SSO login events search and identification in vSphere Client

Products

• VMware vCenter Server

Issue/Introduction

Monitoring Single Sign-On (SSO) activity is essential for auditing access and troubleshooting authentication failures in VMware vCenter Server. This article outlines the procedure for using the vSphere Client event monitor to filter and identify specific com.vmware.sso event types for security and operational analysis.

Environment

vCenter Server 7.x
vCenter Server 8.x
vCenter 9.x

Resolution

1. Log in to the vSphere Client.
2. Select the vCenter Server object in the vSphere Client inventory.
3. Navigate to the Monitor tab and click Events.
4. Filter the Event Type ID column by com.vmware.sso.
5. Review the filtered SSO login events.
   
   • The following events are displayed on Description column.
     
      Login success : Successful login ####@#### from #### at MM/DD/YYYY HH:MM:SS GMT in SSO

 Login failure : Failed login ####@#### from #### at MM/DD/YYYY HH:MM:SS GMT in SSO

Additional Information

How to find vCenter Server login record
Monitoring Events, Alarms, and Automated Actions