25th May 2020

PowerShell: Searching guestinfo.appinfo for an Application or Service

VMware Tools 11 can be configured to collect information of running services inside a virtual machine. When the information is captured it is stored in the advanced setting guestinfo.appinfo. I’ve written about this before and how that information can be exported to a CSV and transformed with PowerBI to visualise application data in the data centre.

This data often provides a significant challenge to get at using traditional methods, as those methods often require full agent installations on machines alongside network access. The charm of the VMware Tools collection method is that it doesn’t require the attack surface to be enlarged in order for it to function. Thinking back to requests I’ve had in the past, they would often be asking to validate if software was installed and the version rolled out across the data centre. Can the appinfo data help with this type of query?

Code

The short answer is yes and it really isn’t that complicated.

#Setting the VM advanced setting field and what application/service to search for
$Advsetting = 'guestinfo.appinfo'
$App = Read-Host -Prompt "Enter the case sensitive executable name to search for; e.g svchost, winlogon, dns, DFSRs"

#Ask for a VMware Cluster to target 
$allclusters = Get-Cluster
    Write-Host ("$allclusters") -ForegroundColor DarkGreen -BackgroundColor White
$cluster = Read-Host -Prompt "Enter the connected Cluster Name from the list above"
$GuestType = Read-Host -Prompt "e.g. windowsGuest or linuxGuest"
 
#Take the set variables to define virtual machines to target for search
$VMS = Get-VM -Location $cluster | Where-Object{($_.Guest.GuestFamily -eq ("$($GuestType)") -and $_.PowerState -eq 'PoweredOn')}

#Test to see if Application/service exists
foreach($VM in $VMS){
$Adv = Get-AdvancedSetting -Entity $VM -Name $Advsetting
$Value = $Adv.value
if ($null -eq $Value) {
    write-host ("$App is not found on $VM!") -ForegroundColor DarkGreen -BackgroundColor White
    }
else {
    write-host ("$App found on $VM! outputting version information --- ") -ForegroundColor White -BackgroundColor DarkGreen

    $Adv.Value | Select-String -Pattern ("$($App)") -SimpleMatch -CaseSensitive | Out-String -Stream | Select-String -Pattern ("$($App)")
    } 
}

What the script does

This script searches the values contained within the VM advanced setting guestinfo.appinfo for the requested applications and services:

The Application or service variable is set as part of the script
The Cluster to target is set as part of the script
Simple logic checks if the Application or Service exists in the advanced settings of the Virtual Centre Virtual Machine object.
If the Application or Service referenced does not exist this is written out by the script
If the Application or Service referenced does exist this is written out alongside version information

Requirements

This script requires VMware PowerCLI
An existing connection to Virtual Centre
VMware Tools 11 or higher
guestinfo.appinfo information is only collected when configured further information about VMware Tools 11 can be found here

Output Example

Windows Guest

Linux Guest

The script is available from Github and VMware Code

Hopefully this is useful

Thanks

Simon