Find all virtual machines with ballooned or swapped RAM in VMware cluster?

If I were to look at a vSphere cluster or resource pool and see a certain level of memory ballooning or swapping, how do I identify which VMs are affected? I know what to do with them once I find them :)

In the example below, there are 65 virtual machines in the resource pool. There's just under 32 Gigabytes of ballooned RAM. How do I identify which VMs have a portion of their RAM ballooned or swapped?

Powercli is great for things like this:

Get-VM | where {$_.BalloonedMemory -ne '0'}

Loads more examples are here:

http://www.getshifting.com/wiki/powerclinotes

Particularly have a look at "VMs with Ballooning and Swapping" http://www.getshifting.com/wiki/powerclinotes#resource_pools_with_ballooning_and_swapping

Copied from the above link:

$myCol = @()
foreach($vm in (Get-View -ViewType VirtualMachine | Where-Object `
  {$_.Summary.QuickStats.BalloonedMemory -ne "0"})){
    $Details = "" | Select-Object VM, `
    SwappedMemory ,BalloonedMemory

    $Details.VM = $vm.Name
    $Details.SwappedMemory = $vm.Summary.QuickStats.SwappedMemory
    $Details.BalloonedMemory = $vm.Summary.QuickStats.BalloonedMemory

    $myCol += $Details
  }
$myCol

Hope this will be a little bit of help.

Sorry, was quick so you would want to do additional sorts in this info output, as well as grouping by resources(host, datastore, cluster), I ran against the whole vCenter.

#!/bin/env python
__author__ = 'dladner'

import os
import sys
import pysphere

from pysphere import VIServer, MORTypes
from pysphere.resources import VimService_services as VI

s = VIServer()
s.connect("vcenter_hostname_or_ip", "username", "password")
vmlist = s.get_registered_vms(status="poweredOn")
count = 0
for vmpath in vmlist:
    pm1 = s.get_performance_manager()
    vm = s.get_vm_by_path(vmpath)
    mor = vm._mor
    ballooned = pm1.get_entity_statistic(mor, 77)
    swapped = pm1.get_entity_statistic(mor, 61)
    count += 1
    print "VM Number %d is %s and Ballooned Memory Amount on this VM is : %s" % (count, vmpath, ballooned)
    print "VM Number %d is %s and Swapped Memory Amount on this VM is  : %s" % (count, vmpath, swapped)

print "NOTICE: This statistic refers to VMkernel swapping and not to guest OS swapping."
s.disconnect()

This will give you the result below where you can already modify and sort it the way you want from higher ballooned/swapped amount to lower (+ would want to convert KB to MB)

I did modified output (substituted hostnames and grouped by ballooned/swapped)

SWAPPED:

VM Number 2 is [vm11_rr] hostname and Swapped Memory Amount on this VM is  : [<vm-303427:swapped(61):Swapped::107336:kiloBytes:2013-08-31 04:35:33.561569>]
VM Number 9 is [vm04] hostname and Swapped Memory Amount on this VM is  : [<vm-17451:swapped(61):Swapped::7896:kiloBytes:2013-08-31 04:36:25.791696>]
VM Number 10 is [vm05_nq] hostname and Swapped Memory Amount on this VM is  : [<vm-266882:swapped(61):Swapped::816:kiloBytes:2013-08-31 04:36:33.266692>]
VM Number 11 is [vm06] hostname and Swapped Memory Amount on this VM is  : [<vm-4550:swapped(61):Swapped::-1:kiloBytes:2013-08-31 04:36:40.313133>]
VM Number 14 is [vm05] hostname and Swapped Memory Amount on this VM is  : [<vm-158642:swapped(61):Swapped::12532:kiloBytes:2013-08-31 04:37:02.907590>]
VM Number 23 is [vm07] hostname and Swapped Memory Amount on this VM is  : [<vm-437276:swapped(61):Swapped::135272:kiloBytes:2013-08-31 04:38:10.633787>]
VM Number 24 is [vm14_rr] hostname and Swapped Memory Amount on this VM is  : [<vm-74703:swapped(61):Swapped::183436:kiloBytes:2013-08-31 04:38:17.985025>]
VM Number 25 is [vm01] hostname and Swapped Memory Amount on this VM is  : [<vm-156212:swapped(61):Swapped::13268:kiloBytes:2013-08-31 04:38:25.224494>]
VM Number 33 is [vm14] hostname and Swapped Memory Amount on this VM is  : [<vm-156661:swapped(61):Swapped::828:kiloBytes:2013-08-31 04:39:25.827377>]
VM Number 39 is [vm23_rr] hostname and Swapped Memory Amount on this VM is  : [<vm-391487:swapped(61):Swapped::10020:kiloBytes:2013-08-31 04:40:10.795514>]
VM Number 48 is [vm15] hostname and Swapped Memory Amount on this VM is  : [<vm-446333:swapped(61):Swapped::-1:kiloBytes:2013-08-31 04:41:20.224237>]
VM Number 49 is [vm14_rr] hostname and Swapped Memory Amount on this VM is  : [<vm-395852:swapped(61):Swapped::91664:kiloBytes:2013-08-31 04:41:27.588455>]
vm number 51 is [vm03] hostname and swapped memory amount on this vm is  : [<vm-47780:swapped(61):swapped::8:kilobytes:2013-08-31 04:41:43.539276>]
vm number 54 is [vm29_rr] hostname and swapped memory amount on this vm is  : [<vm-430048:swapped(61):swapped::1200:kilobytes:2013-08-31 04:42:07.398927>]
vm number 56 is [vm03] hostname and swapped memory amount on this vm is  : [<vm-45758:swapped(61):swapped::19560:kilobytes:2013-08-31 04:42:22.790720>]
vm number 59 is [vm25_rr] hostname and swapped memory amount on this vm is  : [<vm-267833:swapped(61):swapped::55836:kilobytes:2013-08-31 04:42:46.202327>]
vm number 60 is [vm01] hostname and swapped memory amount on this vm is  : [<vm-279859:swapped(61):swapped::4289160:kilobytes:2013-08-31 04:42:53.200330>]
vm number 61 is [vm04] hostname and swapped memory amount on this vm is  : [<vm-174860:swapped(61):swapped::26288:kilobytes:2013-08-31 04:43:01.326958>]
vm number 62 is [vm25_rr] hostname and swapped memory amount on this vm is  : [<vm-384185:swapped(61):swapped::8180:kilobytes:2013-08-31 04:43:09.043827>]
vm number 63 is [vm12_rr] hostname and swapped memory amount on this vm is  : [<vm-434605:swapped(61):swapped::25780:kilobytes:2013-08-31 04:43:16.270494>]
vm number 64 is [vm01] hostname and swapped memory amount on this vm is  : [<vm-372871:swapped(61):swapped::21840:kilobytes:2013-08-31 04:43:23.820811>]
vm number 67 is [vm09_nq] hostname and swapped memory amount on this vm is  : [<vm-184134:swapped(61):swapped::716:kilobytes:2013-08-31 04:43:46.909753>]
vm number 69 is [vm31_rr] hostname and swapped memory amount on this vm is  : [<vm-434653:swapped(61):swapped::148:kilobytes:2013-08-31 04:44:02.652494>]

BALLOONED::
VM Number 23 is [vm07] hostname and Ballooned Memory Amount on this VM is : [<vm-437276:vmmemctl(77):Balloon::2638188:kiloBytes:2013-08-31 04:38:08.631993>]
VM Number 24 is [vm14_rr] hostname and Ballooned Memory Amount on this VM is : [<vm-74703:vmmemctl(77):Balloon::1335560:kiloBytes:2013-08-31 04:38:16.188130>]
VM Number 49 is [vm14_rr] hostname and Ballooned Memory Amount on this VM is : [<vm-395852:vmmemctl(77):Balloon::1249812:kiloBytes:2013-08-31 04:41:25.789048>]
VM Number 56 is [vm03] hostname and Ballooned Memory Amount on this VM is : [<vm-45758:vmmemctl(77):Balloon::-1:kiloBytes:2013-08-31 04:42:20.445191>]

If you need some additional help I can try to make it more sane tomorrow as today it is quite late.

SOURCES:

http://pubs.vmware.com/vsphere-50/index.jsp#com.vmware.wssdk.apiref.doc_50/memory_counters.html

https://code.google.com/p/pysphere/

Hope this helps.

Cheers.

P.S. Not sure what -1:kiloBytes means from API.

This is a very late addition to an old thread but you can make this faster keeping it in a pipeline and avoiding a for each loop. Give this a try:

    get-vm | where{ $_.swappedmemory -ne '0'} | get-view | Select Name,@{Name="Swapped”;Expression={$_.summary.quickstats.swappedmemory}},@{Name="Ballooned";Expression={$_.summary.quickstats.balloonedmemory}}