PowerCLI: One-liners last 10 VMs created and removed

I was asked if it was easy enough to get a list of the last 10 VMs created in a virtual Infrastructure, the answer is yes, its a one-liner !

To list the last 10 VMs created, cloned or imported use the following:

Get-VIEvent -maxsamples 10000 |where {$_.Gettype().Name-eq "VmCreatedEvent" -or $_.Gettype().Name-eq "VmBeingClonedEvent" -or $_.Gettype().Name-eq "VmBeingDeployedEvent"} |Sort CreatedTime -Descending |Select CreatedTime, UserName,FullformattedMessage -First 10


Or if you would like to get the last 5 VMs removed from your VI use the following:

Get-VIEvent -maxsamples 10000 | where {$_.Gettype().Name -eq "VmRemovedEvent"} | Sort CreatedTime -Descending | Select CreatedTime, UserName, FullformattedMessage -First 19

As requested, here is how you can get a list of the VM’s created over the last 14 days:

Get-VIEvent -maxsamples 10000 -Start (Get-Date).AddDays(-14) | where {$_.Gettype().Name-eq "VmCreatedEvent" -or $_.Gettype().Name-eq "VmBeingClonedEvent" -or $_.Gettype().Name-eq "VmBeingDeployedEvent"} |Sort CreatedTime -Descending |Select CreatedTime, UserName,FullformattedMessage

And a list of the VMs removed over the last 14 days:

Get-VIEvent -maxsamples 10000 -Start (Get-Date).AddDays(-14) |where {$_.Gettype().Name-eq "VmRemovedEvent"} |Sort CreatedTime -Descending |Select CreatedTime, UserName,FullformattedMessage



Alan Renouf has a role of Automation Frameworks Product Manager at VMware responsible for providing the architects and operators of the cloud infrastructure with the toolkits/frameworks and command-line interfaces they require to build a fully automated software-defined datacenter. Alan is a frequent blogger at http://blogs.vmware.com/vipowershell and has a personal blog at http://virtu-al.net. You can follow Alan on twitter as @alanrenouf.

You may also like...

18 Responses

  1. Neil says:

    Got exactly the same scripts from the ‘VMware Community PowerPack’ for PowerGUI but got no results. Increased the “-maxsamples 10000″ value to 1000000 and got the results back. Yes the script took longer but got the information I needed!

  2. Hi Glenn, I was just trying your script and it didn’t bring up and results – any idea ?

  3. Ravi says:

    Do we have any chance to collect which we have removed the vm’s from VCenter inventory through powercli ?

  4. CCD says:

    Hi Alan,

    Suppose I want to run this query for specific Cluster in my DC , in that case how can I do this ..

  5. Pete says:

    I don’t believe that this takes into account VMs that are being removed from inventory vs VMs that are truly deleted from disk. Any ideas how I could differentiate these?

  6. Sazzy says:

    When I executed this command…it executes successfully without any error but I doesn’t show the result even I tried exporting it but csv file was blank. Any help here…

  7. Ben Liebowitz says:

    How can I modify this to get more than 14 days? I’ve tried increasing the # from 14 to 120 to get the last 4 months but it isn’t returning the required info.

    • Chris King says:

      It is likely that the maxsamples is not enough to find the events you seek. I had to go to 100000 to get the last 10 vms created. Even using the -types info did not seem to help as most events seem to be info type.

  8. Hemant Patel says:

    This is really a great script. Actually to test i entered 365 days report for VM creation but it only give me 4 VM’s created. So my question is IS it depend on vCenter server database from where it get the events. What changes i have to do in my vCenter server for correct reporting through this script?

    Hemant Patel

  9. Justin says:

    The output command doesnt output anything… not sure why.

    Is there a way to output this to HTML? or a CSV?

  10. twodeer says:

    command(s) > \path\to\file.name

  11. Angus says:

    How can I output the results to a text file?


  12. Virtu-Al says:

    This is one of the things included in my Daily Report script but I have also altered the post above to show how to do this.

  13. vuong says:

    Can we modify the script to show ALL VMs built in last time period given?

  14. Virtu-Al says:

    @Glenn Sizemore
    Great idea with the regex, didnt think of that. Thanks for the comment. Love your blog.

  15. Very cool, I really need to go back and look at all the new cmdlets. Half the stuff I still do with Get-View have real cmdlets now! I would suggest using the -match operator… Slightly faster and easier to read.

    Get-VIEvent -maxsamples 10000 |
    where-Object {$_.Gettype().Name -match “(VmCreatedEvent|VmBeingClonedEvent|VmBeingDeployedEvent)“} |
    Sort-object CreatedTime -Descending |
    Select-Object CreatedTime, UserName, FullformattedMessage -First 10


  1. April 17, 2013

    [...]  our decided rollback point in time. I used the scripts provided by Alan Renouf which can be found here. The PowerCLI script to list deployed virtual machines (change the red text to your specific [...]

Leave a Reply

%d bloggers like this: