Get Details About VM Task Reconfigure Events – PowerCLI

When troubleshooting an issue, many times I’ll see a “Reconfigure virtual machine” task in the VM Event log in vCenter. However, there is very little information as to what was actually done.


Luckily, you can get some of this information from PowerCLI by querying the event manager. Make sure you have PowerCLI loaded and are connected to vCenter to start

I’m going to use a test VM here which I’ve named “test”. I’m also going to specify that I want to look back 30 days into the event manager

$vmObj = Get-VM -Name "test"
$daysBack = 30

Now I just need to setup the filter to look only for events that have to do with the VM I’m specifying as well as the time frame I’m specifying. I’m using the VMware.Vim.EventFilterSpecByEntity to target the VM and the VMware.Vim.EventFilterSpecByTime to target my time frame.

$dateCurrent = Get-Date
$si = get-view ServiceInstance
$em = get-view $si.Content.EventManager
$EventFilterSpec = New-Object VMware.Vim.EventFilterSpec

#only target reconfiguration events
$EventFilterSpec.Type = "VmReconfiguredEvent"

#only target events on the specified VM
$EventFilterSpec.Entity = New-Object VMware.Vim.EventFilterSpecByEntity
$EventFilterSpec.Entity.Entity = ($vmObj | get-view).MoRef

#only query back to the specified number of days
$EventFilterSpec.Time = New-Object VMware.Vim.EventFilterSpecByTime
$EventFilterSpec.Time.BeginTime = $dateCurrent.adddays(-$daysBack)
$EventFilterSpec.Time.EndTime = $dateCurrent

Now to run the query

#run query
$evts = $em.QueryEvents($EventFilterSpec)

You can see that I’ve gotten back the 5 events seen in my screenshot above from vCenter


Since I’m troubleshooting, I don’t really care about every little event. Things like updating the notes or annotations on a VM will show up as events here. I’d rather just look at events where devices on the VM have been changed, which you can see is only 4 events

$deviceChangeEvts = $evts | ?{$_.ConfigSpec.DeviceChange}


Now I just want to look at a couple details about each change operation. So I’m going to select the device type, the change type, and the file operation in case it was a virtual disk event

$deviceChangeEvts | %{$_.ConfigSpec.DeviceChange} | select Operation,FileOperation,Device | ft -AutoSize


You may notice in the output above that there are 5 operations even though there are only 4 events I’m looking at. This is because a single event may have multiple operations. In this example, the first time I edited the VM settings I added a hard drive AND a vNIC at the same time, which you can see if I look only at that first event’s details


Now maybe I want some details on the hard drive that was added, like how big it is. You can drill into this info as well. Here I’m looping through each device changed and outputting additional information about the devices. You can see the capacity of that added drive was 10485760KB or 10GB


A couple things I’ve run into here. Changing the number of cvPU or the amount of vRAM on a VM doesn’t show up as a device change. So if you care about that and filter out anything that’s not a device change you’ll miss it.

Also, if you look at a change event I wasn’t able to find a way to see what the value was before the change. For example, I grew the size of a virtual hard disk from 40GB to 100GB. I can see the change event and the size of the drive as 100GB, but I don’t think it retains the old value of 40GB anywhere. So this isn’t going to help you get back to the original settings. You will need to do more investigation elsewhere for that ability

Bookmark the permalink.

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>