With the release of VMware Cloud Foundation 4.4, we now capture all the API invocation calls, along with user context. The logs also capture user login/logout in the SDDC Manager UI.
The activity log files are defined per service, so the user must know in which log to look.
To help you easier understand in which log file to look, review this reference table
| Log Type | Log File |
|---|---|
| API Login/Token Creation | vcf-commonsvcs |
| Network Pool | vcf-commonsvcs |
| UI Login/Logout | sddc-manager-ui |
| Host Commission/Decommission | operationsmanager |
| Licensing | operationsmanager |
| Certificate Operations | operationsmanager |
| Workload Domain | domainmanager |
| vRealize Suite | domainmanager |
| Lifecycle Ops (pre-check/patching/post-checks) | lcm |
Analyzing the logs
Let’s have a look at what happens when I login to SDDC Manager UI using a browser.
I’m tailing the sddc-manager-ui-activity.log as I login with my account, in the log we can see the timestamp, username and where the login comes from.
Let’s go ahead and decommission a host and see what’s logged, this time I’m tailing operationsmanager-activity.log
We can easily see when someone did what, in this case, martin@vsphere.local started a host decommission at 2022-02-11 08:08:37 (UTC time!)
In this case, a host is being commissioned, again tailing operationsmanager-activity.log as it’s a host operation task.
Here we can see where the user, martin@vsphere.local starts the Commission Host workflow, validates the host and finally starts the host commissioning.
In this example, I’m deleting a Workload Domain, for this I’m tailing domainmanager-activity.log
Thank you very much 🙂