Re: Which System User Deleted My vApp?

though I think the logs should show who logged in as system (gives it a login id) then the audit event should show what auth code was associated to the action.  It's been a long time since I've had to do something like this.