Get-VIEvent does not show Username and VM name for some events?

[markvm2]

I am working on a script to pull the vCenter tasks and events and have noticed that some of the events do not show the VM name or Username that is shown for the event in the vSphere client under the tasks and events tab. For example, when you clone a VM and get the event through Get-VIEvent the user that did the clone does not show up in the event. In the vSphere client under the tasks and events, you get the username, target, time and all the information you would want. That info does not show up in Get-VIEvent. This happens for several other types of events as well.

Is there a way to get the same amount of detail you see in the vSphere client under tasks and events with Get-VIEvent.

I am doing Get-VIEvent without the Entity specified for the default vCenter events, and even when I specify a VM or host I have the same problem.

[LucD]

Which event did you use ?

The VmClonedEvent does contain the user in the UserName property for me (vSphere 5.5)

[markvm2]

You are right that cloning a VM does show the username. Today I generated a bunch of events and looked at each one with Get-VIEvent and the following do not show a Username or VM. Some of them will show the username but not specify the VM and others show the VM but no username.

Creating a snapshot

remove snapshot

rename VM

Host reboot

update/disable service (like starting/stopping SSH service)

Make changes to network settings on standard vSwitch.

Can you take a look at those and see what is going on? I don't know why they would not be there since you see the correct info in the vSphere client. The script I am working for is for security auditing and getting the username and VM for each event is crucial.

[LucD]

Not all actions produce a dedicated Event-type entry.

That information is in several cases available in the TaskEvent.

For example, when you create a snapshot for a VM, the information is available in the related TaskEvent.

To retrieve the info you could do

Get-VIEvent -Start (Get-Date).AddHours(-1) -MaxSamples ([int]::MaxValue) |
Where {$_ -is [VMware.Vim.TaskEvent] -and $_.Info.Name -eq "CreateSnapshot_Task"} |
Select CreatedTime,UserName,@{N="VM";E={$_.Vm.Name}}

[markvm2]

All of those events I listed still show up in the vSphere client under the events tab? I thought Get-VIEvents pulled all of that? It looks like it does pull everything that shows up in the events tab but some of the fields like Username or VM are missing?

[LucD]

That is correct, but if the entry appears under the Events tab, it doesn't necessarily mean there is a special, dedicated event for that entry.

Sometimes, like I tried to explain above, the information comes from the more general TaskEvent (which is an Event as well in the end).

[markvm2]

So how would I pull all of those TaskEvent entires? Like a normal Get-VIEvent.

[LucD]

Yes, get the TaskEvents and eventually add an additional filter, like in my example above.

[markvm2]

LucD,

Sorry If I am not understanding. That example you showed is for the "CreateSnapshot_Task" event. I would like to pull everything at once like a standard "Get-VIEvent" does.

[markvm2]

Also,

Is it possible to specify more granular time like hours and minutes? Your example had an hour? The Get-VIEvent page says that the valid formats are only dd/mm/yyyy and mm/dd/yyyy ?

[LucD]

Most types of vSphere Tasks generate a TaskEvent.

With this small change, you can get all TasEvents, and it shows which task it actually was.

Get-VIEvent -Start (Get-Date).AddHours(-1) -MaxSamples ([int]::MaxValue) |
Where {$_ -is [VMware.Vim.TaskEvent]} |
Select CreatedTime,@{N="Task";E={$_.Info.Name}},UserName,@{N="VM";E={$_.Vm.Name}}

The Start and Finish parameters accept a DateTime object, which contains the date and the time.

In my example I take the current date and time, and substract 1 hour. So as a result I get the events for the past hour.

The documentation just says that the date part can be specified either way, depending on the locale settings.