vCenter session log/API requests log

[Danco74]

Hello everyone,

Some external source is performing operations on our vCenter, and I'm trying to figure out where it comes from.

I'm look for a log that will give me the follow information

Source IP and the action it was performing(in a form of soap message maybe)

Can you help me out?

Dan.

[Frank Escaros-Buechsel]

vCenter tasks and events will actually show you exactly that. The tasks performed by which user from which IP.

Additionally you can find established sessions with their username and originating IP in the vpxd-profiler.log files but they are a bit tricky to parse if you have never done that before.

Actual SOAP message logging is also possible by bumping up the vCenter log level (I am not entirely sure if trivia is needed or not on that).

A third option would be to utilize the free Log Insight option with the vSphere dashboard, see screenshot below.

Hope that helps.

[Danco74]

This is the kind of answer I was hoping to get, thank you so much.

[Danco74]

Where exactly can I find the source IP in Task & Events.
For example I've just deleted a virtual machine, where can I find it?