One of my hosts in a HA protected cluster crashed and I usually use vRealize Log Insight to retrieve a list of VMs which have been restarted on other hosts but in this instance, the host in question didn’t seem to have been logging correctly and I wasn’t getting any results back.

I found a lot of blogs and forum posts for queries being ran on vSphere 5.0 and 5.5 PowerCLI queries which no longer work but here are the details of what worked perfectly on vSphere 7.0 for me:-

Open PowerCLI > Connect to the vCenter where your host resides using…

Connect-VIServer [vCenter Name]

Once connected to your vCenter, run the following query…

Get-VIEvent -MaxSamples 100000 -Start (Get-Date).AddDays(-1) -Type Warning | Where {$_.FullFormattedMessage -match “restarted”} |select CreatedTime,FullFormattedMessage | sort CreatedTime –Descending

This will return any VMs restarted by HA during the last 24 hours but you can change the number after AddDays to increase the search parameter to suit your needs.