PowerCli – Who built that VM…

It can be really frustrating when a VM has been built but something was missed and people need educating or because something is in the inventory but nobody knows anything about it. Unfortunately VM events only go back so far but they have a key code attached to the type of event so I was able to write a short script to go and look for a event type (key) for a number of VMs in vCenter.
In order to identify the Key for the event I want to search for I ran the following command against a VM within Powershell which was already connected to a vCenter. If you want to include more events increase the MaxSample variable.

$vm = get-vm “MyVM”
$vm | get-vievent –MaxSamples 1000 | export-csv –path C:\Events.csv

The output for this file will be all the events for that machine in a csv file format, if you look at the column “FullFormattedMessage” it will show the event notes which will give you an idea of the event you want to search for, for my example I want to use the event “Deploying VM on host MyHost in UK from template Template1” which has the key code of 50884734 and in the csv file I can see who executed that task from the UserName column.
Because this script is to look for the events in multiple VMs I have used a text document to list the VM names in as they are shown in vCenter. It will then interrogate each VM going back as far as the date specified and display the results in the csv file of my stated location.

add-pssnapin VMware.VimAutomation.Core
$file = “C:\Scripts\Input\VMs.txt
$vms = get-content $file
$output = C:\Scripts\Reports\Events.csv
$results = @()
Foreach ($vm in $vms)
$results += get-vm $vm | get-vievent –start 16/03/2016 | where {$_.key –eq 50884734}
$results | Export-csv –NoTypeInformation –UseCulture –Path $output

You can add or change the keys you want to search for, change the dates you want to back as far etc.

Leave a Comment

Your email address will not be published. Required fields are marked *