How to find vCenter Server login record

Products

• VMware vCenter Server

Issue/Introduction

This article is introducing how to search vCenter Server login record from vCenter Server log.

Environment

vCenter Server 8.0

Resolution

• vCenter Server login events are recorded in /var/log/audit/sso-events/audit_events.log as shown below.
  
  
  • Login Successfully:
    
    YYYY-MM-DDTHH:MM:SSZ {"user":"<account name>","client":"<Client IP address>","timestamp":"<timestamp for login>","description":"User <account name>@<Client IP address> logged in with response code 200","eventSeverity":"INFO","type":"com.vmware.sso.LoginSuccess"}
    
    

• • Login Failed:

    YYYY-MM-DDTHH:MM:SSZ {"user":"<account name>","client":"<Client IP address>","timestamp":"<timestamp for login>","description":"User <account name>@<Client IP address> failed to log in with response code 401","eventSeverity":"INFO","type":"com.vmware.sso.LoginFailure"}
    
    

  • Logout:

    YYYY-MM-DDTHH:MM:SSZ {"user":"<account name>","client":"<Client IP address>","timestamp":"<timestamp for logout>","description":"User <account name>@<Client IP address> logged out","eventSeverity":"INFO","type":"com.vmware.sso.Logout"}

Additional Information

Japanese Version : vCenter Serverへのログイン履歴を検索する方法