Retrieve ESXi events through Get-View

[zenivox]

Hello, due to the "Error in deserializing body of reply message for operation 'RetrieveProperties'" error when running Get-VIEvent + export-csv I'm exploring a way to go through Get-View. I'm not able to get there however. I discovered the method getalleventsview but I can't find the way to use it.

$ESXview = get-view –viewtype HostSystem -Filter 
foreach($view in $ESXview)
      {
      $view.getalleventsview | ?{$_.???  -match "has entered"} | select vClusterName,ESXName,CreationTime,FullFormattedMessage
      }

this is the script which throws the error and need to convert in a Get-View script

foreach($esx in (Get-Cluster $vClusters | Get-VMHost))
    {
    Get-VIEvent -Entity $esx -MaxSamples ([int]::MaxValue) -Start (Get-Date).AddMinutes(–15) | ?{$_.FullFormattedMessage -match "has entered"} | 
        select @{N="ClusterName";E={$esx.Parent}},@{N="ESXname";E={$esx.Name}}, CreatedTime, FullFormattedMessage |
        Export-Csv "$path\ESXentries.csv" -NoTypeInformation
    }

[LucD]

Hate to disappoint you, but the API method to get the events throws the same error (it is probably a vCenter issue, and PowerCLI is using the same method under the covers).

My Get-VIEventPlus function (which you can find in Get the vMotion/svMotion history) throws the same error intermittently.

[zenivox]

many thanks Luc as usual! At least for me not to export-csv works fine (without Get-View). Weird..

[zenivox]

Ok, luckily we still have a small VC on version 6 and I could use Onyx. So I could retrieve the method used for this purpose and found this script already posted in the community. I would need few info before making it effective. Then if it still throws that error fine, I'll wait for the fix but at least I'm trying. I really need to learn this Get-View concepts as our environment is big and need fast scripts.

So..

1. I know Get-View is used on vcenter basis. I know it's not a good idea to launch Get-View methods while connected to multiple vCenter servers, however in my case here I need to retrieve ESXi events, so can I attach multiple VCs anyway or there is a risk NOT to get something?

2. Where do I find a list of the EventTypeId ? I need to retrieve APD and PDL type of events. I googled but haven't found anything.

$eventnumber = 1000
$serviceInstance = get-view ServiceInstance -Server $global:DefaultVIServer
$eventMgr = Get-View $serviceInstance.Content.EventManager
$efilter = New-Object VMware.Vim.EventFilterSpec
$efilter.time = New-Object VMware.Vim.EventFilterSpecByTime
$efilter.time.beginTime = (Get-Date).Adddays(-8)
$efilter.time.endtime = (Get-Date).Adddays(-7)
$efilter.EventTypeId = 'VmPoweredOffEvent','VmPoweredOnEvent','com.vmware.vc.ha.VmRestartedByHAEvent'
$events = @() 
$ecollectionImpl = Get-View ($eventMgr.CreateCollectorForEvents($efilter))
$ecollectionImpl.RewindCollector()
$ecollection = $ecollectionImpl.ReadNextEvents($eventnumber)
while($ecollection -ne $null)
    {
    $ecollection.Count
    $events += $ecollection
    $ecollection = $ecollectionImpl.ReadNextEvents($eventnumber)
    }
$ecollectionImpl.DestroyCollector()
$events | Group-Object -Property {$_.GetType().Name} | ft

[LucD · Accepted solution]

Instead of writing your own script, you could reuse my Get-VIEventPlus function.

It contains the logic to filter events based on EventTypeId.

See my HA VM Failover Tracking post for further info on how to find/list all types of events.

Each vCenter has its own ServiceInstance and Managers, including the EventManager.

You would have to include logic to make the call for events to each vCenter in sequence, a simple ForEach loop over all the entries $global:defaultviservers.