VCF Operations for Logs Harvester

There are times I wanted to search log events in VCF Operations for Logs by shortname/FQDN, even though the log events contained only IPs, here's what I did. All testing and screenshots in this blog are against VCF Operations for Logs 9.0.2 or lower.

I extracted log events via the /api/v2/events API endpoint, converted my shortname/FQDN to an IP, then searched the extracted log events for that IP (and whatever else I was looking for). Ultimately, the tooling is available and documented here.

Here's an example, I'm looking for any log events that contain 192.168.135.140 in the Logs UI.

Running the tooling looks like this:

python3 vcf_logs_harvester.py --host 192.168.135.114 --user admin --provider Local --last 5m --insecure --resolve vcfopscp-135-140

This will connect to the Logs instance using admin (ActiveDirectory is supported as well) and pull log events for 192.168.135.140 (the IP for shortname vcfopscp-135-140) over the last 5 minutes.

root@vr8183-bpeterson [ /tmp ]# python3 vcf_logs_harvester.py --host 192.168.135.114 --user admin --provider Local --last 5m --insecure --resolve vcfopscp-135-140

Resolved vcfopscp-135-140 -> 192.168.135.140

Password for admin@192.168.135.114:

Authenticated as admin via Local (session ttl 1800s)

Window: 2026-09-29T18:49:53.111Z -> 2026-09-29T18:54:53.111Z

Match: text CONTAINS '192.168.135.140'

Server query: text CONTAINS '192.168.135.140'

page 1: 28 events from 2026-09-29T18:49:53.111Z

Sep 29 14:52:38 alderstead vpxd[6633]: Event [15495371] [1-1] [2026-09-29T18:52:38.465343Z] [vim.event.UserLoginSessionEvent] [info] [VSPHERE.LOCAL\Administrator] [] [15495371] [User VSPHERE.LOCAL\Administrator@192.168.135.140 logged in as XML-WS Runtime 4.0.5 git-revision#c828e2e]

Sep 29 14:52:42 alderstead vpxd[6633]: Event [15495372] [1-1] [2026-09-29T18:52:42.967635Z] [vim.event.UserLogoutSessionEvent] [info] [VSPHERE.LOCAL\Administrator] [] [15495372] [User VSPHERE.LOCAL\Administrator@192.168.135.140 logged out (login time: Tuesday, 29 September, 2026 06:52:38 PM, number of API invocations: 2, user agent: XML-WS Runtime 4.0.5 git-revision#c828e2e)]

Sep 29 14:52:45 alderstead vpxd[6633]: Event [15495376] [1-1] [2026-09-29T18:52:45.814333Z] [vim.event.UserLogoutSessionEvent] [info] [VSPHERE.LOCAL\Administrator] [] [15495376] [User VSPHERE.LOCAL\Administrator@192.168.135.140 logged out (login time: Tuesday, 29 September, 2026 06:22:45 PM, number of API invocations: 2, user agent: VMware vim-java 1.0)]

Sep 29 14:52:46 alderstead vpxd[6633]: Event [15495377] [1-1] [2026-09-29T18:52:46.302728Z] [vim.event.UserLogoutSessionEvent] [info] [VSPHERE.LOCAL\Administrator] [] [15495377] [User VSPHERE.LOCAL\Administrator@192.168.135.140 logged out (login time: Tuesday, 29 September, 2026 06:22:46 PM, number of API invocations: 1, user agent: VMware vim-java 1.0)]

Sep 29 14:52:46 alderstead vpxd[6633]: Event [15495378] [1-1] [2026-09-29T18:52:46.339004Z] [vim.event.UserLogoutSessionEvent] [info] [VSPHERE.LOCAL\Administrator] [] [15495378] [User VSPHERE.LOCAL\Administrator@192.168.135.140 logged out (login time: Tuesday, 29 September, 2026 06:22:46 PM, number of API invocations: 1, user agent: VMware vim-java 1.0)]

Sep 29 14:52:46 alderstead vpxd[6633]: Event [15495379] [1-1] [2026-09-29T18:52:46.627637Z] [vim.event.UserLoginSessionEvent] [info] [VSPHERE.LOCAL\Administrator] [] [15495379] [User VSPHERE.LOCAL\Administrator@192.168.135.140 logged in as VMware vim-java 1.0]

Sep 29 14:52:46 alderstead vpxd[6633]: Event [15495380] [1-1] [2026-09-29T18:52:46.904578Z] [vim.event.UserLoginSessionEvent] [info] [VSPHERE.LOCAL\Administrator] [] [15495380] [User VSPHERE.LOCAL\Administrator@192.168.135.140 logged in as VMware vim-java 1.0]

Sep 29 14:52:46 alderstead vpxd[6633]: Event [15495381] [1-1] [2026-09-29T18:52:46.909289Z] [vim.event.UserLogoutSessionEvent] [info] [VSPHERE.LOCAL\Administrator] [] [15495381] [User VSPHERE.LOCAL\Administrator@192.168.135.140 logged out (login time: Tuesday, 29 September, 2026 06:52:46 PM, number of API invocations: 1, user agent: VMware vim-java 1.0)]

Sep 29 14:52:46 alderstead vpxd[6633]: Event [15495382] [1-1] [2026-09-29T18:52:46.941535Z] [vim.event.UserLoginSessionEvent] [info] [VSPHERE.LOCAL\Administrator] [] [15495382] [User VSPHERE.LOCAL\Administrator@192.168.135.140 logged in as VMware vim-java 1.0]

Sep 29 14:52:47 alderstead vpxd[6633]: Event [15495383] [1-1] [2026-09-29T18:52:47.138851Z] [vim.event.UserLoginSessionEvent] [info] [VSPHERE.LOCAL\Administrator] [] [15495383] [User VSPHERE.LOCAL\Administrator@192.168.135.140 logged in as VMware vim-java 1.0]

Sep 29 14:52:47 alderstead vpxd[6633]: Event [15495384] [1-1] [2026-09-29T18:52:47.148373Z] [vim.event.UserLogoutSessionEvent] [info] [VSPHERE.LOCAL\Administrator] [] [15495384] [User VSPHERE.LOCAL\Administrator@192.168.135.140 logged out (login time: Tuesday, 29 September, 2026 06:52:47 PM, number of API invocations: 2, user agent: VMware vim-java 1.0)]

Sep 29 14:52:47 alderstead vpxd[6633]: Event [15495385] [1-1] [2026-09-29T18:52:47.453356Z] [vim.event.UserLoginSessionEvent] [info] [VSPHERE.LOCAL\Administrator] [] [15495385] [User VSPHERE.LOCAL\Administrator@192.168.135.140 logged in as VMware vim-java 1.0]

Sep 29 14:52:47 alderstead vpxd[6633]: Event [15495386] [1-1] [2026-09-29T18:52:47.500065Z] [vim.event.UserLoginSessionEvent] [info] [VSPHERE.LOCAL\Administrator] [] [15495386] [User VSPHERE.LOCAL\Administrator@192.168.135.140 logged in as VMware vim-java 1.0]

Sep 29 14:52:47 alderstead vpxd[6633]: Event [15495387] [1-1] [2026-09-29T18:52:47.774104Z] [vim.event.UserLogoutSessionEvent] [info] [VSPHERE.LOCAL\Administrator] [] [15495387] [User VSPHERE.LOCAL\Administrator@192.168.135.140 logged out (login time: Tuesday, 29 September, 2026 06:52:46 PM, number of API invocations: 1, user agent: VMware vim-java 1.0)]

2026-09-29 18:52:38.465 alderstead.vcfops.lab vcenter-server: User VSPHERE.LOCAL\Administrator@192.168.135.140 logged in as XML-WS Runtime 4.0.5 git-revision#c828e2e

2026-09-29 18:52:42.966 alderstead.vcfops.lab vcenter-server: User VSPHERE.LOCAL\Administrator@192.168.135.140 logged out (login time: Tuesday, 29 September, 2026 06:52:38 PM, number of API invocations: 2, user agent: XML-WS Runtime 4.0.5 git-revision#c828e2e)

2026-09-29 18:52:45.814 alderstead.vcfops.lab vcenter-server: User VSPHERE.LOCAL\Administrator@192.168.135.140 logged out (login time: Tuesday, 29 September, 2026 06:22:45 PM, number of API invocations: 2, user agent: VMware vim-java 1.0)

2026-09-29 18:52:46.301 alderstead.vcfops.lab vcenter-server: User VSPHERE.LOCAL\Administrator@192.168.135.140 logged out (login time: Tuesday, 29 September, 2026 06:22:46 PM, number of API invocations: 1, user agent: VMware vim-java 1.0)

2026-09-29 18:52:46.338 alderstead.vcfops.lab vcenter-server: User VSPHERE.LOCAL\Administrator@192.168.135.140 logged out (login time: Tuesday, 29 September, 2026 06:22:46 PM, number of API invocations: 1, user agent: VMware vim-java 1.0)

2026-09-29 18:52:46.627 alderstead.vcfops.lab vcenter-server: User VSPHERE.LOCAL\Administrator@192.168.135.140 logged in as VMware vim-java 1.0

2026-09-29 18:52:46.904 alderstead.vcfops.lab vcenter-server: User VSPHERE.LOCAL\Administrator@192.168.135.140 logged in as VMware vim-java 1.0

2026-09-29 18:52:46.908 alderstead.vcfops.lab vcenter-server: User VSPHERE.LOCAL\Administrator@192.168.135.140 logged out (login time: Tuesday, 29 September, 2026 06:52:46 PM, number of API invocations: 1, user agent: VMware vim-java 1.0)

2026-09-29 18:52:46.941 alderstead.vcfops.lab vcenter-server: User VSPHERE.LOCAL\Administrator@192.168.135.140 logged in as VMware vim-java 1.0

2026-09-29 18:52:47.137 alderstead.vcfops.lab vcenter-server: User VSPHERE.LOCAL\Administrator@192.168.135.140 logged in as VMware vim-java 1.0

2026-09-29 18:52:47.148 alderstead.vcfops.lab vcenter-server: User VSPHERE.LOCAL\Administrator@192.168.135.140 logged out (login time: Tuesday, 29 September, 2026 06:52:47 PM, number of API invocations: 2, user agent: VMware vim-java 1.0)

2026-09-29 18:52:47.453 alderstead.vcfops.lab vcenter-server: User VSPHERE.LOCAL\Administrator@192.168.135.140 logged in as VMware vim-java 1.0

2026-09-29 18:52:47.500 alderstead.vcfops.lab vcenter-server: User VSPHERE.LOCAL\Administrator@192.168.135.140 logged in as VMware vim-java 1.0

2026-09-29 18:52:47.774 alderstead.vcfops.lab vcenter-server: User VSPHERE.LOCAL\Administrator@192.168.135.140 logged out (login time: Tuesday, 29 September, 2026 06:52:46 PM, number of API invocations: 1, user agent: VMware vim-java 1.0)

Done: 28 events written to stdout

This is particularly useful when searching Operations for Logs for NSX DFW logs by VM shortnames/FQDNs (DFW logs include IPs not shortnames/FQDNs). There are all sorts of other use cases, explore the README.md listed here. Hope this was helpful, enjoy!