Does anyone know where SDDC Manager stores security logs for VCF or root logins (successes and failures)? 

I was able to find the UI logins under sddc-manager-ui-activity.log but cannot find security logs for SSH or using the console to log in with root/vcf accounts.

Any help would be appreciated.