Which VMs restarted after a vSphere HA event?
I experienced a vSphere HA event where VMs restarted on other hosts and I was requested by management to confirm which VMs had restarted. Details are stored within vCenter events, but trawling through those manually for multiple VMs would be pretty tedious. Enter of course, PowerCLI. The Get-VIEvent cmdlet enables you to search through the events, but to a certain extent it kind of helps if you know what you are looking for since there is so much information to look through.
In the PowerCLI Book, we include a function, Get-VIEventType to return the different type of events that are available. By using this function we can search for an event that would match HA restarts.
Get-VIEventType | Where-Object {$\_.Description -like '\*restarted\*'} | Select-Object Name,Description
So to find these events when can now run a query and filter out only those that match the VmRestartedOnAlternateHostEvent. In the initial Get-VIEvent query we can also reduce the scope of the search by using -Type Info since these events are not recorded as Warnings or Errors.
Get-VIEvent -start (Get-Date).adddays(-1) -MaxSamples 5000 -Type Info | Where-Object {$\_.gettype().Name -eq 'VmRestartedOnAlternateHostEvent'} | Select-Object @{N='VM';E={($\_ | Select -ExpandProperty VM).Name}},@{N='Host';E={($\_ | Select -ExpandProperty SourceHost).Name}},CreatedTime
Update:
After putting this post together I noticed (after the report came through this morning) that this check is also included as part of vCheck, but implemented slightly differently. As always, there’s usually more than one way to get to the same end result.
$Date = Get-Date $HAVMrestartold =5 Get-VIEvent -maxsamples 100000 -Start ($Date).AddDays(-$HAVMrestartold) -type info | Where {$\_.FullFormattedMessage -match 'was restarted'} |select CreatedTime,FullFormattedMessage |sort CreatedTime -Descending
Update 2:
While testing out this post on vSphere 5 (the above was all vSphere 4.1) I discovered that there had been a few changes. Firstly, there are now two types listed
Get-VIEventType | Where-Object {$\_.Description -like '\*restarted\*'} | Select-Object Name,Description
Some research led to the discovery that the VmRestartedonAlternateHostEvent was deprecated in vSphere 5.
Consequently, the below no longer produced any results:
Get-VIEvent -start (Get-Date).adddays(-1) -MaxSamples 5000 -Type Info | Where-Object {$\_.gettype().Name -eq 'VmRestartedOnAlternateHostEvent'} | Select-Object @{N='VM';E={($\_ | Select -ExpandProperty VM).Name}},@{N='Host';E={($\_ | Select -ExpandProperty SourceHost).Name}},CreatedTime
It needed to be modified to:
Get-VIEvent -start (Get-Date).adddays(-1) -MaxSamples 5000 | Where-Object {$\_.eventtypeid -eq "com.vmware.vc.ha.VmRestartedByHAEvent"} | Select ObjectName,CreatedTime
Also the vCheck method no longer worked:
$Date = Get-Date $HAVMrestartold =5 Get-VIEvent -maxsamples 100000 -Start ($Date).AddDays(-$HAVMrestartold) -type info | Where {$\_.FullFormattedMessage -match 'was restarted'} |select CreatedTime,FullFormattedMessage |sort CreatedTime -Descending
and needed to be modified to the below since the text changed slightly and it was now also a warning event:
$Date = Get-Date $HAVMrestartold =5 Get-VIEvent -maxsamples 100000 -Start ($Date).AddDays(-$HAVMrestartold) -type warning | Where {$\_.FullFormattedMessage -match 'restarted'} |select CreatedTime,FullFormattedMessage |sort CreatedTime -Descending
