Hello,
We are working on an automation project which is based on the Get-VIEvent cmdlet (vSphere Documentation Center).
Specifically we need to get events for changes which were made to virtual machines and host configuration during the previous day. The issue we are running into is sometimes the Get-VIEvent cmdlet command returns no events regarding certain virtual machines (we made the test changes to the day before).
We understand that events logs on monitored ESX server are being overwritten, but the problem is we don't know which exact event logs are being used when we are using the Get-VIEvent cmdlet and which event logs size \ retention policy we have to tweak. Googling and reviewing VMware API documentation gave me no answer.
During our research we have tried:
1. Reviewed this KB article: http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2032076
- Assumed that Get-VIEvent cmdlet uses hostd even log (based on the hostd event log description:
/var/log/hostd.log: Host management service logs, including virtual machine and host Task and Events, communication with the vSphere Client and vCenter Server vpxa agent, and SDK connections.)
2. Found this KB article set ESX event logs to persistent mode: http://pubs.vmware.com/vsphere-50/index.jsp?topic=%2Fcom.vmware.wssdk.pg.doc_50%2FPG_Ch15_Alarms.17.3.html
- made changes to the test VM
- wait 24 hours
- run Get-VIEvent cmdlet
- no events retuned
3. Tried to reproduce this issue by manually deleting the hostd event log on our ESX server:
- Made changes to the test VM
- Right after the changes we deleted the hostd event log
- run the Get-VIEvent cmdlet
- Get-VIEvent cmdlet returned events !!!
Based on these results we assumed that events are being stored somewhere else and the Get-VIEvent cmdlet uses other sources (database\event logs\memory?) and has nothing with hostd event log.
We also found this KB article (http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1004795) which says that we can enable hostd event log rotation, but we have not implemented that because of the results received with test 3 above (hostd was deleted but events were returnd by Get-VIEvent cmdlet) + one of my colleague (who has the same issue with Get-VIEvent cmdlet) tried that before and it didn’t help.
So, question we cannot answer is where the Get-VIEvent cmdlet pulls events from? Once we found the source the Get-VIEvent cmdlet uses, we will work on what we can do to increase its capacity.
We do these test on ESX 5.1
The Get-VIEvent cmdlet command we used: Get-VIEvent -Entity VM_name -Start (Get-Date).AddDays(-1)
Any help, would be appreciated.
Thanks,
Paul