Script – Get VMs created, deleted or modified on vCenter

powercli

A while back someone asked me if i could tell him who deleted a vm and when.

I was able to get the information but it took me quite some time digging in the events.

After this request I was asked to create a script that would send an email every day with the VMs that were created, deleted or modified.

So this is what I came up with:

Connect-VIServer localhost
$Yesterday = (Get-Date).AddDays(-1).ToString('MM-dd-yyyy')
$Yesterday2 = (Get-Date).AddDays(-2).ToString('MM-dd-yyyy')
Get-VIEvent -maxsamples 10000 -Start (Get-Date).AddDays(-1) |where {$_.Gettype().Name-eq "VmRemovedEvent" -or $_.Gettype().Name-eq "VmCreatedEvent" -or $_.Gettype().Name-eq "VmReconfiguredEvent"} |Sort CreatedTime -Descending |Select CreatedTime, UserName,FullformattedMessage | Export-Csv D:\Scripts\VMReport\$Yesterday.csv -NoTypeInformation
#defining file
$file = "D:\Scripts\VMReport\$Yesterday.csv"
$att = New-Object Net.Mail.Attachment($file)
$smtpServer = "smtpServerName.com"
$smtpFrom = "VMware Report <vmware_report@domain.com>"
$smtpTo = "e-mail address 1 <emailaddress1@domain.com>, e-mail address 2 <emailaddress2@domain.com>"
$messageSubject = "Changes on VMs"
$message = New-Object System.Net.Mail.MailMessage $smtpfrom, $smtpto
$message.Subject = $messageSubject
$message.IsBodyHTML = $true
$message.Body = "VMs created, deleted or modified on VCenter"
$message.Attachments.Add($att)
$smtp = New-Object Net.Mail.SmtpClient($smtpServer)
$smtp.Send($message)
Remove-Item D:\Scripts\VMReport\$Yesterday2.csv

Now the explanation

Get-VIEvent -maxsamples 10000 -Start (Get-Date).AddDays(-1) |where {$_.Gettype().Name-eq "VmRemovedEvent" -or $_.Gettype().Name-eq "VmCreatedEvent" -or $_.Gettype().Name-eq "VmReconfiguredEvent"} |Sort CreatedTime -Descending |Select CreatedTime, UserName,FullformattedMessage | Export-Csv D:\Scripts\VMReport\$Yesterday.csv -NoTypeInformation

Get-VIEvent from the vCenter from the day before where the event is equal to removed (VmRemovedEvent), created (VmCreatedEvent) or modified (VmReconfiguredEvent)VMs

The result is sorted by date and it’s exported to a csv file named with the date of a day before.

And this is it from VMware side.

The next part is to send the file by email  (normal powershell scripting)

$file = "D:\Scripts\VMReport\$Yesterday.csv"
$att = New-Object Net.Mail.Attachment($file)
$smtpServer = "smtpServerName.com"
$smtpFrom = "VMware Report <vmware_report@domain.com>"
$smtpTo = "e-mail address 1 <emailaddress1@domain.com>, e-mail address 2 <emailaddress2@domain.com>"
$messageSubject = "Changes on VMs"
$message = New-Object System.Net.Mail.MailMessage $smtpfrom, $smtpto
$message.Subject = $messageSubject
$message.IsBodyHTML = $true
$message.Body = "VMs created, deleted or modified on VCenter"
$message.Attachments.Add($att)
$smtp = New-Object Net.Mail.SmtpClient($smtpServer)
$smtp.Send($message)
Remove-Item D:\Scripts\VMReport\$Yesterday2.csv

In the end it removes the file from two days back.

I hope this helps you in some way.