I did a quick test in lab by configuring the command "enable cli-config-logging" in switch. It enables the logging of CLI configuration commands to the Syslog for auditing purposes.
I did a packet capture in Ridgeline server to confirm the syslog messages are received for creating/deleting the vlan. Then, I have configured "New Alarm definition" matching the log pattern "*Info:cli.logLocalCmd*" and "cli:" and "local0" (used from packet capture) and it is not working by using this pattern. There are few pre-defined events which are available in Ridgeline and it will work based on trigger to generate the alarm mail. However, for the above query we need more testing need to be done. To proceed further, please open a case with GTAC.