Use PowerCLI to find which VMs restarted after a HA protected host failure

One of my hosts in a HA protected cluster crashed and I usually use vRealize Log Insight to retrieve a list of VMs which have been restarted on other hosts but in this instance, the host in question didn’t seem to have been logging correctly and I wasn’t getting any results back.

I found a lot of blogs and forum posts for queries being ran on vSphere 5.0 and 5.5 PowerCLI queries which no longer work but here are the details of what worked perfectly on vSphere 7.0 for me:-

Open PowerCLI > Connect to the vCenter where your host resides using…

Connect-VIServer [vCenter Name]

Once connected to your vCenter, run the following query…

Get-VIEvent -MaxSamples 100000 -Start (Get-Date).AddDays(-1) -Type Warning | Where {$_.FullFormattedMessage -match “restarted”} |select CreatedTime,FullFormattedMessage | sort CreatedTime –Descending

This will return any VMs restarted by HA during the last 24 hours but you can change the number after AddDays to increase the search parameter to suit your needs.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s