VMware Aria Operations displays audit events to provide comprehensive visibility into vCenter server activities, enabling monitoring and analysis of virtual infrastructure events for potential issues or security threats.

Where You Find Audit Events

From the left menu, click Operations > Audit Events to access the Audit Events page. A list of audit events is displayed in a table in the right pane on the page. You can filter the audit events by using the options on the left pane. Click an event in the right pane to see more details. Use the search bar above the table to search for audit events. On the top of the page, you see the number of vCenter servers monitored.
Note: The audit events displayed on the page do not refresh automatically, when you are on the page. Use the Reload option to fetch the latest audit events.

Changing the Time Range

By default, VMware Aria Operations displays audit events for the last 24 hours. You can change this time range by clicking the drop-down menu. The presets available are:
  • Latest 1 hour
  • Latest 6 hours
  • Latest 12 hours
  • Latest 24 hours
  • Latest 48 hours

If you want to select a custom range, use the Start Date, End Date, Start Time and End Time options. The custom range is limited to a 48 hour period. Click Apply to filter the audit events.

View Details

You can click the VIEW DETAILS button to view information about the vCenter servers the audit events are logged from.

The vCenter Servers Status dialog box opens when you click the VIEW DETAILS button. Use the search bar to search for the monitoring status of specific vCenter servers. If a vCenter Server instance that you are aware is present in your datacenter is not being monitored, see the troubleshooting steps in the topic, Troubleshooting Audit Events.