I'm trying to speed these queries up and wondering what entity i can specify in the Get-VIEvent for events of the type below:
"VmCreatedEvent","VmDeployedEvent","VmClonedEvent"
Specifying a cluster or datacenter does not work as apparently they are not logged there.
Thanks,
JD
Ok i think i get you. You just don't want to specify the VMs. Is that correct ? you just want to go through ALLL SERIOUSLY ALLL events, and then check which events where the creation ones ? Take a look on that one
$si=get-view serviceinstance
$em= get-view $si.Content.EventManager
$EventFilterSpec = New-Object VMware.Vim.EventFilterSpec
$EventFilterSpec.Type = "VmCreatedEvent"
$em.QueryEvents($EventFilterSpec)
#19:20:19> measure-command { $em.QueryEvents($EventFilterSpec) }
Days : 0
Hours : 0
Minutes : 0
Seconds : 0
Milliseconds : 271
Seriously it's not a bug It's just how fast it is below 0 seconds . Querying ALL events for your type
names can be extracted from
$em.QueryEvents($EventFilterSpec)[0].vm.name
Time frome $_.createdtime
if you want to search through other methods, like in your first post then
$si=get-view serviceinstance
$em= get-view $si.Content.EventManager
$EventFilterSpec = New-Object VMware.Vim.EventFilterSpec
$EventFilterSpec.Type = "VmCreatedEvent","VmDeployedEvent","VmClonedEvent"
$em.QueryEvents($EventFilterSpec)
I hope this is what you wanted to achieve
Hi John,
"
PARAMETERS
-Entity <VIObject[]>
Specify objects (such as virtual machine, virtual machine host, resource pool, and so on) for which you want to collect events.
"
i#17:51:59> Get-Cluster test-cluster |Get-VIEvent | ?{$_ -is [Vmware.vim.VmCreatedEvent]} -> NO OUTPUT
#17:52:52> get-vm testvm9999 |Get-VIEvent | ?{$_ -is [Vmware.vim.VmCreatedEvent]} -> GOT OUTPUT
Template : False
Key : 26428108
ChainId : 26428099
CreatedTime : 11/9/2012 5:52:24 PM
UserName : xxxx
Datacenter : VMware.Vim.DatacenterEventArgument
ComputeResource : VMware.Vim.ComputeResourceEventArgument
Host : VMware.Vim.HostEventArgument
Vm : VMware.Vim.VmEventArgument
Ds :
Net :
Dvs :
FullFormattedMessage : Created virtual machine testvm9999 on yxxx in xxx casdfadfasd
ChangeTag :
so what i mean is that if you will be passing cluster to get-vievent you will not see creation vm events. it would work if you would do
get-cluster XXX | get-vm | get-vievent -> this will check those events for vms in this cluster and not for cluster object.
you can make a specific list with vms and then pass them to get-vievent , that will help i suppose
make sure that when you query for this event you query on vm object not cluster or folder.
Is this any faster than my current syntax?
Get-VIEvent -MaxSamples ([int]::MaxValue) -Start $start -Types info | ? {$_.gettype().name -eq "vmcreatedevent"}
What property are you calling here?
I saw you post this in an earlier topic.
?{$_ -is [Vmware.vim.VmCreatedEvent]}
Disregard ... I see it here
PowerCLI E:\> $event | gm
TypeName: VMware.Vim.VmCreatedEvent
Name MemberType Definition
---- ---------- ----------
Equals Method bool Equals(System.Object obj)
GetHashCode Method int GetHashCode()
GetType Method type GetType()
ToString Method string ToString()
ChainId Property System.Int32 ChainId {get;set;}
ChangeTag Property System.String ChangeTag {get;set;}
ComputeResource Property VMware.Vim.ComputeResourceEventArgument Comp...
CreatedTime Property System.DateTime CreatedTime {get;set;}
Datacenter Property VMware.Vim.DatacenterEventArgument Datacente...
Ds Property VMware.Vim.DatastoreEventArgument Ds {get;set;}
Dvs Property VMware.Vim.DvsEventArgument Dvs {get;set;}
DynamicProperty Property VMware.Vim.DynamicProperty[] DynamicProperty...
DynamicType Property System.String DynamicType {get;set;}
FullFormattedMessage Property System.String FullFormattedMessage {get;set;}
Host Property VMware.Vim.HostEventArgument Host {get;set;}
Key Property System.Int32 Key {get;set;}
Net Property VMware.Vim.NetworkEventArgument Net {get;set;}
SourceVm Property VMware.Vim.VmEventArgument SourceVm {get;set;}
Template Property System.Boolean Template {get;set;}
UserName Property System.String UserName {get;set;}
Vm Property VMware.Vim.VmEventArgument Vm {get;set;}
John,
you can compare your approaches using
measure-command {
your script goes here
}
giving -Types does not make it faster already tried that. IT is faster when u want to make just a dump from events. Then yeah, its twice faster with only info than with all.
Well i made serveral tests, different ones , the best one i came up with was this one
#18:52:11> measure-command {get-view -viewtype virtualmachine -Filter @{'name'='testvm9999'}|get-viobjectbyviview|Get-VIEvent|?{$_ -is [Vmware.vim.VmCreatedEvent]} }
Days : 0
Hours : 0
Minutes : 0
Seconds : 2
Milliseconds : 907
Ticks : 29077235
Other approaches were giving me 5seconds + where as this one only 2. So summarizing, get-vievent is very fast , it's more like how fast can you give him the vm object.
if you do it like this it's even worse:
i#18:19:14> measure-command {Get-VIEvent -entity testvm9999 |?{$_ -is [Vmware.vim.VmCreatedEvent]} }
Days : 0
Hours : 0
Minutes : 0
Seconds : 14
Milliseconds : 657
Ticks : 146578400
the sandard approach
#18:18:45> measure-command {get-vm testvm9999|Get-VIEvent|?{$_ -is [Vmware.vim.VmCreatedEvent]} }
Days : 0
Hours : 0
Minutes : 0
Seconds : 6
Milliseconds : 860
Ticks : 68601261
Regards,
Greg
Yes, that seems to be the problem here, right?
The objects in question are unknown so I can't pipe a get-vm or get-view to it.
I have to dig through all the logs searching for that VM.
Lengthy, lengthy process when you have a busy VC. Even lengthier when you specify a start/finish date.
JD
Why do you mean they are unknown ? Those types will be only on VMs that are in your inventory right ? So what is uknown ? even if you would do get-vm then you would have all possible vms. What do you want to check in that case?
Ok i think i get you. You just don't want to specify the VMs. Is that correct ? you just want to go through ALLL SERIOUSLY ALLL events, and then check which events where the creation ones ? Take a look on that one
$si=get-view serviceinstance
$em= get-view $si.Content.EventManager
$EventFilterSpec = New-Object VMware.Vim.EventFilterSpec
$EventFilterSpec.Type = "VmCreatedEvent"
$em.QueryEvents($EventFilterSpec)
#19:20:19> measure-command { $em.QueryEvents($EventFilterSpec) }
Days : 0
Hours : 0
Minutes : 0
Seconds : 0
Milliseconds : 271
Seriously it's not a bug It's just how fast it is below 0 seconds . Querying ALL events for your type
names can be extracted from
$em.QueryEvents($EventFilterSpec)[0].vm.name
Time frome $_.createdtime
if you want to search through other methods, like in your first post then
$si=get-view serviceinstance
$em= get-view $si.Content.EventManager
$EventFilterSpec = New-Object VMware.Vim.EventFilterSpec
$EventFilterSpec.Type = "VmCreatedEvent","VmDeployedEvent","VmClonedEvent"
$em.QueryEvents($EventFilterSpec)
I hope this is what you wanted to achieve
What I mean is in your examples above you are specifying a certain VM.
Sure, I can do a get-vm | get-vievent but I have a very large environment with thousands of VM's. This takes a very long time.
I'm simply wondering if there is a way to speed things up.
For example, a vmremoved event has to reside in an entity. Since the VM is gone... what entity holds that event?
Yep, got that take a look on post above with solution
Wow...
Yep... that did the trick
Why they wouldn't work that into get-vievent I'm not sure!
Thanks so much for your help.
Don't ask me John I'm glad that helped.
Written function for that:
Greg