After my post on measuring and preventing vSphere resource over-commitment, a discussion arose at the company I work regarding HA admission control. It would appear that it has been disabled on a number of internal development clusters (thankfully no customer ones), which has then left these clusters over-committed. I have been tasked with finding out how this has happened.

Normally I would turn to the syslog for something like this, but on this occasion I decided to trawl the vCenter event database.  Obviously there would be a lot of data to go through, which meant it was an obvious job for a script!

On a lab cluster, I opened PowerCLI and connected to it in the usual fashion:

# Variables

$credential = Get-Credential
$vc = "vc2.uk.mdb-lab.com"

# Connect to vCenter
Connect-VIServer -Server $vc -Credential $credential

I then defined the cluster I wish to extract the data from, along with today’s date:

$cluster = "London_Cluster"
$date = Get-Date

I needed to find out how admission control appears in the events database.  To do that I used the following to quickly enable and then disable it:

Set-Cluster $cluster -HAAdmissionControlEnabled $false -confirm:$false
Set-Cluster $cluster -HAAdmissionControlEnabled $true -confirm:$false

I queried the event database using:

Get-VIEvent -Entity $cluster -MaxSamples 10

This returns numerous events, the last six being the most interesting. Specifically:

Now I know what I am looking for, and more importantly the key (2798). I can now expand my range but yet narrow my search to just this one key using:

Get-VIEvent -Entity $cluster -MaxSamples 100 | Where {$_.Key -eq 2798}

This filters out unwanted results:

I needed to know the “proper name” of this event, so to do this I use Get-Member to learn more:

Get-VIEvent -Entity $cluster -MaxSamples 100 | Where {$_.Key -eq 2798} | Get-Member

This brings up all the method and property members:

I am interested in Get-Type, and more importantly the Name:

Get-VIEvent -Entity $cluster -MaxSamples 10 | Where {$_.Key -eq 2798} | ForEach {$_.GetType().Name}

Now I know the name is DasAdmissionControlDisabledEvent.

Rather than retrieve the last x amount of queries, I prefer to go back a set amount of months. I’ve already defined today’s date, but I now need to define how many months using:

$goBackInMonths = 6

The remaining task is to amend my search with the date range, and only select the fields I’m interested in – such as date and time, the user and the full message string.

This gives me:

Get-VIEvent -Entity $cluster -Start ($date).AddMonths(-$goBackInMonths) | Where { $_.Gettype().Name -eq "DasAdmissionControlDisabledEvent"} | Select CreatedTime, UserName, FullFormattedMessage

Which for my test lab shows:

The full PowerCLI script is getEvents.ps1, which you can download from my GitHub repo:

# Variables

$credential = Get-Credential
$vc = "vc2.uk.mdb-lab.com"
$date = Get-Date
$goBackInMonths = 6

# Connect to vCenter
Connect-VIServer -Server $vc -Credential $credential

# Define the cluster
$cluster = "London_Cluster"

# Retrieve events
Get-VIEvent -Entity $cluster -Start ($date).AddMonths(-$goBackInMonths) | Where { $_.Gettype().Name -eq "DasAdmissionControlDisabledEvent"} | Select CreatedTime, UserName, FullFormattedMessage

# Disconnect from vCenter
Disconnect-ViServer $vc -Confirm:$false