snapshot who created it

[Myersc]

I'm attempting to take a simplistic approach to my snapshot reporting by using the following script.  I would like to add one more header to indicate who created by extracting the information via Get-VIEvent.

How can I incorporate $snapevent = Get-VIEvent -Entity $snap.VM -Types Info -Finish $snap.Created -MaxSamples 1 | Where-Object {$_.FullFormattedMessage -imatch 'Task: Create virtual machine snapshot'}

into the below script?

connect-viserver -server localhost

$report = Get-VM | Get-Snapshot | where { $_.Created -lt (Get-Date).AddDays(-15)} | select VM, Name, Created, Creator

$emailFrom = "[e-mail]"

$emailTo = "[e-mail]"

$subject = "VM Snapshots older then 15 days"

$body = $report | Out-String

$smtpServer = "[e-mail]"

$smtp = new-object Net.Mail.SmtpClient($smtpServer)

$smtp.Send($emailFrom, $emailTo, $subject, $body)

disconnect-viserver -confirm:$false

Craig

[LucD]

Have a look at Alan's post called SnapReminder, more specifically the Get-SnapshotExtra function in there.

The function uses a TaskCollector to find the "creator" of the snapshot.

It looks for TaskEvent entries with a descriptionID of VirtualMachine.CreateSnapshot.

You could do the same with the Get-VIEvent cmdlet.

Something along these lines

$snapshot = Get-VM -Name MyVM | Get-SNapshot | Select -First 1

$event = Get-VIEvent -Start $snapshot.Created.AddMinutes(-1) -Finish $snapshot.Created.AddMinutes(1) |

where {$_ -is [VMware.Vim.TaskEvent] -and $_.Info.descriptionId -eq "VirtualMachine.createSnapshot"}

$event.Info.Reason.userName

[Myersc]

I seem to be missing one piece here that I can't place.  Right now it uses the first person it finds as the Snapcreator of all the snapshots.  What am I missing?

$event = Get-VIEvent -Start $snapshot.Created.AddMinutes(-1) -Finish $snapshot.Created.AddMinutes(1) | where {$_ -is [VMware.Vim.TaskEvent] -and $_.Info.descriptionId -eq "VirtualMachine.createSnapshot"}

$report = Get-VM | Get-Snapshot | select VM, Name, Created,@{N="Snapcreator";E={$event.Info.Reason.userName}}

$emailFrom = "[e-mail]"

$emailTo = "[e-mail]"

$subject = "VM Snapshots older then 15 days"

$body = $report | Out-String

$smtpServer = "[e-mail]"

$smtp = new-object Net.Mail.SmtpClient($smtpServer)

$smtp.Send($emailFrom, $emailTo, $subject, $body)

disconnect-viserver -confirm:$false

)

[LucD]

You are using the $snapshot variable to get the time span in which to look for the snapshot creation event, but you should have this inside a loop where you get the snapshots for each VM.

Something like this

$report = @()

Get-VM | Get-SNapshot | %{

    $event = Get-VIEvent -Start $_.Created.AddMinutes(-1) -Finish $snapshot.Created.AddMinutes(1) | where {$_ -is [VMware.Vim.TaskEvent] -and $_.Info.descriptionId -eq "VirtualMachine.createSnapshot"}

    $report += $_ | select @{N="VM";E={$_.Vm.Name}},Name,Created,@{N="Snapcreator";E={$event.Info.Reason.userName}}

}

$emailFrom = "[e-mail]"

$emailTo = "[e-mail]"

$subject = "VM Snapshots older then 15 days"

$body = $report | Out-String

$smtpServer = "[e-mail]"

$smtp = new-object Net.Mail.SmtpClient($smtpServer)

$smtp.Send($emailFrom, $emailTo, $subject, $body)

Note that you should also add an additional test to the Where-clause to make sure it is actually the correct snapshot creation event.

You can check the VM and the snapshot names.

[Myersc]

Other than changing the $snapshot which is no longer defined this worked perfect.  Thanks for the help.  Works like a charm now. 

$report = @()

Get-VM | Get-SNapshot | %{

    $event = Get-VIEvent -Start $_.Created.AddMinutes(-1) -Finish $_.Created.AddMinutes(1) | where {$_ -is [VMware.Vim.TaskEvent] -and $_.Info.descriptionId -eq "VirtualMachine.createSnapshot"}

    $report += $_ | select @{N="VM";E={$_.Vm.Name}},Name,Created,@{N="Snapcreator";E={$event.Info.Reason.userName}}

}

$emailFrom = "[e-mail]"

$emailTo = "[e-mail]"

$subject = "VM Snapshots older then 15 days"

$body = $report | Out-String

$smtpServer = "[e-mail]"

$smtp = new-object Net.Mail.SmtpClient($smtpServer)

$smtp.Send($emailFrom, $emailTo, $subject, $body)