A container was moved by some user, I was not able to identify any evidence from changes made through container's events.
When a container is created/changed/moved are not generated events for this actions?
Have you tried this Tip?
Tuesday Tip: How to enable user event logging
There is also http://www.ca.com/us/support/ca-support-online/product-content/knowledgebase-articles/tec516965.aspx that talks about using the log_user_events parameter in the .vnmrc file.
Care should be taken when using this parameter as it could result in a significant increase in logged events.