Font size: +

VMware NetFlow and EventLog configuration


VMware is a ubiquitous name in the virtualization world. It includes ESXi, VMware Workstation, Tanzu and many other products. These products are the first thing that comes up when people talk about virtual machines and other items dependent on them. In this post, we focus on ESXi, VMware's bare-metal hypervisor, and vCenter, VMware's multi-system management software.

NetFlow configuration

VMware allows only setting NetFlow monitoring on distributed switches, not regular vSwitches. VMware vSphere Distributed Switch (VDS) is a centralized interface in the VMware cluster from which you can configure, monitor and administer virtual machine access switching for the entire data center. To configure NetFlow on a distributed switch, go to Configure tab, select the option NetFlow, and click on the edit button on the right side of the page.

This will lead to a new screen where you can configure everything about the NetFlow exporter. When the sampling rate is 0, you will send all NetFlow packets, which can be a strain on your interfaces. Therefore, we would recommend a sampling rate of 50-4096, depending on your traffic volume (more volume means a higher ratio). Next, choose for which Distributed Port Group and Uplink you want to enable NetFlow. There is also an override option, to turn off Netflow collecting on specific ports.

Now you should see NetFlow data in your NetFlow collector and analyzer software. To get your interfaces resolved by name, you need to enable SNMP with the following commands: 

EventLog configuration

Syslog exporting is rather simple, as you only need the following CLI commands:

where is the syslog collector's IP address, listening on port number 514.
Afterward, all you need to add are firewall rules and reload. Promptly you should receive syslog messages:

SonicWall NetFlow and EventLog configuration
OpenWrt NetFlow and EventLog configuration

Related Posts


Mailing and Visiting Address:
Soneco d.o.o.
Makenzijeva 24/VI, 11000 Belgrade, Serbia
Phone: +381.11.6356319
Fax: +381.11.2455210 |


linkedin facebook facebook