Unable to see Audit events in VMware Aria Operations.

Products

• VCF Operations
• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

VMware Aria Operations, Audit Events do not appear in the Operations > Audit events menu with following error message: "Audit Events are available for 0 out of x vCenter Servers"

Environment

Aria Operations 8.18.x

Cause

 Bidirectional sync between VMware Aria Operations for Logs and VMware Aria Operations was not configured. 

Resolution

Review Integrations

• Verify from Aria Operations for Logs -> Integrations that the Aria Operations integration is configured and that test connection works.
  
  
• Verify from Aria Operations -> Integrations that the integration for Aria Operations for logs is configured and that validate connection works. 

Verify that Aria Operations for logs has the Audit events in question

• Go to the Log Explorer page, then click on the Star at the right side of the search
  
  
  
  
• Then add the query below in the Notes Section and hit Save
  
  SELECT COUNT(item0) FROM ((timestamp>=1763610361466 AND timestamp<=1763696761467) AND (((FIELD_EXISTS(vc_event_chain_id) AND FIELD_EXISTS(vmw_vr_ops_id)) AND FIELD_EXISTS(vc_event_cat_0)) AND FIELD_EXISTS(vmw_vcenter))) AS item0 WHERE APPEAR(item0)>0 GROUP BY item0.vmw_vcenter HAVING COUNT(item0)>0 ORDER BY COUNT(item0) DESC
  
  
  
  
• Then click the left star and change the date to Latest hour of data.
  
  
  
  
• This is the query that Aria Operations uses to populate the Audit page from Ops for Logs. If you see log results, then the logs are collected in Aria Operations for Logs

Additional Information

Configuring Audit Events

Troubleshooting Audit Events

Configuring VMware Aria Operations for Logs with VMware Aria Operations

Requirements for Integrating With VMware Aria Operations

Configure an ESX Host to Forward Log Events to VMware Aria Operations for Logs