vCenter Logins with Aria Operations for Logs

I wanted to track vCenter logins across my estate, so started exploring Dashboards and Queries provided by the VMware- vSphere Content Pack. I blogged about something similar previously, but it wasn't exactly what I wanted, so I built my own, here's how.

The VMware vSphere Content Pack has dozens of Dashboards, Queries, Alerts, and more. They can be seen here.

One of the Dashboards that piqued my interest was Security - Authentication.

It does provide vCenter logins, but also ESXi Host logins, and more. So I found the Query I wanted and used that to create my own Dashboard, here it is.

If you want it, you can get it here. The top left widget is just a chart over time grouped by vc_event_type. You can adjust this to be a line or area chart if you'd like.

As you can see I'm capturing two vCenter Events, feel free to add more if you'd like.

• com.vmware.vim25.userloginsessionevent

• com.vmware.vim25.badusernamesessionevent

Top right represents that same query, just grouped by vc_username.

You can always adjust these queries to include/exclude what you want.

The second row shows failed login attempts, just grouped differently, here's the query being used for both.

The third row is a representation of vCenter Event Types being received over time, including a table on the right for more details.

Finally, at the bottom, I wanted a detailed list (Field Table) showing the vCenter Events that included "invalid user name" to highlight any suspicious behavior.

This is only one way to do things, but might get you started, enjoy!