How to get the Event Target

[ChrisROI]

Hi

is there a handy way to get the Event Target for Events?

For example in vCenter UI:

Monitor -> Events ->  Alarm 'Virtual machine memory usage' on vCLS-2a... -> Target "vCLS-2aab32ea-0c7c-4daf-aec2-8e577e1b36e4 "

Or in other words:

Which of the Event Properties is the equivalent for the "target"? ObjectName? Entity?

What Iam trying do:

$start = (Get-Date).AddDays(-1)

$Events = Get-VIEvent -Start $start

$EventOutput = @()

foreach ($Event in $Events){

$tempObj = "" | Select-Object -Property Time, Entity, Message

$tempObj.Time = $Event.CreatedTime


$tempObj.Entity = $event.Objectname # here is the problem

$tempObj.Message = $Event.FullFormattedMessage

$EventOutput += $tempObj

}

$EventOutput

 

 

Thank you in advance.

 

 

[LucD]

The object returned by Get-VIEvent has a series of properties (Datacenter, ComputeResource, Host, VM, DS, Net, Dvs) that will point to the entity connected to the event.

[ChrisROI]

Hi Luc!

thank you for your reply.

 

yes I have seen these Properties and try to set conditions to get the target:

$start = (Get-Date).AddDays(-1)

$Events = Get-VIEvent -Start $start -MaxSamples 100

$EventOutput = @()

foreach ($event in $Events){

#creating objects
$tempObj = "" | Select-Object -Property Time, Entity, Message
#creating Property Time
$tempObj.Time = $event.CreatedTime
#creating Property Message
$tempObj.Message = $Event.FullFormattedMessage

#[VMware.Vim.Event].DeclaredProperties #for testing


$EntityEvents = [PSCustomObject]@{

NetEvent = $event.Net -ne $null
NotNetEvent = $event.Net -eq $null

DistributedVirtualSwitchEvent = $event.Dvs -ne $null
NotDistributedVirtualSwitchEvent = $event.Dvs -eq $null

DatacenterEvent = $event.Datacenter -ne $null
NotDatacenterEvent = $event.Datacenter -eq $null

DsEvent = $event.Ds -ne $null
NotDsEvent = $event.Ds -eq $null

ClusterEvent = $event.ComputeResource -ne $null
NotClusterEvent = $event.ComputeResource -eq $null

NotHostEvent = $event.Host -eq $null
HostEvent = $event.Host -ne $null

VmEvent = $event.Vm -ne $null
NotVmEvent = $event.Vm -eq $null

}

if($EntityEvents.HostEvent -and $EntityEvents.NotVmEvent){
$tempObj.Entity = $event.host.name
}elseif($EntityEvents.VmEvent){


try{
$Ipv4 = (Get-Vm -Name $event.VM.Name).ExtensionData.Guest.Ipaddress;
$tempObj.Entity = [System.Net.Dns]::GetHostByAddress($Ipv4).Hostname

}catch{


$tempObj.Entity = (Get-View -ViewType 'VirtualMachine' -Filter @{Name=$event.Vm.Name} -Property Guest).Guest.Hostname

}


}elseif($event.ObjectType -ne $null -and
$EntityEvents.DatacenterEvent -and
$EntityEvents.NotVmEvent ){


if($event.ObjectName -ne $null){$tempObj.Entity = $event.ObjectName}

}else{$tempObj.Entity = $global:DefaultVIServers.Name}

$EventOutput += $tempObj

}

$EventOutput | Ft -AutoSize

 

Is there a better way to do that?

Thank you!

[LucD]

You can check the type of the Event to see what it is.

$event.GetType().Name

If you look up the Event object in the API Reference, you will notice that there are a lot of Extended By events.
The above code should tell you what kind of event you are dealing with.

[ChrisROI]

Thank you Luc for your quick response.

Yes I alread found that information, but what can I do with this? Or in other words, how can I filter the correct Entity (target, shown in vCenter)? Something like if ($event -is [AlarmStatusChangedEvent]){ $tempObj.Entity = $event.Entity.Entity.Name} ? and How can I ensure, that I get all the Entites from all possible eventtypes that have that Property? Because I saw in some Eventtypes the Property ObjectName, not Entity   Thank you in advance

Output:

VmEmigratingEvent
DrsVmMigratedEvent
EventEx
TaskEvent
DrsVmMigratedEvent
EventEx
TaskEvent
AlarmStatusChangedEvent
AlarmStatusChangedEvent
AlarmStatusChangedEvent
VmEmigratingEvent
VmEmigratingEvent
DrsVmMigratedEvent
EventEx

[ChrisROI]

I tried this code for all possible Events to get information about the Properties:

 

$eventMgr = Get-View EventManager
$eventMgr.Description.EventInfo | %{

$_ | select *

}

Output:

Key : EventEx
Description : KMS Server Certificate will expire soon.
Category : warning
FormatOnDatacenter :
FormatOnComputeResource :
FormatOnHost :
FormatOnVm :
FullFormat : com.vmware.vc.vecs.KMSServerCertExpirationEvent|KMS Server Certificate '{subject}' expires on {expiryDate}
LongDescription

But I cant realy see here, if there is an Entity or Object Property.

[LucD]

The EventEx and ExtendedEvent objects are different from the "normal" Event object.
You have to understand that all these events were not introduced at the same time.
Some events were introduced in later vSphere versions, and since the standard Event couldn't fit all the info, new types of events, like EventEx and ExtendedEvent, were created.

You can have a look at my Events, Dear Boy, Events – Part 2 post to see how to extract that info from the EVentManager.
Similar to what you did.

In my Event-O-Matic post I tried provide more info on all these different types of events.

So if you want a common property Entity in your output, you will have to do a series of tests.
I wouldn't know how to do that otherwise.

[ChrisROI]

Thank you Luc.

I will have a look at your blog again.

I thought there is some way to filter the eventtypes, that are related to an inventory item (host, vm, datastore...) to show me that "target". By now, i know how to show vms and hosts by that $event.VM.Name and $event.Host.Name, but for the other ones I have to test and work with conditions and testing

Greetings