Comments on: Events – Part 3 : Auditing VM device changes

By: LucD

LucD — Fri, 11 Jun 2021 21:07:36 +0000

In reply to Alexander. Hi, Not sure what you mean. The script retrieves all ReconfigVM_Task tasks, and then per Task, via the EventChainId property retrieves all related events.

By: Alexander

Alexander — Thu, 10 Jun 2021 12:53:34 +0000

Hello LucD. Thanks for the great script!
I have a question. What do you think, is there a way to query the related event for reconfiguration change task? The thing is, that reconfiguration task has related event wich has a description that tells us what and how was exactly changed. It would be much useful if we could add this description into the exported csv file.
Example:
Reconfigured VM on HOST in Datacenter. Modified: config.hardware.numCoresPerSocket: 2 -> 4; config.hardware.memoryMB: 4096 -> 8192;

By: Macleud

Macleud — Mon, 15 Mar 2021 17:17:40 +0000

In reply to LucD. It looks like a problem in one the vcenter. Others the vcenter are fine. Thanks!

By: LucD

LucD — Mon, 15 Mar 2021 14:56:13 +0000

In reply to Macleud. Are you sure you are connected to a vCenter? Were there any errors before the 1st one (CreateCollectorForEvents) you listed here?

By: Macleud

Macleud — Mon, 15 Mar 2021 14:42:25 +0000

Hi LucD.
I run the script but the result is no luck.

MethodInvocationException: /Users/mac/Documents/Redirect/TaskVM.ps1:26
Line |
26 | $eCollector = Get-View ($eventMgr.CreateCollectorForEvents($e …
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| Exception calling “CreateCollectorForEvents” with “1” argument(s): “A specified parameter was not correct: ”

InvalidOperation: /Users/mac/Documents/Redirect/TaskVM.ps1:27
Line |
27 | $events = $eCollector.ReadNextEvents($eventnumber)
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| You cannot call a method on a null-valued expression.

InvalidOperation: /Users/mac/Documents/Redirect/TaskVM.ps1:52
Line |
52 | $ecollection = $eCollector.ReadNextEvents($eventnumber)
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| You cannot call a method on a null-valued expression.

InvalidOperation: /Users/mac/Documents/Redirect/TaskVM.ps1:54
Line |
54 | $eCollector.DestroyCollector()
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| You cannot call a method on a null-valued expression.

By: LucD

LucD — Wed, 09 Sep 2020 15:56:14 +0000

In reply to Erwin. Instead of calling the Get-VIEvent cmdlet multiple times, you better do something like this.


$servers=Get-Cluster -name LIM-SANFER | Get-VM

Get-VIEvent -Entity $servers -MaxSamples ([int]::MaxValue) -Start (Get-Date).AddHours(-1) |
where{$_ -is [VMware.Vim.VmReconfiguredEvent] -and $_.ConfigChanges.Modified -match "config.hardware.numCPU|config.hardware.memoryMB"} |
Group-Object -Property {$_.VM.Name} -PipelineVariable group |
ForEach-Object -Process {
        $group.Group | 
        Select @{N='VM';E={$group.Name}},
            @{N='User';E={$_.UserName}},
            @{N='Details';E={$_.FullFormattedMessage}}
}

By: Erwin

Erwin — Wed, 09 Sep 2020 15:25:38 +0000

Hi Lucd,
First of all, thanks for the scripts that make our automation life easier.
I have a query, I want to work with the events of the vm to know which servers were modified in memory and cpu, but I still cannot finish it, it only works with cpu but when I add the memory it no longer works.

$servers=get-cluster -name LIM-SANFER | get-vm
$i=1
$Total=@()
$TotalServer=$servers.Count
foreach($server in $servers){
Write-Progress -Activity “Getting Info Please wait……” -Status “Server $server ($i/$TotalServer)” -PercentComplete ($i/$TotalServer*100)
$event=Get-VIEvent -Entity $server | Where { $_.FullFormattedMessage -like “*config.hardware.numCPU*” }
$event3=Get-VIEvent -Entity $server | Where { $_.FullFormattedMessage -like “*config.hardware.memoryMB*”}
$i=$i+1
if($event){
$event2=$event | select @{N=’user’;E={$_.UserName}}, @{N=’detalle’;E={$_.FullFormattedMessage}}, @{N=’VM’;E={$server}}
echo $event2
$Total+=$event2
}
else{
if($event3){
$event4=$event3 | select @{N=’user’;E={$_.UserName}}, @{N=’detalle’;E={$_.FullFormattedMessage}}, @{N=’VM’;E={$server}}
echo $event4
$Total+=$event4
}
else{

}

}
$Total |Export-Csv ./Output.csv -NoTypeInformation

By: Vladimir

Vladimir — Mon, 10 Aug 2020 08:07:26 +0000

Hello, Luc and thank you for great article, it’s helped me alot. But i have a question. Is it’s possible to retrieve Disk UUID from event if disk was created during such event (“add” – operation)? If disk was edited or removed it is easy, i can just add a line to the script: UUID = $_.Device.backing.uuid and script will return me disk UUID. But if disk was created during operation i will just receive null result.

I there any way to retrieve UUID of the disk from the event of disk creation. If it’s not possible then may be we cant retrieve some other info which can help us to identify disk that was created?

By: LucD

LucD — Thu, 16 Jul 2020 06:56:35 +0000

In reply to decniner. Hi, No, there is nothing missing. When there is no value for any of these present in the event, their value was not changed. Hence the empty string.

By: decniner

decniner — Thu, 16 Jul 2020 05:59:08 +0000

In reply to Nathan Kulas. It looks like there are some information missing from below line. Can you share what are those? Memory = else{“”}} NumCPU = else{“”}} Disk = else{“”}}