInfo

Key                  : 42709599

ChainId              : 42709599

CreatedTime          : 3/6/2017 2:11:37 AM

UserName             : TECH\svc_backups

Datacenter           : VMware.Vim.DatacenterEventArgument

ComputeResource      : VMware.Vim.ComputeResourceEventArgument

Host                 : VMware.Vim.HostEventArgument

Vm                   : VMware.Vim.VmEventArgument

Ds                   :

Net                  :

Dvs                  :

FullFormattedMessage : Task: host.DiskManager.Lease.MapDiskRegion

ChangeTag            :

[LucD]

Remember to put the MaxSamples parameter, by default you only get the last 100 events.

Get-VIEvent -Start (Get-Date).AddDays(-1) -MaxSamples ([int]::MaxValue) |

Where-Object {$_.FullFormattedMessage -match 'Task: Create virtual machine snapshot'} |

Select CreatedTime,@{N='VM';E={$_.Vm.Name}},UserName

[kwhornlcs]

I was just making sure it wasn't a case of the account running the script not having access to the events.

vmk2014, what is the latest snapshot creation date? That script was looking for events within a couple of minutes of the creation, and the script in the original post was returning nothing when looking for any snapshot creation events with max-samples. Still sounds like it could be the events are rolling off the retention period. The only time I'm seeing username come up empty is for snapshots older than 30 days.

[vmk2014]

Hi Kwhornics,

    Please snapshot report. RV tools shows around 79 snapshot but here i pasted recent ones for your reference.

1/12/2017 15:14	Vsvia-Bns01
1/12/2017 15:12	vsvia-Bnsqldm01
1/12/2017 15:15	wsvia-dnicava02
1/12/2017 15:13	wsvia-dnenapp01
3/3/2017 16:21	wSVIA-MMHUB01
3/3/2017 16:51	wSVIA-mMHUB02
3/3/2017 17:29	wSVIA-MMUMP02
3/3/2017 17:08	wSVIA-mMUMP01

Thnks

vmk2014

[LucD]

Did you try the code I posted (with the MaxSamples parameter)?

[vmk2014]

Thanks LucD. Yes, i did try just now.

PowerCLI C:\temp> .\Snapshot-Event.ps1

PowerCLI C:\temp>

I didn't generate any output on the screen.

Thanks

vmk2014

[LucD]

That only looked at the events of the last day.

Can you change the -1 into a longer time period?

For example -7 to go back 7 days.

[vmk2014]

LucD,

Same result. i.e. no output.

Thanks

vmk2014

[kwhornlcs]

Pretty sure the events related to the January snapshots rolled off, by default vCenter only retains events for 30 days, so anything older than that shouldn't return an event, hence no username.

Maybe there's something funny in the match string? What happens if you run the Get-VIEvent to match on a regex instead of the exact message like so?

Get-VIEvent -Start (Get-Date).AddDays(-7) -Finish (Get-Date) | Where {$_.FullFormattedMessage -match "Create.*snapshot"}

[LucD]

Can you let us know what the following returns?

Get-AdvancedSetting -Entity $global:DefaultVIServer |

where{$_.Name -match "event.max|task.max"}

[vmk2014]

LucD,

Please find the output below.

Name                 Value                Type                 Description

---                 -----                ----                 -----------

vent.maxAge         30                   VIServer             Maximum event...

vent.maxAgeEnabled  True                 VIServer             Enable event ...

ask.maxAge          30                   VIServer             Maximum task age

ask.maxAgeEnabled   True                 VIServer             Enable event ...

Thanks

vmk2014

[LucD]

So you're running with the default of a 30 days retention for events.

You should be able to see snapshot events for the last 30 days.

Would you mind sharing the output from RVTools (mask the VM names)?

[vmk2014]

Hi LucD,

I have attached the RV Tools report for  snapshot. ( VM name is masked).

Thanks

vmk2014