When was the last time that VM was powered on?

People often want to know the last time that a VM was powered on. Unfortunately there is no completely fool-proof way to figure this out using just vCenter or ESX, but PowerCLI offers an approach that is pretty good, good enough that you can create a simple report and identify VMs that may be ready for that big hypervisor in the sky.

This is also a popular topic on the PowerCLI community, where LucD offers a solution to the problem, which relies on using events to determine when the poweron took place. Since Luc gave this solution a few things have happened:

  1. The bug that caused Get-VIEvent to only return 1000 events is fixed in PowerCLI 4.0.
  2. More importantly, you can pipe objects into Get-VIEvent, so you don’t have to deal with huge arrays of events. This is significant because a typical vCenter will have tens if not hundreds of thousands of events, covering everything from trivial to important things.

To take advantage of these facts I’ve written an updated PowerCLI script which generates a last-powered-on report.

One important note, ESX and vCenter actually create two events in connection with a VM poweron, one event when a user attempts to power a VM on, then another event if that power on actually succeeds. The code above actually generates a report of the last time a user attempted to power a VM on. When you attempt to power a VM on there are a lot of reasons it may fail, for instance your datastore may be full, in which case the poweron fails because ESX can’t create the memory swap file it needs (something I run into all the time).

Here’s a screen capture I made after running this against one of my ESX servers:


We can also use the always-useful, though often cryptic, select cmdlet to enhance this report by adding the total amount of space the VM uses, as follows.


This report suggests that the VM named 2k8 64 bit is a good candidate for removal, and in fact it is since I only used it to create this blog post, so it hasn’t been powered on since March 2009.

On the other hand you can see the report above is far from perfect, for example several powered on VMs have no entry for LastPoweron. Why? The reason is that, by default, ESX 4 only retains 1000 events (this is re-occurrence of the PowerCLI bug, I checked). Some of my VMs were powered on so long ago that their events no longer exist.

This brings us to another important point. ESX is not meant to store events for extended periods of time, instead vCenter will handle this for us. So the best way to generate this last powered on report is to run it against our vCenter instance, which will give us a much longer view.

Still this view does not stretch back forever, even in vCenter events will eventually expire. In vCenter 4, the event retention policy is even customizable. If you’re running vCenter 4, I’ve written this function to help you figure out what your retention policy is.

Here’s what it looks like in action:


If you know your retention policy and you know that all poweron/poweroff actions are performed through your vCenter server, you can be very confident that the information in the report is accurate, and use it to start moving unused VMs to archive storage, or even deleting them completely.

It is very important to note, though, that this report is pretty good, not perfect!! Don’t go around deleting stuff without careful human review beforehand.


13 comments have been added so far

  1. Great article (as always).
    Would you mind sharing the source of the 1000 events limit on ESX ? Was looking for that as well but couldn’t find it.
    Is the same true for ESXi ?

  2. I’m not completely sure about events on ESX directly. My ESX 4 (full ESX) always has exactly 1000 events. I have another server, ESXi 3.5, that started with about 500 events. I created a bunch of other events but the largest number it keeps is 994. I don’t see any way to configure the values either.

    1. @roberto, Yes it works fine with ESXi 5.1.0. I have tested that in my environment.

      @Carter: Thanks for such a great and useful post.

  3. thanks abhinav, I can exeute the script in powercli console so the function is supposed to be loaded in memory and I do not get any errors but when I launch “Get-Vm | GetLastPowerOn” I get the following errors:

    + Get-Vm | GetLastPowerOn
    + ~~~~~~~~~~~~~~
    + CategoryInfo : ObjectNotFound: (GetLastPowerOn:String) [], Comm
    + FullyQualifiedErrorId : CommandNotFoundException

    any clue ?

  4. It doesn’t work for me. I get this error after I run the script with the get-lastpoweron function.
    PowerCLI D:\Scripts\Shutdown> get-vm | get-lastpoweron
    The term ‘get-lastpoweron’ is not recognized as the name of a cmdlet, function,
    script file, or operable program. Check the spelling of the name, or if a path
    was included, verify that the path is correct and try again.
    At line:1 char:25
    + get-vm | get-lastpoweron <<<<
    + CategoryInfo : ObjectNotFound: (get-lastpoweron:String) [], Com
    + FullyQualifiedErrorId : CommandNotFoundException

  5. This still works great, running against 5.5 vcenter.

    Just dot source the function script (thats period space then the path\ps1)
    PowerCLi> . C:\functions.ps1

    then get-vm | get-lastpoweron

    Thank you.

  6. Aw, this was a very good post. Taking the time and actual effort to produce a great article… but what can I say… I put things off a whole lot and
    don’t manage to get anything done.

Leave a Reply

Your email address will not be published. Required fields are marked *