PowerCLI Cmdlet Review: Get-VIEvent

The PowerCLI cmdlet I’ve found myself using a lot lately is Get-VIEvent. It allows you to collect event information in a VCenter environment. This is super useful for quickly filtering through logs when diagnosing an issue or for automating VM deployments.

Collecting VCenter Events

To connect to the VCenter instance, open up PowerCLI and type in the following syntax to connect to VCenter. Input the proper credentials if prompted:

Connect-VIserver –Server VC01

Use Connect-VIServer to connect to an ESXi host or VCenter environment.

Filtering through VCenter event logs in PowerCLI is simple and quick. In this example we’ll get the last 10 errors that have occurred in our VCenter environment. To do this we’ll use the –Types parameter to specify that we want only “error” event types to be displayed along with the –Maxsamples parameter to specify that we only want to view that last 10 events of this type. The syntax looks like the following:

Get-VIevent –Types error –Maxsamples 10

Use -types to filter by error type and -maxsamples to specify how many events you want.

You can see from the example above the information returned can be a lot to scroll through, not very GUI friendly. There is another way to view this information that will have your eyes and mouse wheel thanking you. By piping our syntax above to Out-GridView, we can have the data returned in a  format that’s easier to read and sort through:

Get-VIevent –Types error –Maxsamples 10 | Out-GridView

Use Out-GridView to see data in a more manageable format.

A new window appears with the collected data. Now we get columns that are movable and expandable. We can even sort the data by each specified column:

Click on a column to sort that data by that column.

What if we wanted to sort information by a specific date range? Let’s say that 3 days during the week users have been experiencing slowness at random times throughout the day. Get-VIEvent can help us out with our search. We simply use the -Start and –Finish parameters to retrieve either a specific date range or a date to start looking at occurring events. These two parameters follow the “dd/mm/yyyy” or “mm/dd/yyyy” formats. Since we want to look back at 3 days specifically, let’s look through April 6 to April 8 of 2016 as a test (This lab has been around for awhile). The syntax is going to look like this:

Get-VIevent –Start 4/6/2016 –Finish 4/8/2016 | Out-Gridview

Use -Start and -Finish to specify a date range.

Now we get a nice, easy to read, view of all the events that have occurred in our VCenter environment from 4/6/2016 – 4/8/2016:

Sorting by CreatedTime will arrange the events according to the time that they occurred.

We could even take it one step further from here to quickly filter our current information even further. We can click on Add Criteria to create quick filters:

Let’s say we wanted to search for events that have triggered an alarm up to the “Red” threshold. We’ll choose the FullFormattedMessage property and select the Contains operator and type in the value Red:

In Out-GridView, information can be filtered quickly within seconds.

We can see that the host ESX03 has been getting high memory alerts in the morning. This can really save an IT Admin time instead of sorting through logs via the clunky VSphere client.

Also, we can narrow down our initial search to individual objects such as resource pools, VMs, and Hosts instead of the entire VCenter environment by using the –Entity parameter. Let’s say we wanted to look at all events in the last 7 days on the VM “Win7Test”:

Get-VIevent –Entity Win7Test –Start 4/3/2016 | Out-GridView

Use -Entity if you want to collect logs for a specific object in your VMware environment.

We now get all events related to this VM:

Filter your search by VMware object and pipe the results to Out-GridView to manage them easily.

Using Get-VIevent in VM Deployment Scripts

Not only is Get-VIevent a great cmdlet to use for quickly looking through event logs, it is also an amazing tool to use for automation. Let’s say you are writing a script to deploy some VMs and configure them to company standards (install backup agent, monitoring tools, configure compliance requirements, etc..). One of the first steps in the script might be to deploy the VM from the template and specify the OS customization spec that you’ve created for this deployment. However, after the customization job has finished we need to perform some more tasks. The trick is, how do we tell our script to know when the customization has finished? Using start-sleep and making the script pause for a certain amount of time till the customization is estimated to be finished is not a good way to go about it. We want our script to be intelligent enough to know for sure that the customization job is complete and was successful. An easy and simple way to do this would be to utilize Get-VIevent in our script along with a while loop.  The loop continuously checks the logs to ensure that the customization is complete and that it completed successfully. It would look like the following snippet:

# Wait until OS Customization has completed or failed

while($true){

    $CustomizeSuccess = Get-VIEvent -Entity $VMname | Where-Object {$_.GetType().Name -eq "CustomizationSucceded"}

    $CustomizeFail= Get-VIEvent -Entity $VMname | Where-Object {$_.GetType().Name -eq "CustomizationFailed"}


    If ($CustomizeSuccess){

         Write-verbose -Message "OS Customization has completed on $VMname"

            break

        }

    If ($CustomizeFail){

         Write-verbose -Message "OS Customization failed on $VMname"

            break

         }

    Start-Sleep -Seconds 5

}

This provides a much more intelligent script and allows for more flexibility. Get-VIEvent is a very useful cmdlet and I hope you’ll find it as useful as I have over the years!

Have you tried Get-VIEvent?

Tell me your thoughts. What are some other ways that you’ve used this cmdlet? Let us know in the comments section below!

[the_ad id=”4738″][thrive_leads id=’18673′]