Description

This article introduces the procedure used to collect hypervisor logs from Hyper-V hosts using PowerShell commands.

Applicable Systems

ThinkAgile HX

Procedures

1. Log in to the hypervisor host that contains the VMs experiencing issues.
2. Open Windows PowerShell and select Run as Administrator.
3. The Get-WinEvent cmdlet is used to pull logs from a local or remote server. Windows servers have hundreds of logs, so you should only collect the ones that you need. For example, the output of the Get-Winevent -Listlog * command would be extensive.
   In the shortened example output shown below, there are about 19 Hyper-V logs.
   
   The following steps introduce the command examples used to capture the logs and save the outputs in CSV format.
4. Follow the procedure set out below to capture only the Hyper-V logs and save the output bundle to a directory of your choosing.
   1. Create a temp directory using use the mkdir c:\temp command.
      
      Note: If the output directory does not exist, the rest of the steps will fail.
   
   
   2. Run the following PowerShell script to collect the Hyper-V* logs and the SMBClient* logs and place the output in the c:\temp folder which has the computer name in the filename.

      Get-WinEvent @{logname="Microsoft-Windows-Hyper-V*","Microsft-Windows-SMBClient*"} -ErrorAction Ignore|select TimeCreated,LogNAme,Id,LevelDisplayName,ProviderName,Message,MachineName,UserId|Export-Csv -Path "c:\temp\$env:computername-hyperv.csv" -NoTypeInformation 

   
   
   3. Run the dir c:\temp command to display the newly created CSV file.
      
   
   
   4. Run the following script to collect the application and system logs as a combined log and sort all events by creation time.

      Get-WinEvent @{logname='application','system'} -ErrorAction Ignore|select TimeCreated,LogNAme,Id,LevelDisplayName,ProviderName,Message,MachineName,UserId|Export-Csv -Path "c:\temp\$env:computername-applicationsystem.csv" -NoTypeInformation

      
5. When you want to collect logs for a specific date or logs related to warnings and errors only, combine different parameters with the Get-WinEvent command to filter the output.
   1. To collect all the Hyper-V logs from yesterday, run the following script:

      Get-WinEvent -FilterHashTable @{LogName ="Microsoft-Windows-Hyper-V*"; StartTime =(Get-Date).AddDays(-1)} 

   2. To collect only the warnings from yesterday, run the following script:

      Get-WinEvent -FilterHashTable @{LogName ="Microsoft-Windows-Hyper-V*"; StartTime =(Get-Date).AddDays(-1); Level = 3}

   3. To collect only the error messages from yesterday, run the following script:

      Get-WinEvent -FilterHashTable @{LogName ="Microsoft-Windows-Hyper-V*"; StartTime =(Get-Date).AddDays(-1); Level = 2}

   
   
   4. To collect the hyper-V logs and output to a folder, run the following script:

      Get-WinEvent -FilterHashTable @{LogName ="Microsoft-Windows-Hyper-V*"; StartTime = (Get-Date).AddDays(-1)} -ErrorAction Ignore|Export-Csv -Path "c:\temp\$env:computername-hyperv.csv" -NoTypeInformation 

6. Compress the log files and send the entire log to Lenovo Support using the Lenovo upload tool.

Additional Information

• Get-EventLog

Related Article

• How to upload a file to Lenovo Data Center support
• How to run the NCC health check and collect the output using Nutanix Prism
• How to run the NCC health check and collect the output using the Nutanix CVM CLI
• How to collect hypervisor logs using SSH to connect to a Controller VM in ThinkAgile HX systems
• How to collect cluster diagnostic logs from the hyper-v host in ThinkAgile MX