But which event to look for ?

The Making Of

In the PowerCLI Community there are often questions on how track a specific type of event. The best source of information to start with is of course the VMware vSphere API Reference Documentation. Under the Data Object Types you’ll find most of the events that can occur in a vSphere environment.

But there are ways to make the search easier. In my Events – Part 7 : Working with extended events – Update Manager post I already provided a short script to produce a cross-reference of the available events in your vSphere environment.

This is an improved version of that script.

$report = @()
$eventMgr = Get-View EventManager
$events = foreach($event in $eventMgr.Description.EventInfo){
  New-Object PSOBject -Property @{
    Key = $event.Key
    Category = $event.Category
    EventTypeId = &{
      If('ExtendedEvent','EventEx' -contains $event.Key){
        $event.FullFormat.Split('|')[0]
      }
      else{ $null}}
    Description = $event.Description
  }
}
$events | Export-Csv C:\events.csv -NoTypeInformation -UseCulture

The resulting table looks something like this.

Important to remember here, there are 3 major categories of events: a regular Event, an EventEx and an ExtendedEvent. The hierarchy of these different object types looks like this.

Now that we have our events XRef, it’s a matter of doing a bit of searching. The Excel filtering options do wonders here. In this case it was obvious that the HA component produces a number of events that all seem to start with com.vmware.vc.HA. The one we were after had VmRestartedByHAEvent in the identifier. And the Description confirms that this was the event we were looking for.

We pass this EventTypeId with the EventType parameter to the Get-VIEventPlus function. This is explained in the description of the eventTypeId property on the EventFilterSpec object.

The script to get the specific events and produce a report is quite simple.

$entity = Get-Folder Datacenters
$start = (Get-Date).AddMonths(-3)
$Recurse = $false
$eventTypes = "com.vmware.vc.ha.VmRestartedByHAEvent"

Get-VIEventPlus -Entity $entity -Start $start -EventType $eventTypes |
Select CreatedTime,@{N="VM";E={$_.Vm.Name}},@{N="ESX";E={$_.Host.Name}}

The result looks something like this.

Enjoy !