How to find audit logs for manual tag changes on infrastructure resources in Aria Automation

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

When you manually add or remove tags on compute resources, such as vSphere datastores or clusters, within the Aria Automation UI (under Assembler > Infrastructure), you may notice that these actions do not appear in the standard Audit Logs. This makes it difficult to track which user performed the tag modification.

Environment

VMware Aria Automation 8.x

Cause

The audit events for these specific tag management operations are not sent to the main Audit Log service. Instead, they are logged locally in the application log file for the provisioning service on the Aria Automation appliance that processed the request.

Resolution

To locate the audit trail for these tag changes, you must search the correct log file on each appliance in your Aria Automation cluster.

1. Use an SSH client to log in to each of your Aria Automation appliances as root.

2. Navigate to the provisioning service log directory:

   cd /services-logs/prelude/provisioning-service-app/files-logs/

3. Use a command-line tool like grep to search the log file for information related to the event. You can search for the name of the object that was tagged, the tag itself, or the username.

   Example: To find all tag-related events for an object named "vsan-datastore-01", run:

   grep "vsan-datastore-01" provisioning-service-app.log

4. Repeat this process on all nodes in your cluster, as the log entry will only be on the node that handled the specific UI request.

Interpreting the Log Entry

When you find a relevant line in the log, it will contain a JSON payload that describes the operation. Look for the tagsToAdd and tagsToDelete arrays to determine what action was taken.

Example Log Entry for Adding a Tag: Here is a sanitized example of a log entry generated when a tag named "Test-tag" is added to a compute resource.

2025-08-21T11:56:39.653Z INFO provisioning [host="provisioning-service-app-########-#####" thread="xn-index-queries-3" user="" org="" trace="" parent="" span=""] c.v.p.c.m.a.v.VSphereAdapterResourceTogglingService.lambda$handlePatch$1:108 - [/resources/compute/...] Request context: {
  "currentMemoryBytes": 412312584192,
  "ADD": {
    "tagsToAdd": "[\"\\\"Test-tag\\\"\"]",
    "tagsToDelete": "[]",
    "tagsToAddList": "[{\\\"tag\\\":\\\"Test-tag\\\"}]",
    "tagsToDeleteList": "[]"
  },
  "currentCpuCount": 48,
  "state": "ON",
  "machine": "mgmt-cluster-01"
}

In this example, the "tagsToAddList": "[{\\\"tag\\\":\\\"Test-tag\\\"}]" clearly indicates that "Test-tag" was added. If a tag were being removed, it would appear in the tagsToDelete or tagsToDeleteList array instead.

Additional Information

Due to internal log rotation policies on the appliances, local log files will be deleted over time. To ensure long-term retention of audit data, it is highly recommended to configure log forwarding to a centralized syslog system.

The supported method for this is to forward logs from Aria Automation to an instance of Aria Operations for Logs. From there, you can configure Aria Operations for Logs to forward the logs to a third-party syslog system if your organization requires it.