Activity tracking events for VCF as a Service

IBM Cloud® services, such as VMware Cloud Foundation (VCF) as a Service, generate activity tracking events.

Activity tracking events report on activities that change the state of a service in IBM Cloud. You can use the events to investigate abnormal activity and critical actions and to comply with regulatory audit requirements.

You can use IBM Cloud Activity Tracker Event Routing, a platform service to route auditing events in your account to destinations of your choice by configuring targets and routes that define where activity tracking events are sent. For more information, see About IBM Cloud Activity Tracker Event Routing.

You can use IBM Cloud Logs to visualize and alert on events that are generated in your account and routed by IBM Cloud Activity Tracker Event Routing to an IBM Cloud Logs instance.

As of 28 March 2024, the IBM Cloud Activity Tracker service is deprecated and will no longer be supported as of 30 March 2025. Customers will need to migrate to IBM Cloud Logs before 30 March 2025. During the migration period, customers can use IBM Cloud Activity Tracker along with IBM Cloud Logs. Activity tracking events are the same for both services. For information about migrating from IBM Cloud Activity Tracker to IBM Cloud Logs and running the services in parallel, see Migrating to IBM Cloud Logs.

Locations where activity tracking events are generated

VCF as a Service generates activity tracking events in the regions that are indicated in the following table.

Regions where activity tracking events are generated in Americas locations
Dallas (`us-south`)	Washington (`us-east`)	Toronto (`ca-tor`)	Sao Paulo (`br-sao`)
Yes	Yes	Yes	No

Regions where activity tracking events are generated in Asia Pacific locations
Tokyo (`jp-tok`)	Sydney (`au-syd`)	Osaka (`jp-osa`)	Chennai (`in-che`)
Yes	Yes	No	No

Regions where activity tracking events are generated in Europe locations
Frankfurt (`eu-de`)	London (`eu-gb`)
Yes	Yes

Locations where activity tracking events are sent to IBM Cloud Activity Tracker hosted event search

VCF as a Service sends activity tracking events to IBM Cloud Activity Tracker hosted event search in the regions that are indicated in the following table.

Regions where activity tracking events are sent in Americas locations
Dallas (`us-south`)	Washington (`us-east`)	Toronto (`ca-tor`)	Sao Paulo (`br-sao`)
Yes	Yes	Yes	No

Regions where activity tracking events are sent in Asia Pacific locations
Tokyo (`jp-tok`)	Sydney (`au-syd`)	Osaka (`jp-osa`)	Chennai (`in-che`)
Yes	Yes	No	No

Regions where activity tracking events are sent in Europe locations
Frankfurt (`eu-de`)	London (`eu-gb`)
Yes	Yes

Viewing activity tracking events for VCF as a Service

VCF as a Service events are global events. For more information, see Monitoring global and location-based events.

Launching IBM Cloud Logs from the VMware Solutions console

Activity Tracker can have only one instance per location. To view events, you must access the web UI of the Activity Tracker service in the same location where your service instance is available. For more information, see Navigating to the UI.

Launching IBM Cloud Logs from the Observability page

For information on launching the IBM Cloud Logs UI, see Launching the UI through the IBM Cloud UI.

Events that are related to virtual data centers

Events are generated to track how users and applications interact with virtual data centers (VDCs). The following table lists the actions that generate and send events to Activity Tracker.

Description of actions that generate events related to VDCs
Action	Description
`vmware.vdc.create`	An event is generated when a VDC instance is created.
`vmware.vdc.delete`	An event is generated when a VDC instance is deleted.
`vmware.vdc.update`	An event is generated when a VDC instance is modified.
`vmware.sharedsite.create`	An event is generated when the VMware Cloud Director™ site creates a VDC on the multitenant site for the first time.
`vmware.sharedsite.delete`	An event is generated when the VMware Cloud Director site deletes a VDC on the multitenant site.

Events that are related to director site management

Events are generated when you access VMware Cloud Director in VCF as a Service. The following table provides the actions that generate and send events to Activity Tracker.

Description of actions that generate events related to VMware Cloud Director site management
Action	Description
`vmware.directorsite.create`	An event is generated when a VMware Cloud Director site is created.
`vmware.directorsite.delete`	An event is generated when a VMware Cloud Director site is deleted.
`vmware.directorsite-pvdc.create`	An event is generated when a VMware Cloud Director site resource pool is created.
`vmware.directorsite-pvdc.delete`	An event is generated when a VMware Cloud Director site resource pool is deleted.
`vmware.directorsite-cluster.create`	An event is generated when a VMware Cloud Director site cluster is created.
`vmware.directorsite-cluster.delete`	An event is generated when a VMware Cloud Director site cluster is deleted.
`vmware.directorsite-host.add`	An event is generated when a host is added to a VMware Cloud Director site.
`vmware.directorsite-host.remove`	An event is generated when a host is removed from a VMware Cloud Director site.
`vmware.directorsite-nfs-storage.add`	An event is generated when NFS storage is added to a VMware Cloud Director site.
`vmware.directorsite-nfs-storage.remove`	An event is generated when NFS storage is removed from a VMware Cloud Director site.
`vmware.directorsite.password-reset`	An event is generated when the user password for a VMware Cloud Director site is reset.
`vmware.directorsite-iam.config`	An event is generated when the OpenID Connect (OIDC) for a VMware Cloud Director site is configured.
`vmware.directorsite-iam.read`	An event is generated when the OIDC for a VMware Cloud Director site is checked. Monitoring is not enabled yet.