PLEASE help with GET-VIEVENT

[Almero]

Hi Guys , been breaking my head on this , please help .

Why does get-ViEVENT sometimes return nothing , even when you know there should be something within the last , lets say 1000 samples ?

I need to audit many companies for Snapshots made, getting most of info is easy , Get-VM | Get-Snaphot , and then select what you need .

BUT who took that snapshot ? That's where I get stuck . Not sure if I need to probe the actual vCenter DB to get this .

Tried -Start , -MaxSamples , Where statements with -like , some VMs just return nothing . Tested on my site with 5.5 , and another on 6.0 .

Here are some of my attempts . Most only catch some "createdby" data .

I would also except a link to a full working script , need Date created , size , and Who made the snapshot .

#$MyVMsnaps = (Get-VM | Get-Snapshot)

 

$MyVMs = (Get-VM)

  

$Report = @()

Foreach ($VM in $MyVMs){

   $MyEventsPerVM = Get-VIEvent -Entity $vm -type info -MaxSamples 1000 | Where { $_.FullFormattedMessage.contains("Create virtual machine snapshot")}

   $Report += [pscustomobject][ordered] @{

   'VirtualMachine' = $VM.name

   'SnapshotCount' = (Get-Snapshot $VM).Count

   # Insert Foreach snapshot here

   'CreatedBy' = $MyEventsPerVM.username

   'Date' = $MyEventsPerVM.CreatedTime

   'Snapshot Size in GB' = $SnapsSize = Get-Snapshot $VM | % {"$($_.SizeGB)"} # () dO this first )

$Report | Out-GridView 

[LucD]

Would Alan's Snapreminder script help?

[Almero]

Thank you LucD , will give it a try .

HOWEVER , it appears this is NOT a PowerShell challenge , but a vCenter one  . I dug a bit deeper , even got my DBA to help .

vCenter by default retains tasks and events for 30 days only , so that's probably why my get-Vievent cannot see who took it, a year ago .

Strangely , sometimes , it does come back with who created it , even a year ago . but looks like a the norm will be , no further back than what your VC is configured for .

Other metrics gathered by normal cmdlets , like get-snapshot | select sizeGB can go back infinitely .

I will still try Alans one and advise .

[LucD]

The default Task and Events retention period is slightly complex.

Have a look at KB2117550