How to find vCenter Server login record

Products

• VMware vCenter Server

Issue/Introduction

This article is introducing how to search vCenter Server login record from vCenter Server log.

Environment

vCenter Server 8

Cause

N/A

Resolution

1. vCenter Server login record can be found in "/var/log/audit/sso-events/audit_events.log"
2. Regarding operations below:

   • Login Successfully:

     YYYY-MM-DDTHH:MM:SSZ {"user":"<account name>","client":"<Client IP address>","timestamp":"<timestamp for login>","description":"User <account name>@<Client IP address> logged in with response code 200","eventSeverity":"INFO","type":"com.vmware.sso.LoginSuccess"}

      

   • Login Failed:

     YYYY-MM-DDTHH:MM:SSZ {"user":"<account name>","client":"<Client IP address>","timestamp":"<timestamp for login>","description":"User <account name>@<Client IP address> failed to log in with response code 401","eventSeverity":"INFO","type":"com.vmware.sso.LoginFailure"}

      

   • Logout:

     YYYY-MM-DDTHH:MM:SSZ {"user":"<account name>","client":"<Client IP address>","timestamp":"<timestamp for logout>","description":"User <account name>@<Client IP address> logged out","eventSeverity":"INFO","type":"com.vmware.sso.Logout"}