Events: a great source of information - Part 1

On the PowerCLI community someone raised a question how he could get a list of guests that were created longer than 30 days ago. The obvious source to get this kind of information are the events that VI/vSphere keeps. Note that in vSphere you will have to take into account how long events are kept! The current PowerCLI build provides the Get-ViEvent cmdlet that allows you to get at the information.

It is rather simple to get a working script, even as a one-liner, that will get you the specific info.

Get-VIEvent -Start (Get-Date).adddays(-120) | `
where {$_.gettype().Name -eq "VmCreatedEvent" -and $_.CreatedTime -lt (Get-Date).adddays(-30)} | `
select @{N="VMname"; E={$_.Vm.Name}},
@{N="CreatedTime"; E={$_.CreatedTime}},
@{N="Host"; E={$_.Host.Name}},
@{N="User"; E={$_.UserName}}

Get-VIEvent -Start (Get-Date).adddays(-120) | `

where {$_.gettype().Name -eq "VmCreatedEvent" -and $_.CreatedTime -lt (Get-Date).adddays(-30)} | `

select @{N="VMname"; E={$_.Vm.Name}},

@{N="CreatedTime"; E={$_.CreatedTime}},

@{N="Host"; E={$_.Host.Name}},

@{N="User"; E={$_.UserName}}

On the Get-ViEvent cmdlet you specify with the -Start parameter how many days you want to go back and in the Where-Object cmdlet you specify how old the specific event should be.

As was discovered by many others before, the current implementation of the Get-ViEvent cmdlet is rather slow if the amount of events you have to run through is high.

As an alternative you can use the SDK’s Event Collector.

There are already quite a few samples on how to use this present in several PowerCLI Community threads.

$days = 120
$eventnumber = 9999
$report = @()
$serviceInstance = get-view ServiceInstance
$eventMgr = Get-View eventManager
if($eventMgr.Client.Version -eq "Vim4" -and $eventnumber -gt 1000){
Write-Host "Sorry, API 4.0 only allows a maximum event window of 1000 entries!" -foregroundcolor red
Write-Host "Please set the variable `$eventnumber to 1000 or less" -foregroundcolor red
exit
}
$efilter = New-Object VMware.Vim.EventFilterSpec
$efilter.time = New-Object VMware.Vim.EventFilterSpecByTime
$efilter.time.beginTime = (Get-Date).Adddays(- $days)
$efilter.time.endtime = (Get-Date).AddDays(-30)
$ecollectionImpl = Get-View ($eventMgr.CreateCollectorForEvents($efilter))
$ecollection = $ecollectionImpl.ReadNextEvents($eventnumber)
while($ecollection -ne $null){
foreach($event in $ecollection){
switch($event.GetType()){
"VMware.Vim.VmCreatedEvent" {
$row = New-Object PSObject
$row | Add-Member -name VMname -value $event.Vm.Name -memberType NoteProperty
$row | Add-Member -name CreatedTime -value $event.CreatedTime -memberType NoteProperty
$row | Add-Member -name Host -value $event.Host.Name -memberType NoteProperty
$row | Add-Member -name User -value $event.UserName -memberType NoteProperty
$report += $row
}
}
}
$ecollection = $ecollectionImpl.ReadNextEvents($eventnumber)
}
$ecollectionImpl.DestroyCollector()
$report

$days = 120

$eventnumber = 9999

$report = @()

$serviceInstance = get-view ServiceInstance

$eventMgr = Get-View eventManager

if($eventMgr.Client.Version -eq "Vim4" -and $eventnumber -gt 1000){

Write-Host "Sorry, API 4.0 only allows a maximum event window of 1000 entries!" -foregroundcolor red

Write-Host "Please set the variable `$eventnumber to 1000 or less" -foregroundcolor red

exit

}

$efilter = New-Object VMware.Vim.EventFilterSpec

$efilter.time = New-Object VMware.Vim.EventFilterSpecByTime

$efilter.time.beginTime = (Get-Date).Adddays(- $days)

$efilter.time.endtime = (Get-Date).AddDays(-30)

$ecollectionImpl = Get-View ($eventMgr.CreateCollectorForEvents($efilter))

$ecollection = $ecollectionImpl.ReadNextEvents($eventnumber)

while($ecollection -ne $null){

foreach($event in $ecollection){

switch($event.GetType()){

"VMware.Vim.VmCreatedEvent" {

$row = New-Object PSObject

$row | Add-Member -name VMname -value $event.Vm.Name -memberType NoteProperty

$row | Add-Member -name CreatedTime -value $event.CreatedTime -memberType NoteProperty

$row | Add-Member -name Host -value $event.Host.Name -memberType NoteProperty

$row | Add-Member -name User -value $event.UserName -memberType NoteProperty

$report += $row

}

$ecollection = $ecollectionImpl.ReadNextEvents($eventnumber)

}

$ecollectionImpl.DestroyCollector()

$report

In this script we use the EventFilterSpecByTime object to specify the start and end of the interval we’re interested in.

The big difference between these two scripts is the total execution time. To measure this I used the StopWatch class. Just add some lines before and after your code you want to time and you will get a nice elapsed time report.

$sw = New-Object System.Diagnostics.StopWatch
$sw.Start()
# Your code goes here
$sw.Stop()
write-host $sw.Elapsed.ToString()

$sw = New-Object System.Diagnostics.StopWatch

$sw.Start()

# Your code goes here

$sw.Stop()

write-host $sw.Elapsed.ToString()

In my test environment the script that uses the Event Collector ran 10 times faster than the script that uses the current Get-ViEvent cmdlet !

Luckily Carter announced, during his recent VMworld presentation, considerable performance improvements in the imminent release of PowerCLI 4u1.

8 Comments

Jon

July 14, 2019 at 18:29

Is the way to have first column vcenter than time created, severity, full description, comments and type of event ?

LucD

August 6, 2019 at 09:06

Yes, you can add a calculated property, where the expression (E) would be
([System.Uri]$global:defaultviserver.ServiceUri.AbsoluteUri).Host

Kamal Khoosal

April 10, 2013 at 09:43

Hi LucD,

Thanks for the script.

I’m having issues running your script even after you added the warning for API version number. The following error is being thrown. My version for the API is Vim50 but the script will only execute when my $eventnumber is 1000 or less.

Exception calling “ReadNextEvents” with “1” argument(s): “A specified parameter was not correct.
maxCount”
At C:\Users\ADMINI~1.IDC\AppData\Local\Temp\4\Untitled8.ps1:42 char:47
+ $ecollection = $ecollectionImpl.ReadNextEvents <<<< ($eventnumber)
+ CategoryInfo : NotSpecified: (:) [], MethodInvocationException
+ FullyQualifiedErrorId : DotNetMethodException

Any ideas as to what is causing this to still fail.

Thanks

Harley Stagner

October 7, 2009 at 20:05

Thanks LucD,

I have installed it on my site. I will start putting much more PowerCLI stuff on there now 🙂

Mike Foley

October 7, 2009 at 19:58

Hi Luc,

I cut and pasted the 2nd example and got the following error. I think the parameter MaxCount is missing??

PS C:\Users\Mike\Documents\My Code Library\Vmware> .\events.ps1
Exception calling “ReadNextEvents” with “1” argument(s): “A specified parameter was not correct.
maxCount”
At C:\Users\Mike\Documents\My Code Library\Vmware\events.ps1:14 char:47
+ $ecollection = $ecollectionImpl.ReadNextEvents <<<< ($eventnumber)
+ CategoryInfo : NotSpecified: (:) [], MethodInvocationException
+ FullyQualifiedErrorId : DotNetMethodException

October 7, 2009 at 21:13

Hi Mike, you encountered a vSphere API 4.0 “feature“.
When the maxCount parameter on the ReadNextEvents method is greater than 1000 you will get this error message.
I have added a test to the script so the user will be warned 😉

Note that this “feature” doesn’t exist in API 2.5.

October 7, 2009 at 17:53

Hello LucD,

Good stuff here as usual. I have a quick question.

What are you using to format your code on your site? Is it a WordPress Plugin?

Thanks for the excellent information as always.

October 7, 2009 at 18:18

Thanks Harley.
It’s indeed a WordPress plugin which I discovered recently.
It’s called SyntaxHighlighter Evolved and I’m quite pleased how it threats PowerShell code.

Events: a great source of information – Part 1

8 Comments

Jon

LucD

Kamal Khoosal

Harley Stagner

Mike Foley

LucD

Harley Stagner

LucD

Leave a Reply Cancel reply