PowerCLI one-liner to find created VMs

Occasionally I get asked:

When was this virtual machine created?

Unfortunately in vSphere client, the events log it displays may be truncated and you can’t see the vm creation entry. Here is a simple one-liner in powerCLI that can list the VMs created.

Get-VIEvent -maxsamples 10000 -Start (Get-Date).AddDays(-5) | where {$_.Gettype().Name -eq "VmCreatedEvent"}

You may need to change the “-maxsamples” flag if you environment is large because of the number of events it needs to crawl through. Also you can change the date range by increasing the value in the “.AddDays()” variable. In the example above “-5” means the last 5 days.

There is probably a more elegant way to write this script but this works well enough for me. You can take it one step further and pipe the output to CSV or format it. At one of my clients I set it up to run as a scheduled weekly task(weekly because we were purging vCenter events weekly to save DB space).


Leave a Reply

Your email address will not be published. Required fields are marked *