Audit logs track how VMware Aria Operations for Logs is used.

The audit log file audit.log is located in /var/log/vmware/loginsight/. This file logs the following actions:
Category Logged Actions
User authentication
  • Login, logout, and authentication failures.
Access control
  • Creating, removing, and modifying users, groups, roles, and datasets.
Configuration
  • Creating and removing forwarders, vSphere and VMware Aria Operations integrations, and so on.
  • Changing configuration values such as session timeout, SSL, SMTP configuration, and so on.
Content packs
  • Installing, uninstalling, and upgrading.
  • Importing and exporting.
Dashboards and widgets
  • Creating, removing, and modifying.
  • Sharing dashboards.
Administration
  • Configuring agents and enabling auto-update.
  • Upgrading clusters.
  • Adding and removing certificates and licenses.
Alerts
  • Creating, removing, and modifying.
Explore logs
  • Creating, removing, and modifying snapshots and extracted fields.