VMware PowerCLI – Quick query to list VMs restarted in an HA event

I don’t practice my PowerShell scripting nearly enough day to day for it to really stick so when I see/use these quick little one-liners that are so useful, I can’t stop myself from posting them. 😉 ^{*Mainly so I can look them up later to use again.}

This example showed up at a client when one of our ESXi servers had purple screened and we wanted to quickly see what VMs on the host machine had been affected.  Almost immediately, HA (High Availability) had kicked in and restarted all the VMs on different hosts.  We used this opportunity to leverage the following PowerShell command to instantly query which machines had been restarted so we could easily spot check them for functionality.

Get-VIEvent -MaxSamples 100000 -Start (Get-Date).AddDays(-1) -Type Warning | Where {$_.FullFormattedMessage -match "restarted"} |select CreatedTime,FullFormattedMessage | sort CreatedTime –Descending

This single PowerShell line grabbed warning events from the past 24 hours and matched the word “restarted” in them and displayed in a nice list format.  With this list in hand, we could quickly start spot checking the VMs.

Here’s to hoping you don’t have to use this one!

Happy scripting!
–Carlo