[VMC on AWS] Unable to see csp-audit events on vRealize Log Insight Cloud

Products

• VMware Aria Suite
• VMware Cloud on AWS

Issue/Introduction

This article provides information on how to display the csp-audit events on vRealize Log Insight Cloud.

Symptoms:
Unable to see VMware Cloud Services Audit Events on vRealize Log Insight Cloud with the following query.

・Query：text | Contains | csp__user_login

Cause

This issue occurs due to lack of user roles permissions.

Resolution

csp-audit logs can be viewed only by users with "Organization Owner" and "vRealize Log Insight Cloud Admin" permissions.

Please check the current user roles from the following location.
・VMC Console > Org > My Account > My Roles tab
　- Organization Roles：Organization Owner 
　- Service Roles：vRealize Log Insight Cloud Admin

If you do not have the above roles, please contact your organization owner to assign the above roles.

Additional Information

VMware Cloud Services Audit Events
Organization Roles and Permissions
Assign a VMC Service Role to an Organization Member