I have asked a few similar questions but my report that contains snapshots is in sore need of expanding in order to call out some culprits and to ensure that our backup software is not abandoning snaps in the environment. So far I have the following snippet from my report as a lead in example:
Get-View -ViewType VirtualMachine -Filter @{'Runtime.PowerState'='poweredOn'} |
Select -First 50 Name,
@{N='SnapShot';E={
function Get-Snap{
param([PSObject]$snap)
$snap
if($snap.ChildSnapshotList){
$snap.ChildSnapshotList | %{
Get-Snap -Snap $_
}
}
}
$script:snaps = $_.Snapshot.RootSnapshotList | %{
Get-Snap -Snap $_
}
($script:snaps | sort-Object -property Name).Name -join '|'}},
@{N='SnapShot Created';E={($script:snaps | sort-Object -property Name).CreateTime -join ','}},
@{N="Days Old";E={(New-TimeSpan -End (Get-Date) -Start $script:snaps.CreateTime).Days}},
@{N='Created By';E={$snapevent = Get-VIEvent -Entity $_ -Types Info -Finish $_.created -MaxSamples 1 | Where-Object {$_.FullFormattedMessage -imatch 'Task: Create virtual machine snapshot'}
$snapevent.UserName}}
Everything works except the Created By
If I run this on a single server I get all Created by results from the Event Log including ones that have been deleted.
$snapevent = Get-VIEvent -Entity ServerA -Types Info -Finish ServerA.Created -MaxSamples 1 | Where-Object {$_.FullFormattedMessage -imatch 'Task: Create virtual machine snapshot'}
$snapevent.UserName
Any help is greatly appreciated.