Hi,

it is really painful to search for events in vSphere’s vCenter.

PowerCLi provides the Get-VIEvent command-let for such tasks

PS D:\> Get-VIEvent

Note: When a filter is not given Get-VIEvent retrieves only the 100 Events! Only the Start and Finish parameter together disables the 100 entry limit! Another option is to set the MaxSamples parameter.

Some filters can reduce the run time of the command.

This gets all events within yesterday and the day before yesterday.

PS D:\> Get-VIEvent -Start ((Get-date).AddDays(-2)) -Finish ((Get-date).AddDays(-1))

Filter by type. Valid types are

Info
Warning
Error


PS D:\> Get-VIEvent -Types Error

Get the last 100 entries

PS D:\>Get-VIEvent -MaxSamples 100

In combination. The last 100 errors

PS D:\>Get-VIEvent -MaxSamples 100 -Types Error

Get the events for a specific VM

PS D:\> Get-VIEvent -Entity (get-vm "MyVM*")

Or for an ESXi host

PS D:\> Get-VIEvent -Entity (get-vmhost myHost.myDomain.org)

Search for an event in the event description. Get all events by setting a filter and search the description field. The powershell like operator supports the wildcards * and ? and is case insensitive. Due to performance issues. Save the events in a variable and then apply the “like” filter.

PS D:\> $aAllEventsTimeRange=Get-VIEvent -Start (Get-Date 31.01.2022) -Finish (Get-Date 01.02.2022)
PS D:\> $aAllEventsTimeRange | ?{$_.FullFormattedMessage -like "*delete*" }
PS D:\> $aAllEventsTimeRange | ?{$_.UserName -like "*MyLogin" }

All power

Michael