PowerShell Snip of the Week (Get-WinEvent)

VMs that went into Saved State in the Last Day

During the migration of VMs to a Hyper-V in Windows Server 2012 R2 environment you may find that some of your VMs go in to Saved State when the backup process kicks off.  This may be because you have not updated the Integration Components, there is a problem with the Integration Component install or some other issue where the Hyper-V Writers determine that the VM should be backed up offline (Look for a post on this soon).  During this time of troubleshooting you can go to the Windows-Hyper-V-Worker-Admin event log on each server to identify which VMs are having this issue by looking for event 18510.  If you have a larger environment this gets a little inefficient.

I have used the script below during my troubleshooting.  You could easily change this to either look to a server list text file or even to accept a switch.

 

 

$s = “”SERVERNAME1”, “SERVERNAME2” foreach ($server in $s) {Get-WinEvent -ComputerName $server -FilterHashTable @{LogName =”Microsoft-Windows-Hyper-V-worker-admin”; StartTime = (Get-Date).AddDays(-1)} | ? id -eq 18510}