Explanation
The administrator can find log files containing information related to user login activities on the vCenter Server Appliance, which is a preconfigured Linux-based virtual machine that runs all vCenter Server services.
The log files are located in /var/log/vmware/vmware-vpx/vpxd.log and
/var/log/vmware/sso/ssoAdminServer.log directories. References:
https://docs.vmware.com/en/VMware-vSphere/8.0/com.vmware.vsphere.troubleshooting.doc/GUID-5F9A7E49-