How do I observe current and past traffic history?

[Box293]

We have been using VMware vCloud Networking and Security in our test and dev environment and will be implementing this into production soon. I am still unsure how I can observe current and past traffic history for troubleshooting purposes.

Specifically I am talking about a vShield Edge that I have deployed.

Let me use Microsoft ISA Server 2006 as an example of what I am talking about.

• I can open ISA Server Management MMC
  
• In here I can go to Monitoring > Logging
  
• For current traffic observation
  
  • I can define a query with criteria such a Client IP and Log Time = Live
    
  • I can then watch this live log as I attempt to reproduce the client issue I am having which helps me diagnose things like "oh I need to open that port"
    
• For past traffic history
  
  • I can define a query with criteria such a Client IP and Log Time = Specific Time Period
    
  • I can then read through the logs for this specific time period to help me diagnose the issue that was reported to me\
    

How can I perform this functionality on a vShield Edge?

I currently have deployed vShield Mananger 5.1.1-848085 which has been used to deploy the vShield Edge into our test and dev environment.

[Box293]

Looks this functionality doesn't exactly exist right now.

Here are some options:

SYSLOG Server

• Poing the vShield appliance at a SYSLOG server
• Allows you to look back in time
• Requires you to setup a syslog server if you don't have one

SSH to vShield appliance

• Here you can watch network traffic in action
• Using commands like:
  • show flowtable flowspec srcip=192.168.175.78
    • Only shows you live traffic, does not show you history
  • show log follow
    • Shows live traffic as it happens
  • show log
    • Lets you see what has happened in the past
  • using these log commands requires that the firewall rules have logging enabled

Would like to know of any other methods that can be used.