Powered Off VM time (vcenter events required?)

[Trammell]

If a virtual is powered down from within the virtual i.e. Shutdown by logged on user or remote shutdown. That there is no event logged in vcenter? Making powercli powered off reports not accurate?

This is my understanding and I wanted to confirm.

Thank You

[LucD]

No, even when shutdown from within the guest OS, there will be an event.

I just checked with

Get-VIEvent -MaxSamples ([int]::MaxValue) -Start (Get-Date).AddMinutes(-10) |

where { $_ -is [VMware.Vim.VmPoweredOffEvent] }

---------------------------------------------------------------------------------------------------------

Was it helpful? Let us know by completing this short survey here.

[Trammell]

Ok, so thank you for clearing that up. Seem's our event logs are only stored 60 days. With the events being pruned, the powered off vm's which are showing blank have been off for 60+ days. Is this a correct assumption? VIEvents are needed in order to get time powered off.

[Trammell]

$Report = @()

#############################################################################

# gather information on powered off virtuals

$VMs = Get-VM | Where {$_.PowerState -eq "PoweredOff"} 

$Datastores = Get-Datastore | Select Name, Id 

$PowerOffEvents = Get-VIEvent -Entity $VMs -MaxSamples ([int]::MaxValue) | where {$_ -is [VMware.Vim.VmPoweredOffEvent]} | Group-Object -Property {$_.Vm.Name} 

 

foreach ($VM in $VMs) { 

    $lastPO = ($PowerOffEvents | Where { $_.Group[0].Vm.Vm -eq $VM.Id }).Group | Sort-Object -Property CreatedTime -Descending | Select -First 1 

 

    $row = "" | select VMName,Powerstate,OS,Host,Cluster,Datastore,NumCPU,MemMb,DiskGb,PoweredOffTime,PoweredOffBy,@{n='Notes';e={$_.notes -join ", "}}

    $row.VMName = $vm.Name 

    $row.Powerstate = $vm.Powerstate 

    $row.OS = $vm.Guest.OSFullName 

    $row.Host = $vm.VMHost.name 

    $row.Cluster = $vm.VMHost.Parent.Name 

    $row.Datastore = $Datastores | Where{$_.Id -eq ($vm.DatastoreIdList | select -First 1)} | Select -ExpandProperty Name 

    $row.NumCPU = $vm.NumCPU 

    $row.MemMb = $vm.MemoryMB 

    $row.DiskGb = Get-HardDisk -VM $vm | Measure-Object -Property CapacityGB -Sum | select -ExpandProperty Sum 

    $row.PoweredOffTime = $lastPO.CreatedTime 

    $row.PoweredOffBy   = $lastPO.UserName

    $row.Notes = $vm.Notes -join "`r`n" | Out-String -Stream

    $report += $row 

} 

# Output to screen 

$report | Sort Host | Select VMName, Cluster, Host, NumCPU, MemMb, @{N='DiskGb';E={[math]::Round($_.DiskGb,2)}}, PoweredOffTime, PoweredOffBy | ft -a 

[LucD]

That sounds the most logical explanation, yes.

If they are kept for 60 days, you could for example collect all related events every 30 days, store them externally and run your report from there.

[Trammell]

If you have any tips or pointers (links?) to how to do that, I would be grateful.

Thanks again sir

[LucD]

Well, you just run the Get-VIEvent for the last 30 days, collect the events you want to keep, and store the properties from those events in an external file.

For example, this collects all power on/power off events for VMs, and stores the timestamp, the user and a bit more in an external file.
You can add properties as you like.

The file is a CSV, but you can send the result to whatever file you want.

Get-VIEvent -MaxSamples ([int]::MaxValue) -Start (Get-Date).AddDays(-30) |

Where-Object { $_ -is [VMware.Vim.VmPoweredOnEvent] -or $_ -is [VMware.Vim.VmPoweredOffEvent] } |

ForEach-Object -Process {

   New-Object -TypeName PSObject -Property @{

   CreatedTime = $_.CreatedTime

   Event = $_.GetType().Name

   VM = $_.Vm.Name

   User = $_.UserName

   VMhost = $_.Host.Name

   Message = $_.FullFormattedMessage

   }

} | Export-Csv -Path .\vmpower.csv -NoTypeInformation -UseCulture -Append

[ehsanijavad]

Hi LucD

First of thanks for your infos and scripts.

a question about VMware.Vim.VmPoweredOnEvent: where and how do you find something like this?

Thanks in advance for your reply.

Regards

 

Jawad

[LucD]

In the API Reference under Data Object Types, start with Event, and under Extended By you'll find all derived events.
Note that this is a nested structure.

An alternative is to use my Event-O-Matic

[ehsanijavad]

Thank you so much LucD.