How to find details of vCenter login through [email protected] or domain user

Products

• VMware vCenter Server

Issue/Introduction

This is an Information article on how to track the user login events/details. Unusual login activities or "Unauthorized Login" alerts are detected within security monitoring tools or the vSphere Client. This often includes successful GotSession events for users who deny performing the activity. These events typically originate from third-party integrations or automated services.

• An activity has been performed in Vcenter web client through [email protected] credentials.

• It is unclear which user performed the activity.

• /var/log/vmware/sso/websso.log contains the following information:

YYYY-MM-DDTHH:MM:SS INFO websso [52: tomcat-http -- 12] [CorId=######-##-######-#########] [auditlogger] {\"user\":\"[email protected]\", \"client\":\"<system/jump_server IP>\",\"timestamp\":\"MM/DD/YYYY HH:MM:SS GMT\",\"description\":\"User [email protected]@<system/jump_server IP> logged in with response code 200\", \"eventSeverity\":\"INFO\",\"type\":\"com.vmware.sso.LoginSuccess\"}
.
YYYY-MM-DDTHH:MM:SS INFO websso [59: tomcat-http -- 19] [CorId=######-##-######-#########] [auditlogger] {\"user\":\"[email protected]\", \"client\":\"<system/jump_server IP\",\"timestamp\":\"MM/DD/YYYY HH:MM:SS GMT\", \"description\":\"User [email protected]@<system/jump_server IP> logged out\", \"eventSeverity\": \"INFO\", \"type\":\"com.vmware.sso.Logout\"}

Environment

• vCenter 7.x
• vCenter 8.x
• vCenter 9.x

Cause

A third-party appliance (e.g., backup software, monitoring tool, or automation script) is performing automated session cloning or logins using cached user credentials.

Resolution

To identify the source of the login:

1. Locate the login event in vpxd.log or journalctl using the reported timestamp and username: [vim.event.UserLoginSessionEvent] [info] [User [USER] logged in]
2. Find the Session ID in vpxd-profiler.log corresponding to that timestamp: --> /SessionStats/SessionPool/Session/Id='########-####-####-####-############'/Username='[USER]'
3. Identify the Source IP by searching vpxd.log for the Session ID to find the ClientIP.
4. Identify the device associated with the logged IP address and verify if it is a service account or an appliance.
5. Update the credentials on the identified third-party appliance or engage the vendor to adjust the login frequency.