A BIG-IP Administrator needs to determine who changed a Virtual Server configuration.

The audit log (/var/log/audit) records configuration changes made on the BIG-IP system, including:

Who made the change (user account)

What was changed (for example, a virtual server modification)

When the change occurred

How it was performed (GUI, TMSH, or API)

Why the other options are incorrect:

/var/log/secure logs authentication events such as login successes and failures, not configuration changes.

/var/log/ltm logs traffic-management and runtime LTM events, not administrative configuration modifications.

Therefore, the correct log file for tracking who changed a virtual server is /var/log/audit.