3 Replies Latest reply on Aug 1, 2017 9:31 AM by vJimmy469

    Last Power Off / Guest OS Shutdown Date - PowerCLI

    MarcelEP Lurker

      Hi everyone!


      These days I was looking for a script that could return me the last time my VMs were shut down by filtering their Events.


      I found the one below:


      function Get-LastPowerOff {












        Process {

        $patterns = @(

        "*Power Off virtual machine*"




        $events = $VM | Get-VIEvent

        $qualifiedEvents = @()

        foreach ($pattern in $patterns) {

        $qualifiedEvents += $events | Where { $_.FullFormattedMessage -like $pattern }


        $qualifiedEvents = $qualifiedEvents | Where { $_ -ne $null }

        $sortedEvents = Sort-Object -InputObject $qualifiedEvents -Property CreatedTime -Descending

        $event = $sortedEvents | select -First 1


        $obj = New-Object PSObject

        $obj | Add-Member -MemberType NoteProperty -Name VM -Value $_

        $obj | Add-Member -MemberType NoteProperty -Name PowerState -Value $_.PowerState

        $obj | Add-Member -MemberType NoteProperty -Name LastPoweroff -Value $null

        if ($event) {

        $obj.LastPoweroff = $event.CreatedTime




        Write-Output $obj




      Since I am pretty much new to Powershell / PowerCLI activities, I could not entirely understand the script at first sight. But I found out that I also needed to include the "Initiate guest OS shutdown" pattern in the highlighted part above. I want to know when the VM was turned off for the last time, not mattering if it was a "Power Off" or a Gracefull Shutdown. But I dont know how to include both in this same script. I tried the following:


      Process {

        $patterns = @(

        "*Initiate guest OS shutdown*",

        "*Power Off virtual machine*"


      It wont bring me the last event by comparing both, but only using the first I declare (in the case above, "*Initiate guest OS shutdown*"), ignoring the date it could have been "Powered Off".


      How can I make it work properly by considering both and bringing me the last event?



        • 1. Re: Last Power Off / Guest OS Shutdown Date - PowerCLI
          LucD Guru
          Community WarriorsUser ModeratorsvExpert

          Instead of looking inside the fully formatted message, you can look at the eventtype.

          Something like this (looks at the last 7 days)


          Get-VIEvent -Start (Get-Date).AddDays(-7) -MaxSamples ([int]::MaxValue) |

          where{$_ -is [VMware.Vim.VmPoweredOffEvent] -or

                $_ -is [VMware.Vim.VmGuestShutdownEvent]} |

          Select CreatedTime,@{N='VM';E={$_.Vm.Name}},UserName,FullFormattedMessage


          2 people found this helpful
          • 2. Re: Last Power Off / Guest OS Shutdown Date - PowerCLI
            MarcelEP Lurker

            Thanks a lot for your help and time LucD! It worked perfectly.

            • 3. Re: Last Power Off / Guest OS Shutdown Date - PowerCLI
              vJimmy469 Lurker

              LucD is the man! Many of his scripts have helped bail me out of a tight spot...my only regret is taking this long to thank him or even post something...below is code that I had taken from LucD and modified it so that it reads in a list of VMs and then outputs the information when it was last poweredoff/GuestOS shutdown.


              Add-PSSnapin vmware.vimautomation.core

              Disconnect-VIServer * -Confirm:$FALSE

              Write-Host "Connecting to vCenter"

              Write-Host "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"

              Connect-VIserver {your vCenter}


              $VMs = Get-Content {file path}\PoweredOffVMs_EW.txt


              foreach ($VM in $VMs) {


              #Days set to -425 because my boss wanted list of VMs that have been shutdown for over a year...parsing to CSV helps in the sorting.


                 get-vm $VM | Get-VIEvent -Start (Get-Date).AddDays(-425) -MaxSamples ([int]::MaxValue) |

                 where {$_ -is [VMware.Vim.VmPoweredOffEvent] -or $_ -is [VMware.Vim.VmGuestShutdownEvent]} |

                 Select CreatedTime,@{N='VM';E={$_.Vm.Name}},UserName,FullFormattedMessage | Export-CSV -NoTypeInformation {file path}\PoweredOffVMs_info_EW.csv -Append