Find Restarted VMs After a VMware HA Event

On several occasions I've had the privilege of finding a VMware ESXi host hung with a Purple Screen of Death (PSOD).  Assuming you have your VMware cluster setup properly, VMware HA will automatically restart the VMs that were running on the crashed host on other hosts in the cluster.

In my experience, it's fairly easy to identify the host with the PSOD in vCenter.  But it's a bit more tricky to identify what VMs were restarted by VMware HA.  (Aka - find the victims)

I've found that PowerCLI can help with this task.

Below is a quick PowerCLI one-liner to find the VMs that were restarted.

get-cluster "Cluster Name" | get-vm | Get-VIEvent | where {$_.FullFormattedMessage -match "vSphere HA restarted virtual machine"} | select ObjectName, CreatedTime, FullFormattedMessage

You can easily add an export-csv to the end if you want to export the list of VM's into something where you edit the data.