Finding the user that deleted or detached tags

Products

• VMware vCenter Server

Issue/Introduction

You need to identify which user deleted or detached a tag from an object within the vCenter Server environment.

This action is not always immediately clear from the UI and requires reviewing the backend logs or journalctl to correlate the detachment event with the user session.

Environment

VMware vCenter Server 8.x

Cause

This is an operational task to audit and track tagging administrative actions in the environment.

Resolution

You can identify the user who detached a tag by querying either journalctl or the vpxd-svcs logs.

Note: In the log examples below, sensitive data such as specific usernames, domains, and hostnames have been removed and replaced with generic placeholders.

Option 1: Using journalctl

1. Access your vCenter Server via SSH and log in as root.

2. Run the following command to filter the journal for detached tags and output the associated user and machine:

   • less journalctl_-b--*.txt | grep "detached tag(s)" | awk  '{print $12,$27}' | sort

3. The output will display the domain, username, and the server name associated with the action:

             [DOMAIN\Username] SERVER-NAME]

             [DOMAIN\Username] SERVER-NAME]

 

Option 2: Using vpxd-svcs Logs

1. Access your vCenter Server via SSH and log in as root.

2. Search the vpxd-svcs logs for the DETACH string to find the exact time the event occurred:

3. You will receive output detailing the detachment event. Note the timestamp of the operation:

            

2026-06-11T07:43:19.763Z [dataservice-6 [] INFO  com.vmware.cis.server.util.VpxdEventGenerator  opId=689c2720-e6bb-4996-b17a-2cd7d7efa50f IS] Scheduling post event on VC for TAGGING:DETACH
2026-06-11T07:43:19.768Z [pool-13-thread-1 [] INFO  com.vmware.cis.server.util.VpxdEventGenerator  opId=] Posting DETACH event to VC: Rubrik -Tier III Daily 1 Month to urn:vmomi:VirtualMachine:vm-144616:01a11a20-75b1-4ddc-9c7c-77bac579885d
2026-06-11T07:43:19.776Z [dataservice-6 [] INFO  com.vmware.cis.core.tagging.vmodl.MoTagManager  opId=689c2720-e6bb-4996-b17a-2cd7d7efa50f IS] Detached 1 tags from 1 objects

     

     4. Scroll up a few lines prior to this timestamp in the log. This will show the authentication token being created and identify the user who performed the detachment:

2026-06-11T07:43:19.703Z [authz-service-6 [] INFO  com.vmware.vim.sso.client.impl.SecurityTokenServiceImpl  opId=1e17c16e-f491-4eda-8f38-963a40f798a9] Successfully acquired token for user: {Name: Username, Domain: domain.local}
2026-06-11T07:43:19.703Z [authz-service-6 [] INFO  com.vmware.cis.authorization.impl.AuthorizationManagerImpl  opId=1e17c16e-f491-4eda-8f38-963a40f798a9] Session count for user [after add]: DOMAIN\Username is 3
2026-06-11T07:43:19.703Z [authz-service-6 [] INFO  com.vmware.cis.server.authentication.impl.MoSessionManager  opId=1e17c16e-f491-4eda-8f38-963a40f798a9] Logged in user: "DOMAIN\Username"