Using HTML5 vSphere Client access logs to analysis user operation history

Products

• VMware vCenter Server

Issue/Introduction

The HTML5 vSphere Client was introduced with vSphere 6.5 GA.
HTML5 vSphere Client access log contains more detail information about individual HTTP requests from the Web browse,

This article provides several HTML5 vSphere Client access log analysis samples base HTML5 vSphere Client log file: localhost_access_log. <date>.txt

Environment

VMware vCenter Server 6.5.x
VMware vCenter Server Appliance 6.5.x
VMware vCenter Server Appliance 6.7.x
VMware vCenter Server 6.7.x
VMware vCenter Server Appliance 7

Resolution

The HTML5 vSphere Client access logs are placed in a different directory on disk depending on vCenter Server version and the deployed platform:

vCenter Server 6.5 and later versions on Windows : C:\ProgramData\VMware\vCenterServer\logs\vsphere-ui\logs\access

File name :localhost_access_log. <date>.txt

vCenter Server Appliance 6.5 and later versions: /var/log/vmware/vsphere-ui/logs/access

File name: localhost_access_log. <date>.txt

1 Navigate related HTTP request log sample:

1-1 List Virtual Machine
“GET /ui/list/listOptions/vsphere.core.vm.list?listViewType=VirtualMachine”

1-2 List ESXi host
“GET /ui/list/listOptions/vsphere.core.host.list?listViewType=HostSystem”

1-3 List Datastore
“GET /ui/list/listOptions/vsphere.core.datastore.list?listViewType=Datastore”

1-3 List Network
“GET /ui/list/listOptions/vsphere.core.network.list?listViewType=HostNetwork”

2 Power off multiple VM related HTTP request log sample:

2-1 Select Multiple VM and Click Power off
“POST /ui/actionsService/actions/evaluations?actionUids=vsphere.core.vm.powerOffAction”

2-2 Click “Yes” to perform multiple VM Power off, notice “vm-ID:UUID” will show the actual vm-ID and UUID in log files:
"POST /ui/mutation/applyOnMultiEntity?objectIds=urn:vmomi:VirtualMachine:vm-ID:UUID&objectIds=urn:vmomi:VirtualMachine:vm-ID:UUID&propertyObjectType=com.vmware.vsphere.client.vm.powerops.VmPowerStateSpec HTTP/1.1"

3 VM Clone related HTTP request log sample:

"POST /ui/mutation/add?propertyObjectType=com.vmware.vsphere.client.vm.VmCloneSpec HTTP/1.1"

4 Unregister multiple VM related HTTP request log sample:

4-1 Select Multiple VM and Click Unregister:
”POST /ui/actionsService/actions/evaluations?actionUids=vsphere.core.vm.actions.unregisterAction&skipActionFilteringStage=true HTTP/1.1"

4-2 Click “Yes” to perform multiple VM Unregister, notice “vm-ID:UUID” will show the actual vm-ID and UUID in log files:

"POST /ui/mutation/removeOnMultiEntity?objectIds=urn:vmomi:VirtualMachine:vm-ID:UUID&objectIds=urn:vmomi:VirtualMachine:vm-ID:UUID&propertyObjectType=com.vmware.vsphere.client.vm.VmRemovalSpec HTTP/1.1"

5 Delete multiple VM related HTTP request log sample:

5-1 Select Multiple VM and Click delete:
"POST /ui/actionsService/actions/evaluations?actionUids=vsphere.core.vm.actions.deleteAction&skipActionFilteringStage=true HTTP/1.1"

5-2 Click “Yes” to perform multiple VM delete, notice “vm-ID:UUID” will show the actual vm-ID and UUID in log files:
"POST /ui/mutation/removeOnMultiEntity?objectIds=urn:vmomi:VirtualMachine:vm-ID:UUID&objectIds=urn:vmomi:VirtualMachine:vm-ID:UUID&propertyObjectType=com.vmware.vsphere.client.vm.VmRemovalSpec HTTP/1.1"