User Auditing Log locations for Aria Automation 8.x
search cancel

User Auditing Log locations for Aria Automation 8.x

book

Article ID: 394870

calendar_today

Updated On:

Products

VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

This article provides detailed information about the log locations where all user activities are logged in Aria Automation . It helps administrators monitor user behavior, track login attempts, identify what actions users are performing, and determine where they are accessing the system from.

Environment

VMware Aria Automation 8.x

Resolution

Envoy Logs
 This log tracks user interactions within the platform and provides insight into API calls and authentication requests The log is located at:

/var/log/services-logs/prelude/envoy/file-logs/envoy.log

Identity Service Logs
 This log contains entries related to user authentication and authorization processes, such as login attempts, token generation, and user validation. You can find this log at:

/var/log/services-logs/prelude/identity-service-app/file-logs/identity-service-app.log

These logs are helpful for troubleshooting authentication issues, ensuring that the correct access permissions are being applied, and auditing user activity.

Envoy Log Sample:

[2025-04-07T15:17:30.992Z] "GET /csp/gateway/slc/api/definitions?expand=1 HTTP/2" 200 - 0 1443 52 51 "Ip address" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36" "0cc###e6-###-b5bb0fb5###" "Domain name" "Ip address with port"
[2025-04-07T15:17:31.011Z] "GET /csp/gateway/slc/api/v2/ui/definitions/?orgId=7169cb4c-9e77-4e68-###f960&locale=en&hideHelperServices=true HTTP/2" 200 - 0 881 42 42 "Ip address" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36" "cd01abeb-f6bf-44ac-9b###dd33123###a25" "Domain name" "Ip address with port"
[2025-04-07T15:17:31.028Z] "GET /csp/gateway/am/api/loggedin/user/orgs/71###9cb4c-9e77-4e6###c43f5aa###0/roles HTTP/2" 200 - 0 229 38 37 "Ip address" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36" "a63###7d-7b4c-40d###-85e6-419###" "Domain name" "Ip address with port"

Identity Service App log Example:

2025-04-07T15:30:08.730Z INFO identity-service [host='identity-service-app-6#####65-wf##g7' thread='reactor-http-epoll-2' user='' org='' trace='67f3ef80524###########' parent='c25326###84ebc' span='c641b77###8bd2b4'] c.v.i.r.AuthenticatedRestClientFactoryImpl.getCustomAuthorizationClient:72 - Getting custom rest client with NO authorization header.
2025-04-07T15:30:08.731Z INFO identity-service [host='identity-service-app-6#####65-wf##g7' thread='reactor-http-epoll-2' user='' org='' trace='67f3ef80524cf9c###########' parent='c253###b84ebc' span='c641b77b4###2b4'] com.vmware.identity.rest.RestClient.lambda$logRequest$1:86 - POST https://[DNS NAME]/SAAS/API/1.0/oauth2/token?grant_type=authorization_code
2025-04-07T15:30:08.777Z INFO identity-service [host='identity-service-app-6#####65-wf##g7' thread='reactor-http-epoll-2' user='' org='' trace='67f3ef80524c###########' parent='c253269b###b84ebc' span='c641b77###d2b4'] c.v.i.s.impl.IdpAuthenticationService.lambda$getTokenByAuthorizationCode$7:148 - User with username: {###} has logged in through the UI.{###}
2025-04-07T15:30:08.779Z INFO identity-service [host='identity-service-app-6#####65-wf##g7' thread='reactor-http-epoll-2' user='' org='' trace='67f3ef80524c#########' parent='c25326###ebc' span='c641b######d2b4'] com.vmware.identity.rest.RestClient.lambda$logRequest$1:86 - POST https://DNS Name/SAAS/API/1.0/oauth2/token?grant_type=client_credentials
2025-04-07T15:30:08.805Z INFO identity-service [host='identity-service-app-6#####65-wf##g7' thread='reactor-http-epoll-2' user='' org='' trace='67f3ef80524c#########' parent='c253########ab84ebc' span='c641b######bd2b4'] com.vmware.identity.rest.RestClient.lambda$logRequest$1:86 - GET https://DNS Name/SAAS/jersey/manager/api/scim/Users/1d2214###4a-7f2b-4###5c5a5###b0ef
2025-04-07T15:30:08.847Z INFO identity-service [host='identity-service-app-6#####65-wf##g7' thread='parallel-1' user='' org='' trace='67f3ef80524cf9c6########' parent='c253###7ab8###c' span='c6###77b####d2b4'] com.vmware.identity.rest.RestClient.lambda$logRequest$1:86 - POST https://DNS Name/SAAS/API/1.0/oauth2/token?grant_type=client_credentials
2025-04-07T15:30:08.873Z INFO identity-service [host='identity-service-app-6#####65-wf##g7' thread='reactor-http-epoll-3' user='' org='' trace='67f3ef80524cf9c6########' parent='c253269###ab84ebc' span='c641b77######d2b4'] com.vmware.identity.rest.RestClient.lambda$logRequest$1:86 - POST https://{DNS NAME}/SAAS/jersey/manager/api/scim/Groups/.search
2025-04-07T15:30:08.908Z INFO identity-service [host='identity-service-app-6#####65-wf##g7' thread='reactor-http-epoll-3' user='' org='' trace='67f3ef80524##########' parent='c253x9####b84ebc' span='c6###77b4###2b4'] c.v.i.s.impl.IdpAuthenticationService.saveTokensToDb:158 - Saving tokens from authorization code flow to database.
2025-04-07T15:30:08.916Z INFO identity-service [host='identity-service-app-6#####65-wf##g7' thread='reactor-http-epoll-1' user='' org='' trace='67f3ef80524c#########' parent='' span='2b73a7########175a'] reactor.netty.http.server.AccessLog.info:279 - {IP Address - - [07/Apr/2025:15:30:08 +0000] "POST /csp/gateway/am/api/auth/token HTTP/1.1" 200 3128 8080 243 ms

 

Additional Information

For any further assistance or questions regarding log management and troubleshooting, feel free to reach out to Broadcom support or consult the official VMware documentation.

Powered by Wolken Software