Powershell Script for auditing restore jobs

[ThatTechGuy91]

Hey all,

For auditing purposes, we have to provide proof that we test full VM restore jobs. Specifically for one server. Through researching, I found this command that shows everything from the requested time frame.

Code: Select all

Export-VBRAudit -From <datetime> -To <datetime> -FileFullPath <string>  [<CommonParameters>]

Is there a way (or different script) to make it only pull for a certain job/server? And is there a way to get more details on the type of restore job it was? From the report, one server says "File Level Restore" on a restore job, but another server (the one in question) just doesn't specify what kind of restore jobs were done. It just shows a section that says "vmRestorePointDate." Ideally, the report needs to be able to range from the first of the year to a specified cutoff time.

Thanks in advance.

[david.domask]

Hi Ty, welcome to the forums.

Export-VBRAudit can work for this for sure. The outputted file is a CSV, so it's a little roundabout for my taste but you can do something like:

Code: Select all

$date = Get-Date
Export-VBRAudit -From $currDate.AddDays(-25) -To $currDate -FileFullPath C:\temp\exportaudit.log
$data = Import-Csv C:\temp\exportaudit.log
PS C:\Users\david.LAB> $data | Where-Object {$_.operation -eq "VmRestore"}


Time      : 03.07.2024 11:45:31Z
User      : LAB\david
SID       : S-1-5-21-3244118976-2883547007-3715689972-22252
Operation : VmRestore
Result    : Success
Details   : sessionUid='55038718f2104b3fbae297c104907368';vmName='ddom-ocfs2-node1'

Time      : 03.07.2024 11:52:21Z
User      : LAB\david
SID       : S-1-5-21-3244118976-2883547007-3715689972-22252
Operation : VmRestore
Result    : Success
Details   : sessionUid='354b289dde024bd6838364e8b549d72f';vmName='ddom-ocfs2-node1'

The SessionUid is what you need to parse out here, and once you do you'll pass that to Get-VBRRestoreSession to get further data on it. The parsing to "clean" that up is a bit messy though:

Code: Select all

Get-VBRRestoreSession -id (($data | Where-Object {$_.operation -eq "VmRestore"})[0].Details.Split("'")[1].Split(";")[0].Trim("'"))

Restore Type       VM Name              State      Start Time             End Time               Description
------------       -------              -----      ----------             --------               -----------
RestoreVm          ddom-ocfs2-node1     Stopped    03.07.2024 13:45:31    03.07.2024 13:47:48

I would actually just get it by using first Get-VBRSession with the -Type parameter (use Get-Help Get-VBRSession to see the valid options) and pass the relevant Session Type to Get-VBRSession -- this cmdlet is far faster to generate a "cold" list, and if you need more information than what it returns, you can pass an array of IDs from your result to Get-VBRRestoreSession -Id or Get-VBRBackupSession -Id to get an array of the full sessions returned.