LucD notes

On the PowerCLI community someone raised a question how he could get a list of guests that were created longer than 30 days ago. The obvious source to get this kind of information are the events that VI/vSphere keeps. Note that in vSphere you will have to take into account how long events are kept! The current PowerCLI build provides the Get-ViEvent cmdlet that allows you to get at the information.

It is rather simple to get a working script, even as a one-liner, that will get you the specific info.

Get-VIEvent -Start (Get-Date).adddays(-120) | `
	where {$_.gettype().Name -eq "VmCreatedEvent" -and $_.CreatedTime -lt (Get-Date).adddays(-30)} | `
	select @{N="VMname"; E={$_.Vm.Name}},
			@{N="CreatedTime"; E={$_.CreatedTime}},
			@{N="Host"; E={$_.Host.Name}},
			@{N="User"; E={$_.UserName}}

On the Get-ViEvent cmdlet you specify with the -Start parameter how many days you want to go back and in the Where-Object cmdlet you specify how old the specific event should be.

As was discovered by many others before, the current implementation of the Get-ViEvent cmdlet is rather slow if the amount of events you have to run through is high.

As an alternative you can use the SDK’s Event Collector.

There are already quite a few samples on how to use this present in several PowerCLI Community threads.

$days = 120
$eventnumber = 9999
$report = @()

$serviceInstance = get-view ServiceInstance
$eventMgr = Get-View eventManager

if($eventMgr.Client.Version -eq "Vim4" -and $eventnumber -gt 1000){
 Write-Host "Sorry, API 4.0 only allows a maximum event window of 1000 entries!" -foregroundcolor red
 Write-Host "Please set the variable `$eventnumber to 1000 or less" -foregroundcolor red
 exit
}

$efilter = New-Object VMware.Vim.EventFilterSpec
$efilter.time = New-Object VMware.Vim.EventFilterSpecByTime
$efilter.time.beginTime = (Get-Date).Adddays(- $days)
$efilter.time.endtime = (Get-Date).AddDays(-30)

$ecollectionImpl = Get-View ($eventMgr.CreateCollectorForEvents($efilter))
$ecollection = $ecollectionImpl.ReadNextEvents($eventnumber)
while($ecollection -ne $null){
   foreach($event in $ecollection){
      switch($event.GetType()){
         "VMware.Vim.VmCreatedEvent" {
            $row = New-Object PSObject
            $row | Add-Member -name VMname -value $event.Vm.Name -memberType NoteProperty
            $row | Add-Member -name CreatedTime -value $event.CreatedTime -memberType NoteProperty
            $row | Add-Member -name Host -value $event.Host.Name -memberType NoteProperty
            $row | Add-Member -name User -value $event.UserName -memberType NoteProperty
            $report += $row
         }
      }
   }
   $ecollection = $ecollectionImpl.ReadNextEvents($eventnumber)
}
$ecollectionImpl.DestroyCollector()

$report

In this script we use the EventFilterSpecByTime object to specify the start and end of the interval we’re interested in.

The big difference between these two scripts is the total execution time. To measure this I used the StopWatch class. Just add some lines before and after your code you want to time and you will get a nice elapsed time report.

$sw = New-Object System.Diagnostics.StopWatch
$sw.Start()

# Your code goes here

$sw.Stop()
write-host $sw.Elapsed.ToString()

In my test environment the script that uses the Event Collector ran 10 times faster than the script that uses the current Get-ViEvent cmdlet !

Luckily Carter announced, during his recent VMworld presentation, considerable performance improvements in the imminent release of PowerCLI 4u1.