Vshield App Management; Send Vshield App System Events To A Syslog Server - VMware VSHIELD APP 1.0 Admin Manual

11

vShield App Management

vShield App is an interior, vNIC‐level firewall that allows you to create access control policies regardless of
network topology. A vShield App monitors all traffic in and out of an ESX host, including between virtual
machines in the same port group. vShield App includes traffic analysis and container‐based policy creation.
vShield App installs as a hypervisor module and firewall service virtual appliance. vShield App integrates
with ESX hosts through VMsafe APIs and works with VMware vSphere platform features such as DRS,
vMotion, DPM, and maintenance mode.
vShield App provides firewalling between virtual machines by placing a firewall filter on every virtual
network adapter. The firewall filter operates transparently and does not require network changes or
modification of IP addresses to create security zones. You can write access rules by using vCenter containers,
like datacenters, cluster, resource pools and vApps, or network objects, like Port Groups and VLANs, to
reduce the number of firewall rules and make the rules easier to track.
You can monitor the health of vShield App instances by using the vShield Manager user interface and by
sending vShield App system events to a syslog server.
This chapter includes the following topics:

"Send vShield App System Events to a Syslog Server" on page 63

"Back Up the Running CLI Configuration of a vShield App" on page 64

"View the Current System Status of a vShield App" on page 64

Send vShield App System Events to a Syslog Server

You can send vShield App system events to a syslog server.
To send vShield App system events to a syslog server
1 Log in to the vShield Manager user interface.
2 Select a vShield App from the inventory panel.
3 Click the Configuration tab.
4 Click Syslog Servers.
5 Type the IP Address of the syslog server.
6 From the Log Level drop‐down menu, select the event level at and above which to send vShield App
events to the syslog server.
For example, if you select Emergency, then only emergency‐level events are sent to the syslog server. If
you select Critical, then critical‐, alert‐, and emergency‐level events are sent to the syslog server.
7 Click Add to save new settings. You send vShield App events to up to five syslog instances.
VMware, Inc.
11
63