The Get-VIEvent cmdlet can be used to retrieve information about the events on a vCenter Server system. The syntax of the Get-VIEvent cmdlet is as follows:

Get-VIEvent [[-Entity] <VIObject[]>] [-Start <DateTime>] [-Finish
    <DateTime>] [-Username <String>] [-MaxSamples <Int32>] [-Types
    <EventCategory[]>] [-Server <VIServer[]>] [<CommonParameters>]

The Get-VIEvent cmdlet has no required parameters.

If you don't specify a value for the -Start, -End, and -MaxSamples parameters, the default maximum number of objects returned will be 100. If you want to specify the maximum value possible for the -MaxSamples parameter, you can use -MaxSamples ([int]::MaxValue). This is a .NET notation, and it is the equivalent of 2,147,483,647.

You can specify Error, Info, or Warning as the value of the -Types parameter in order to retrieve the events of the specified types only. For example, to retrieve a maximum of 50 error events from the error events of the last 24 hours, you can use the following command:

PowerCLI C:> $StartDate = (Get-Date).AddDays(-1)
PowerCLI C:> Get-VIEvent -Start $StartDate -Types
    Error -MaxSamples 50 |
>> Select-Object -Property CreatedTime,FullFormattedMessage

The output of the preceding command lines is as follows:

CreatedTime          FullFormattedMessage
-----------          --------------------
2/1/2017 8:45:54 PM  Host 192.168.0.133 in New York is not responding
2/1/2017 9:39:40 PM  Cannot login [email protected]

The events returned by the Get-VIEvent cmdlet are of different types, depending on the type of the event. To get a sorted list of some of the names of the event types in your environment, you can use the following command lines:

PowerCLI C:> Get-VIEvent -MaxSamples 500 |
>> Select-Object -Property @{
>>   Name = "TypeName"
>>   Expression = {$_.GetType().Name}
>> }|
>> Sort-Object -Property TypeName -Unique |
>> Format-Wide -Property TypeName -Column 2

The output of the preceding command is as follows:

AlarmAcknowledgedEvent                 AlarmStatusChangedEvent
DatastoreFileDeletedEvent              DatastoreIORMReconfiguredEvent
DrsVmMigratedEvent                     DrsVmPoweredOnEvent
DvsPortLinkDownEvent                   DvsPortLinkUpEvent
EventEx                                NoAccessUserEvent
NonVIWorkloadDetectedOnDatastoreEvent  ScheduledTaskCompletedEvent
ScheduledTaskStartedEvent              TaskEvent
UserLoginSessionEvent                  UserLogoutSessionEvent
VmAcquiredTicketEvent                  VmBeingHotMigratedEvent
VmDasResetFailedEvent                  VmEmigratingEvent
VmMessageEvent                         VmPoweredOnEvent
VmReconfiguredEvent                    VmRemoteConsoleConnectedEvent
VmResettingEvent                       VmResourceReallocatedEvent
VmStartingEvent

Play with the value of the -MaxSamples parameter to get a large or small number of event type names.

You can use the names of the event types to filter for certain events. For example, to retrieve events related to the creation of a virtual machine, you can filter for the VmBeingDeployedEvent, VmCreatedEvent, VmRegisteredEvent, or VmClonedEvent event type names.

You can use these event type names to find the person who created the virtual machine. In this case, you have to specify the virtual machine as the value of the -Entity parameter. You have to use the -MaxSamples parameter with a large value; otherwise, you might not find the event if the virtual machine was not created recently. The output of the Get-VIEvent cmdlet must be piped to the Where-Object cmdlet to filter for the events related to the creation of the virtual machine. In the following example, the event related to the creation of the virtual machine VM1 will be retrieved:

PowerCLI C:> Get-VIEvent -Types Info -Entity $VM -MaxSamples
    ([int]::MaxValue) |
>> Where-Object {
>> @('VmBeingDeployedEvent','VmCreatedEvent','VmRegisteredEvent',
    'VmClonedEvent') -contains $_.Gettype().Name
>> }

The output of the preceding command is as follows:

Template             : False
Key                  : 28367
ChainId              : 28360
CreatedTime          : 2/1/2017 9:54:51 AM
UserName             : VSPHERE.LOCALAdministrator
Datacenter           : VMware.Vim.DatacenterEventArgument
ComputeResource      : VMware.Vim.ComputeResourceEventArgument
Host                 : VMware.Vim.HostEventArgument
Vm                   : VMware.Vim.VmEventArgument
Ds                   :
Net                  :
Dvs                  :
FullFormattedMessage : Created virtual machine VM1 on 192.168.0.134
                       in New York
ChangeTag            : 

Now, you know that the virtual machine VM1 was created by the user VSPHERE.LOCALAdministrator on February 1st, 2017, at 9:54:51 A.M.