Visitors

Who created these VM snapshots???

I am sure you have been in a situation where there are a lot of old, unidentifiable virtual machine snapshots and no one takes responsibility for creating them. How would you deal with all these “pre install”, “upgrade” or any other meaningless snapshot names without description?

Well, it is easy to find out when snapshot was taken ( Get-VM | Get-Snapshot | Select-Object VM, Name, SizeMB, Created ) but how to identify, name and shame users who created them?

Depending on vCenter Event database retention policy, the username might not be available – the Create VM snapshot event has already been purged.
Check the Database Retention Policy configuration: Administration / vCenter Server Settings / Database Retention Policy / Tasks retained for X days, Events retained for X days.

Here is the script that gets a list of virtual machine snapshots and users who created them:

#
foreach ($snap in Get-VM | Get-Snapshot)
{$snapevent = Get-VIEvent -Entity $snap.VM -Types Info -Finish $snap.Created -MaxSamples 1 | Where-Object {$_.FullFormattedMessage -imatch 'Task: Create virtual machine snapshot'}
if ($snapevent -ne $null){Write-Host ( "VM: "+ $snap.VM + ". Snapshot '" + $snap + "' created on " + $snap.Created.DateTime + " by " + $snapevent.UserName +".")}
else {Write-Host ("VM: "+ $snap.VM + ". Snapshot '" + $snap + "' created on " + $snap.Created.DateTime + ". This event is not in vCenter events database")}}
#

Output result example:

VM: DC2DC001. Snapshot 'pre-5.1.2upgrade' created on 28 July 2013 07:10:26 by vStrong.infowin8user.
VM: DC1DC001. Snapshot 'pre 5.1.2a upgrade' created on 28 July 2013 07:51:24 by vStrong.infowin7user.
VM: DC2APP001. Snapshot 'pre-fix' created on 02 August 2012 14:29:19. This event is not in vCenter events database

Hope this will help.

19 comments to Who created these VM snapshots???

  • Rob L

    Great script , any way to make it ignore snapshots created by a certain user – eg veeam , citrix etc ?

  • Dan

    BTW how do it get this into an html file ?

    I tried | ConvertTo-Html|Out-File C:temptest.txt

    but gives error ..

    Thanks

  • Juan Pedro

    Great Script

    Any way to show short format to date? Example dd/mm/yyyy ?

    Thanks

  • Nikhil

    how do I run this script

  • nikhil

    Thanks Mark for the reply , I am new to PowerShell ,I have it installed on my system , if possible , kindly give me the command to run the script

  • Dave A

    I used a piece of this code in a Snap Report script which I run daily so we could see who actually took the snap. I noticed recently it’s no longer showing the owner. When I run the code you have above, I see the snap in question, but it says at the end “This event is not in vCenter events database.”, however I can see the event when I explore events in vCenter client. Any idea of why this would no longer be getting reported?

    • The Get-VIEvent cannot “catch” the right event…
      Try something like this:
      Get-VIEvent -Entity $snap.VM -Types Info -Finish $snap.Created.AddMinutes(1) -MaxSamples 10

      • Dave A

        Thanks for that. I posted this same question to another board and they recommended playing with the AddSeconds setting in positive and negative direction. It was working sometimes and other times not. The AddMinutes(1) seems to give me more consistent results.
        I did change MaxSamples to 1 because in testing I was seeing multiple users, I’m sure due to the fact that I’m taking too many snaps too close together. This seems to work well now though. Thanks for the help!

  • SnakeNET

    In my case, the result is wrong as the filter ” – finish” does not include the event itself, so I made a small modification::

    $snapshot=get-snapshot *
    foreach ($snap in $snapshot){
    $snapevent = Get-VIEvent -Entity $snap.VM -Types Info -Finish (( get-date $snap.Created).addhours(1)) | Where-Object {$_.FullFormattedMessage -imatch ‘Task: Create virtual machine snapshot’} | sort createdtime -Descending | select -First 1
    if ($snapevent -ne $null){
    Write-Host ( “VM: “+ $snap.VM + “. Snapshot ‘” + $snap + “‘ created on ” + $snap.Created + ” by ” + $snapevent.UserName +”.” ) -foregroundcolor GREEN
    }else {
    Write-Host (“VM: “+ $snap.VM + “. Snapshot ‘” + $snap + “‘ created on ” + $snap.Created + “. This event is not in vCenter events database”) -foregroundcolor RED
    }
    }

  • Guido W

    If you want the output to a file you can use this:
    foreach ($snap in Get-VM | Get-Snapshot)
    {$snapevent = Get-VIEvent -Entity $snap.VM -Types Info -Finish $snap.Created -MaxSamples 1 | Where-Object {$_.FullFormattedMessage -imatch ‘Task: Create virtual machine snapshot’}
    if ($snapevent -ne $null){Write-output ( “VM: “+ $snap.VM + “. Snapshot ‘” + $snap + “‘ created on ” + $snap.Created.DateTime + ” by ” + $snapevent.UserName +”.”) | out-file -append C:snaplist.txt}
    else {Write-output (“VM: “+ $snap.VM + “. Snapshot ‘” + $snap + “‘ created on ” + $snap.Created.DateTime + “. This event is not in the database”) | out-file -append C:snaplist.txt}}

  • Ibrar Sajid

    I’m unable to see the most important information which is who created the snapshot?

    VM: TestVM. Snapshot ‘TESTSS’ created on Monday, April 18, 2016 10:50:
    55 AM. This event is not in vCenter events database
    VM: TESTVM1. Snapshot ‘Test’ created on Thursday, June 16, 2016 10:29:53 A
    M. This event is not in vCenter events database

  • fast4d

    same here.

    “This event is not in vCenter events database”

    not on all records but on the one I actually need to find owner :-(

  • Chandan Hegde

    Is there a way to retrieve the snapshot creator information even if it does not exist in vcenter event database?

  • Martin

    Thanks to Mark for the starting script.
    Here is my solution to write a CSV and send an HTML report with attached the CSV.
    —————————————————-
    $VIServer = “”

    # Importing all Available VMware Module
    Write-Host -Fore Yellow “Powershell Loading VMware-Modules…”
    Get-Module -Name VMware* -ListAvailable | Import-Module

    # Connecting to vCenter Server
    Write-Host -Fore Yellow “Connecting to VCenter $VIServer … Loginprompt appears”
    Connect-VIServer -Server $VIServer

    # Global Script Definitions
    $LogPath = “”
    $Sender = “xy@xy.bla”
    $Subject = “VMs with Snapshot”
    $To = “xy@xy.bla”
    $SMTPServer = “”
    $SMTPPort = “25”

    # Definitions Mail HTML Style
    $style = “BODY{font-family: Arial; font-size: 9pt;}”
    $style = $style + “TABLE{border: 1px solid black; border-collapse: collapse;}”
    $style = $style + “TH{border: 1px solid black; background: #dddddd; padding: 5px; }”
    $style = $style + “TD{border: 1px solid black; padding: 5px; }”
    $style = $style + “”

    # Mail Function
    Function SendMail()
    {
    $BodyText = “$mailcontent”
    Send-MailMessage -From $Sender -Subject $Subject -To $To -Body $BodyText -BodyAsHtml -Attachments $LogPath -DeliveryNotificationOption None -Port $SMTPPort -SmtpServer $SMTPServer
    }

    $report = @()
    $SnapShots = Get-VM | Get-Snapshot
    foreach ($snap in $SnapShots) {
    $snapevent = Get-VIEvent -Entity $snap.VM -Types Info -Finish $snap.Created -MaxSamples 1 | Where-Object {$_.FullFormattedMessage -imatch ‘Task: Create virtual machine snapshot’}
    if ($snapevent -ne $null){
    $row = “” | Select VM, Snapshot, CreatedDateTime, Username, Description
    $row.VM = $snap.VM
    $row.Snapshot = $snap
    $row.CreatedDateTime = $snap.Created.DateTime
    $row.Username = $snapevent.UserName
    $row.Description = $snap.Description
    }
    else {
    $row.VM = $snap.VM
    $row.Snapshot = $snap
    $row.CreatedDateTime = $snap.Created.DateTime
    $row.Username = $snapevent.UserName
    $row.Description = “This event is not in vCenter events database”
    }
    $report += $row
    }
    # Convert Report Content to Mail HTML
    $mailcontent += $report | ConvertTo-Html -Head $style
    # Start Function SendMail with Content
    SendMail($mailcontent)

    # Log to file
    $report | Export-Csv $LogPath -NoTypeInformation
    —————————————————-
    Cheers Martin

Leave a Reply

You can use these HTML tags

<a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>