Configuring Audit Events

Configure integration with VMware Aria Operations for Logs to see audit events from vCenter Servers.

Prerequisites

Ensure that you have the following versions:

• VMware Aria Operations version 8.18+

• VMware Aria Operations for Logs version 8.18+

  For more information, see the topic, Upgrading VMware Aria Operations for Logs.

Bi-directional integration between VMware Aria Operations and VMware Aria Operations for Logs is a prerequisite. This means, you must:

• Configure the VMware Aria Operations for Logs management pak within VMware Aria Operations, directing it to a VMware Aria Operations for Logs instance.
• Configure VMware Aria Operations integration within the VMware Aria Operations for Logs environment, pointing it to the VMware Aria Operations instance.

Note: Only one VMware Aria Operations for Logs instance can be integrated with VMware Aria Operations.

Note: You must manually configure VMware Aria Operations for Logs to monitor vCenter servers. Audit events can monitor and report audit events for vCenter Servers coming through l VMware Aria Operations for Logs instance which is connected via log forwarding.

Procedure

1. From the left menu, click Operations > Audit Events.
2. If you have not configured VMware Aria Operations, you will not see any information related to audit events. Install VMware Aria Operations for Logs first.
   1. Install VMware Aria Operations for Logs. For more information, see the Getting Started with VMware Aria Operations for Logs documentation.
   2. Register the vCenter Server instances in VMware Aria Operations for Logs. For more information, see the topic, Configure VMware Aria Operations for Logs to Pull Events, Tasks, and Alarms from vCenter Server Instance.
   3. After you install VMware Aria Operations for Logs, you must configure the VMware Aria Operations for Logs management pack from the Administration > Integrations page in VMware Aria Operations. For more information, see the topic, Configuring VMware Aria Operations for Logs with VMware Aria Operations.
   4. Configure the VMware Aria Operations for Logs instances which forward logs to the VMware Aria Operations for Logs which is integrated with VMware Aria Operations. For more information, see the topic, Configure VMware Aria Operations for Logs to Pull Events, Tasks, and Alarms from vCenter Server Instance.
3. Verify that you can see the audit events in the Audit Events page.