Script – Get VMs created, deleted or modified on vCenter

A while back someone asked me if i could tell him who deleted a vm and when.

I was able to get the information but it took me quite some time digging in the events.

After this request I was asked to create a script that would send an email every day with the VMs that were created, deleted or modified.

So this is what I came up with:

[sourcecode language=”bash”]
Connect-VIServer localhost
$Yesterday = (Get-Date).AddDays(-1).ToString(‘MM-dd-yyyy’)
$Yesterday2 = (Get-Date).AddDays(-2).ToString(‘MM-dd-yyyy’)
Get-VIEvent -maxsamples 10000 -Start (Get-Date).AddDays(-1) |where {$_.Gettype().Name-eq "VmRemovedEvent" -or $_.Gettype().Name-eq "VmCreatedEvent" -or $_.Gettype().Name-eq "VmReconfiguredEvent"} |Sort CreatedTime -Descending |Select CreatedTime, UserName,FullformattedMessage | Export-Csv D:\Scripts\VMReport\$Yesterday.csv -NoTypeInformation
#defining file
$file = "D:\Scripts\VMReport\$Yesterday.csv"
$att = New-Object Net.Mail.Attachment($file)
$smtpServer = "smtpServerName.com"
$smtpFrom = "VMware Report <vmware_report@domain.com>"
$smtpTo = "e-mail address 1 <emailaddress1@domain.com>, e-mail address 2 <emailaddress2@domain.com>"
$messageSubject = "Changes on VMs"
$message = New-Object System.Net.Mail.MailMessage $smtpfrom, $smtpto
$message.Subject = $messageSubject
$message.IsBodyHTML = $true
$message.Body = "VMs created, deleted or modified on VCenter"
$message.Attachments.Add($att)
$smtp = New-Object Net.Mail.SmtpClient($smtpServer)
$smtp.Send($message)
Remove-Item D:\Scripts\VMReport\$Yesterday2.csv
[/sourcecode]

Now the explanation

[sourcecode language=”bash”]
Get-VIEvent -maxsamples 10000 -Start (Get-Date).AddDays(-1) |where {$_.Gettype().Name-eq "VmRemovedEvent" -or $_.Gettype().Name-eq "VmCreatedEvent" -or $_.Gettype().Name-eq "VmReconfiguredEvent"} |Sort CreatedTime -Descending |Select CreatedTime, UserName,FullformattedMessage | Export-Csv D:\Scripts\VMReport\$Yesterday.csv -NoTypeInformation
[/sourcecode]

Get-VIEvent from the vCenter from the day before where the event is equal to removed (VmRemovedEvent), created (VmCreatedEvent) or modified (VmReconfiguredEvent)VMs

The result is sorted by date and it’s exported to a csv file named with the date of a day before.

And this is it from VMware side.

The next part is to send the file by email  (normal powershell scripting)

[sourcecode language=”bash”]
$file = "D:\Scripts\VMReport\$Yesterday.csv"
$att = New-Object Net.Mail.Attachment($file)
$smtpServer = "smtpServerName.com"
$smtpFrom = "VMware Report <vmware_report@domain.com>"
$smtpTo = "e-mail address 1 <emailaddress1@domain.com>, e-mail address 2 <emailaddress2@domain.com>"
$messageSubject = "Changes on VMs"
$message = New-Object System.Net.Mail.MailMessage $smtpfrom, $smtpto
$message.Subject = $messageSubject
$message.IsBodyHTML = $true
$message.Body = "VMs created, deleted or modified on VCenter"
$message.Attachments.Add($att)
$smtp = New-Object Net.Mail.SmtpClient($smtpServer)
$smtp.Send($message)
Remove-Item D:\Scripts\VMReport\$Yesterday2.csv
[/sourcecode]

In the end it removes the file from two days back.

I hope this helps you in some way.