https://kb.vmware.com/s/article/1019064 taught me quite a bit about what logs in vmware.log for power-down of a machine.I knew about "VMX has left the building" for power down and vmotions. The KB taught me a few others.
See attached code which has been plagiarized from a stun time script. This will be used to confirm VMs have indeed been powered off for greater than 90 days. The last time I did this exercise users claimed they powered on their VMs since the date I stated the VM was powered off. This time, I'm gathering my evidence first. ![]()
1) I'm not strong (yet) in regex. I want to search vmware.log for the following strings. I'm not sure how to do multiple (greater than 2) or statements.
VMX has left the building
CPU reset
Power
power
vmotion
2) What is this line of code doing: Duration = $fields[2].Split(' ')[6]
It doesn't give me a duration in days, but something like this (note: the following is a paste from the export-csv output and is a cell). I added the variable Row as that's more useful to me but still want to learn from the plagiarized code.
| building: |
VM Timestamp Duration Row
-- --------- -------- ---
TAM_Health_Amalyzer-5.5.4 11/4/2021 11:26:27 AM 2) {2021-11-04T17:26:27.845Z, vcpu-0, I125: CPU reset: hard...
TAM_Health_Amalyzer-5.5.4 11/4/2021 12:29:08 PM building: {2021-11-04T18:29:08.516Z, vmx, W115: VMX has left the b...