Enable Local Auditing with ESXCLI

You can use ESXCLI to configure local auditing.

The following example specifies the size of the audit record storage capacity and enables the audit record storage. Specify one of the options listed in Connection Options for ESXCLI Host Management Commands in place of <conn_options>.

Note: The size of the audit record storage capacity is measured in kilobytes in ESXi 7.0 and earlier, and in megabytes in ESXi 7.0 Update 1 and later.

Procedure

1. Specify the audit record storage capacity.
   • If you are running the command against ESXi 7.0 or earlier, specify the value of the --size parameter in kilobytes.

     esxcli <conn_options> system auditrecords local set --size=4096

   • If you are running the command against ESXi 7.0 Update 1 or later, specify the value of the --size parameter in megabytes.

     esxcli <conn_options> system auditrecords local set --size=4

2. Enable the audit record storage.

   esxcli <conn_options> system auditrecords local enable