Search vCenter server events using PowerCLI script

Search vCenter server events using PowerCLI script

Retrieves information about the events on a vSphere server

Syntax:

Get-VIEvent <vm_name> -MaxSamples([int]::MaxValue) | Where-Object {$_.FullFormattedMessage -like "<search content>"} |Select CreatedTime, UserName, FullFormattedMessage

Examples:

To search who renamed a virtual machine

Get-VIEvent Win2008 -MaxSamples([int]::MaxValue) | Where-Object {$_.FullFormattedMessage -like "* rename *"} |Select CreatedTime, UserName, FullFormattedMessage

To search for entries created by user "adminuser" in a virtual machine

Get-VIEvent Win2008 -MaxSamples([int]::MaxValue) | Where-Object {$_.UserName -like "adminuser"} |Select CreatedTime, UserName, FullFormattedMessage

To search for entries created in a particular date/time in a virtual machine

Get-VIEvent Win2008 -MaxSamples([int]::MaxValue) | Where-Object {$_.CreatedTime -like "* 9/11/2017 *"} |Select CreatedTime, UserName, FullFormattedMessage