The PowerCLI applet Get-VIEvent can be used to report on any events that occur in vCenter, for any object.

To use it to see which alarms have generated email alerts for all VMs in the cluster, the following one-liner gets the job done:

Get-Cluster ClusterName | Get-VM | Get-VIevent -Start ([DateTime]"2012-07-10 00:00") -Finish ([DateTime]"2012-07-11 23:59") | Where { $_.GetType().Name -eq "AlarmEmailCompletedEvent"} | Select @{N="Name"; E={$_.Vm.Name}}, CreatedTime, Key, FullFormattedMessage | ft -autosize

Simply put, for all VMs in cluster “ClusterName”, get their events from 7/10/2012 to 7/11/2012 that have an event type of AlarmEmailCompletedEvent, and output the VM’s name, the date/time of the entry, the event key number for future reference, and the text of the message. Output it as a formatted table, autosized to accommodate the long strings of the message.

This can take awhile to run, especially if there are a large number of VMs in the cluster and they have a large number of events to sift through. By including start/finish times, the script will return faster as there’s a shorter window to sift through for AlarmEmailCompletedEvent entries.

Some notes:

• Dynamic time-frame: the -Start and -Finish parameters can be dynamic, so that, for example, the time-frame to search begins 12 hours ago and ends 1 hour ago: -Start ((Get-Date).AddHours(-12)) -Finish ((Get-Date).Addhours(-1)) (Thanks LucD)
• Type: this can be determined by piping the output of Get-VIevent to Get-Member. Above the list of methods and properties will be a TypeName which can be used with the Gettype().Name property (do not include the “VMware.Vim” portion of the TypeName).
• Instead of piping to ‘ft’ (Format-Table), the output could be piped to Export-CSV (be sure to use the -notype parameter).
• As always, bits and pieces were assembled from LucD’s great work.