To monitor audit events in vSphere, follow these steps:
1. Log in to the vSphere Web Client with administrator credentials.
1. Navigate to the vCenter Server or host that you want to monitor and click on the “Configure” tab.
1. Under the “System” section, click on “Advanced Settings”
1. In the Advanced Settings page, search for the configuration parameter “config.vpxd.audit.logger” and make sure that its value is set to “info, vpextn.auditlog”. If it is not, change the value to this.
1. Click on “OK” to save the changes.
1. Now, navigate to the “Administration” tab in the vSphere Web Client and click on “System Configuration”.
1. Select “Events” from the left sidebar, and then click on “Filters”
1. In the Filters window, create a new filter by clicking on the “Create” button.
1. Specify the filter conditions such as specific event types (e.g., power on, power off, etc.), time range, and other parameters.
1. Click on “OK” to save the filter.
1. You can now view the audit events that match the filter criteria by clicking on the “Monitor” tab and selecting “Tasks & Events”. The relevant audit events will appear in the list.
1. To further analyze the audit events, you can export the data to a CSV file or send them to a syslog server for further processing.
Note: Audit logging can cause performance issues, so it is recommended to configure audit logging only on an as-needed basis.
