VMotion events for a specific virtual machine

VMotion is the process of moving a virtual machine from one ESXi host to another in an effort to balance the workload of all virtual machines as evenly and effectively as possible. You might need to track VMotion events for a specific virtual machine when doing the following:

• Monitoring VMware virtual machine performance

Prerequisites 

In order to execute this procedure in your environment, you may need to first on-board the data, services, or apps shown in the following table.

Example

The purpose of this example is to show how this procedure works in a general environment. In your environment, you can optimize the search by specifying an index, a time range, or a different data source. 

While the VMotion process is seamless to the virtual machine operation, it can impact performance. You want to monitor virtual machines being moved from one ESXi host to another so you can be prepared for any problems caused by the process. 

1. Run the following search: 

sourcetype=vmware:inv:hierarchy type=VirtualMachine moid=<MOID of the VM to track>
|reverse
|dedup consecutive=true moid changeSet.runtime.host.moid
|table _time moid changeSet.runtime.host.moid
|rename changeSet.runtime.host.moid AS esxi_host

Search Explanation

The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.

Result

The table below shows sample results for the search. You can see that the earliest time returned from the search is 14:39 with vm-77 on host-10. Approximately a minute and a half later, at 10:40:42, you see vm-77 is on host-11. Another minute and a half later, vm-77 has moved back to host-11. The data generated for the example has vm-77 moving back and forth between host-10 and 11 as we advance in time. 

Alternatively, you can add this timechart command to the end of the search for a visualization of the movement of the VMs:

|timechart span=1m dc(moid) BY "changeSet.runtime.host.moid"