10 Replies Latest reply on Nov 9, 2012 10:34 AM by johndavidd

    Get-VIEvent --- "VmCreatedEvent","VmDeployedEvent","VmClonedEvent"

    johndavidd Enthusiast

      I'm trying to speed these queries up and wondering what entity i can specify in the Get-VIEvent for events of the type below:




      Specifying a cluster or datacenter does not work as apparently they are not logged there.




        • 1. Re: Get-VIEvent --- "VmCreatedEvent","VmDeployedEvent","VmClonedEvent"
          Grzesiekk Expert

          Hi John,


             -Entity <VIObject[]>
                 Specify objects (such as virtual machine, virtual machine host, resource pool, and so on) for which you want to collect events.


          i#17:51:59> Get-Cluster test-cluster |Get-VIEvent | ?{$_ -is [Vmware.vim.VmCreatedEvent]}  -> NO OUTPUT
          #17:52:52> get-vm testvm9999 |Get-VIEvent | ?{$_ -is [Vmware.vim.VmCreatedEvent]}  -> GOT OUTPUT


          Template             : False
          Key                  : 26428108
          ChainId              : 26428099
          CreatedTime          : 11/9/2012 5:52:24 PM
          UserName             : xxxx
          Datacenter           : VMware.Vim.DatacenterEventArgument
          ComputeResource      : VMware.Vim.ComputeResourceEventArgument
          Host                 : VMware.Vim.HostEventArgument
          Vm                   : VMware.Vim.VmEventArgument
          Ds                   :
          Net                  :
          Dvs                  :
          FullFormattedMessage : Created virtual machine testvm9999 on yxxx  in xxx casdfadfasd
          ChangeTag            :



          so what i mean is that if you will be passing cluster to get-vievent you will not see creation vm events. it would work if you would do

          get-cluster XXX | get-vm | get-vievent    -> this will check those events for vms in this cluster and not for cluster object.


          you can make a specific list with vms and then pass them to get-vievent , that will help i suppose

          make sure that when you query for this event you query on vm object not cluster or folder.

          • 2. Re: Get-VIEvent --- "VmCreatedEvent","VmDeployedEvent","VmClonedEvent"
            johndavidd Enthusiast

            Is this any faster than my current syntax?


            Get-VIEvent -MaxSamples ([int]::MaxValue) -Start $start -Types info | ? {$_.gettype().name -eq "vmcreatedevent"}


            What property are you calling here?


            I saw you post this in an earlier topic.


            ?{$_ -is [Vmware.vim.VmCreatedEvent]}


            Disregard ... I see it here



            PowerCLI E:\> $event | gm
               TypeName: VMware.Vim.VmCreatedEvent
            Name                 MemberType Definition
            ----                 ---------- ----------
            Equals               Method     bool Equals(System.Object obj)
            GetHashCode          Method     int GetHashCode()
            GetType              Method     type GetType()
            ToString             Method     string ToString()
            ChainId              Property   System.Int32 ChainId {get;set;}
            ChangeTag            Property   System.String ChangeTag {get;set;}
            ComputeResource      Property   VMware.Vim.ComputeResourceEventArgument Comp...
            CreatedTime          Property   System.DateTime CreatedTime {get;set;}
            Datacenter           Property   VMware.Vim.DatacenterEventArgument Datacente...
            Ds                   Property   VMware.Vim.DatastoreEventArgument Ds {get;set;}
            Dvs                  Property   VMware.Vim.DvsEventArgument Dvs {get;set;}
            DynamicProperty      Property   VMware.Vim.DynamicProperty[] DynamicProperty...
            DynamicType          Property   System.String DynamicType {get;set;}
            FullFormattedMessage Property   System.String FullFormattedMessage {get;set;}
            Host                 Property   VMware.Vim.HostEventArgument Host {get;set;}
            Key                  Property   System.Int32 Key {get;set;}
            Net                  Property   VMware.Vim.NetworkEventArgument Net {get;set;}
            SourceVm             Property   VMware.Vim.VmEventArgument SourceVm {get;set;}
            Template             Property   System.Boolean Template {get;set;}
            UserName             Property   System.String UserName {get;set;}
            Vm                   Property   VMware.Vim.VmEventArgument Vm {get;set;}
            • 3. Re: Get-VIEvent --- "VmCreatedEvent","VmDeployedEvent","VmClonedEvent"
              Grzesiekk Expert


                you can compare your approaches using


              measure-command {


              your script goes here





              giving -Types does not make it faster already tried that. IT is faster when u want to make just a dump from events. Then yeah, its twice faster with only info than with all.

              Well i made serveral tests, different ones , the best one i came up with was this one


              #18:52:11> measure-command {get-view -viewtype virtualmachine -Filter @{'name'='testvm9999'}|get-viobjectbyviview|Get-VIEvent|?{$_ -is [Vmware.vim.VmCreatedEvent]} }


              Days              : 0
              Hours             : 0
              Minutes           : 0
              Seconds           : 2
              Milliseconds      : 907
              Ticks             : 29077235


              Other approaches were giving me 5seconds +  where as this one only 2. So summarizing,  get-vievent is very fast , it's more like how fast can you give him the vm object.


              if you do it like this it's even worse:

              i#18:19:14> measure-command {Get-VIEvent -entity testvm9999 |?{$_ -is [Vmware.vim.VmCreatedEvent]} }


              Days              : 0
              Hours             : 0
              Minutes           : 0
              Seconds           : 14
              Milliseconds      : 657
              Ticks             : 146578400


              the sandard approach

              #18:18:45> measure-command {get-vm testvm9999|Get-VIEvent|?{$_ -is [Vmware.vim.VmCreatedEvent]} }


              Days              : 0
              Hours             : 0
              Minutes           : 0
              Seconds           : 6
              Milliseconds      : 860
              Ticks             : 68601261





              • 4. Re: Get-VIEvent --- "VmCreatedEvent","VmDeployedEvent","VmClonedEvent"
                johndavidd Enthusiast

                Yes, that seems to be the problem here, right?


                The objects in question are unknown so I can't pipe a get-vm or get-view to it.


                I have to dig through all the logs searching for that VM.


                Lengthy, lengthy process when you have a busy VC. Even lengthier when you specify a start/finish date.



                • 5. Re: Get-VIEvent --- "VmCreatedEvent","VmDeployedEvent","VmClonedEvent"
                  Grzesiekk Expert

                  Why do you mean they are unknown ? Those types will be only on VMs that are in your inventory right ? So what is uknown ? even if you would do get-vm then you would have all possible vms. What do you want to check in that case?

                  • 6. Re: Get-VIEvent --- "VmCreatedEvent","VmDeployedEvent","VmClonedEvent"
                    Grzesiekk Expert

                    Ok i think i get you. You just don't want to specify the VMs. Is that correct ? you just want to go through ALLL SERIOUSLY ALLL events, and then check which events where the creation ones ? Take a look on that one

                    $si=get-view serviceinstance
                    $em= get-view $si.Content.EventManager
                    $EventFilterSpec = New-Object VMware.Vim.EventFilterSpec
                    $EventFilterSpec.Type = "VmCreatedEvent"



                    #19:20:19> measure-command { $em.QueryEvents($EventFilterSpec) }


                    Days              : 0
                    Hours             : 0
                    Minutes           : 0
                    Seconds           : 0
                    Milliseconds      : 271


                    Seriously it's not a bug It's just how fast it is below 0 seconds . Querying ALL events for your type

                    names can be extracted from


                    Time frome $_.createdtime


                    if you want to search through other methods, like in your first post then

                    $si=get-view serviceinstance
                    $em= get-view $si.Content.EventManager
                    $EventFilterSpec = New-Object VMware.Vim.EventFilterSpec
                    $EventFilterSpec.Type = "VmCreatedEvent","VmDeployedEvent","VmClonedEvent"


                    I hope this is what you wanted to achieve

                    • 7. Re: Get-VIEvent --- "VmCreatedEvent","VmDeployedEvent","VmClonedEvent"
                      johndavidd Enthusiast

                      What I mean is in your examples above you are specifying a certain VM.


                      Sure, I can do a get-vm | get-vievent but I have a very large environment with thousands of VM's. This takes a very long time.


                      I'm simply wondering if there is a way to speed things up.


                      For example, a vmremoved event has to reside in an entity. Since the VM is gone... what entity holds that event?

                      • 8. Re: Get-VIEvent --- "VmCreatedEvent","VmDeployedEvent","VmClonedEvent"
                        Grzesiekk Expert

                        Yep, got that take a look on post above with solution

                        • 9. Re: Get-VIEvent --- "VmCreatedEvent","VmDeployedEvent","VmClonedEvent"
                          johndavidd Enthusiast



                          Yep... that did the trick


                          Why they wouldn't work that into get-vievent I'm not sure!


                          Thanks so much for your help.

                          • 10. Re: Get-VIEvent --- "VmCreatedEvent","VmDeployedEvent","VmClonedEvent"
                            Grzesiekk Expert

                            Don't ask me John I'm glad that helped.


                            Written function for that: