The vCenter Hyperic audit subsystem logs changes made to alert definitions. When an alert definition is enabled, disabled, or deleted, the event is written to the database. The information includes the username of the person who made the change.

You can configure vCenter Hyperic server to also write the audit events to the server.log file in the server's logs directory.

Add the following section to ServerHome/conf/server-log4j.xml

<!-- Use this category to log every instance of a group alert firing.
          Comment out if the log messages become unwieldy. -->
 <category name="org.hyperic.hq.galerts.processor.MemGalertDef.Fired">
   <priority value="DEBUG" />

name="org.hyperic.hq.common.server.session.AuditManagerEJBImpl"> <!--SEE
HERE -->
    <priority value="DEBUG"/>

This section should be added before the root stanza.

The entries are written to logs/server.log, similar to the following:

2009-03-18 15:56:20,088 INFO
 Audit Manager starting up2009-03-18 15:58:28,223 DEBUG
msg=HQ Started]2009-03-18 16:01:12,114 DEBUG
resource=,msg=HQ Administrator logged in]
2009-03-18 16:05:18,485 DEBUG [http-]
resource=Linux,msg=Alert definition deleted (High Load)]