PowerCLI: One-liners last 10 VMs created and removed

I was asked if it was easy enough to get a list of the last 10 VMs created in a virtual Infrastructure, the answer is yes, its a one-liner !

To list the last 10 VMs created, cloned or imported use the following:

Get-VIEvent -maxsamples 10000 |where {$_.Gettype().Name-eq "VmCreatedEvent" -or $_.Gettype().Name-eq "VmBeingClonedEvent" -or $_.Gettype().Name-eq "VmBeingDeployedEvent"} |Sort CreatedTime -Descending |Select CreatedTime, UserName,FullformattedMessage -First 10


Or if you would like to get the last 5 VMs removed from your VI use the following:

Get-VIEvent -maxsamples 10000 | where {$_.Gettype().Name -eq "VmRemovedEvent"} | Sort CreatedTime -Descending | Select CreatedTime, UserName, FullformattedMessage -First 19

As requested, here is how you can get a list of the VM’s created over the last 14 days:

Get-VIEvent -maxsamples 10000 -Start (Get-Date).AddDays(14) | where {$_.Gettype().Name-eq "VmCreatedEvent" -or $_.Gettype().Name-eq "VmBeingClonedEvent" -or $_.Gettype().Name-eq "VmBeingDeployedEvent"} |Sort CreatedTime -Descending |Select CreatedTime, UserName,FullformattedMessage

And a list of the VMs removed over the last 14 days:

Get-VIEvent -maxsamples 10000 -Start (Get-Date).AddDays(14) |where {$_.Gettype().Name-eq "VmRemovedEvent"} |Sort CreatedTime -Descending |Select CreatedTime, UserName,FullformattedMessage

19 thoughts on “PowerCLI: One-liners last 10 VMs created and removed”

  1. Hi Alan,

    Can I use the same script if i want to monitor total deployment time VM take like start time and end time. So i can monitor VM deployment performance along with the VM created list daily.
    Thanks in advance.
    Hemant Patel

  2. Got exactly the same scripts from the ‘VMware Community PowerPack’ for PowerGUI but got no results. Increased the “-maxsamples 10000” value to 1000000 and got the results back. Yes the script took longer but got the information I needed!

  3. Alan,
    I don’t believe that this takes into account VMs that are being removed from inventory vs VMs that are truly deleted from disk. Any ideas how I could differentiate these?

  4. When I executed this command…it executes successfully without any error but I doesn’t show the result even I tried exporting it but csv file was blank. Any help here…

  5. How can I modify this to get more than 14 days? I’ve tried increasing the # from 14 to 120 to get the last 4 months but it isn’t returning the required info.

    1. It is likely that the maxsamples is not enough to find the events you seek. I had to go to 100000 to get the last 10 vms created. Even using the -types info did not seem to help as most events seem to be info type.

  6. Hi,
    This is really a great script. Actually to test i entered 365 days report for VM creation but it only give me 4 VM’s created. So my question is IS it depend on vCenter server database from where it get the events. What changes i have to do in my vCenter server for correct reporting through this script?

    Hemant Patel

  7. Very cool, I really need to go back and look at all the new cmdlets. Half the stuff I still do with Get-View have real cmdlets now! I would suggest using the -match operator… Slightly faster and easier to read.

    Get-VIEvent -maxsamples 10000 |
    where-Object {$_.Gettype().Name -match “(VmCreatedEvent|VmBeingClonedEvent|VmBeingDeployedEvent)“} |
    Sort-object CreatedTime -Descending |
    Select-Object CreatedTime, UserName, FullformattedMessage -First 10


Leave a Reply