View the Logs for a Virtual Service in the VMware Cloud Director Tenant Portal

Starting with VMware Cloud Director 10.5.1, you can view detailed logs for the virtual services that you configured.

The virtual service logs include WAF signature violation logs that are always categorized as critical.

Prerequisites

• Verify that you are logged in as an organization administrator.

• Verify that your system administrator has enabled load balancing on the NSX edge gateway.
• Verify that your system administrator has assigned at least one service engine group to the edge gateway.
• Add a load balancer server pool to the edge gateway.
• Create a virtual service.

Procedure

1. From the primary left navigation panel, select Networking and from the page top navigation bar, select Edge Gateways.
2. Click the NSX edge gateway on which the virtual service is configured.
3. Click the virtual service name and then click the Logs tab.
   A list of the virtual service logs for the selected period is displayed. You can filter the results by log type (if non-critical logging is enabled), client IP, URI, request type and response.
4. If you suspect that the WAF signature violations list contains a false positive, you can check the WAF recommendations.
   The recommendations feature provides suggestions for WAF settings remediation to avoid similar false positive reports in the future.
   1. On the right hand side of the Log Details, click Recommendations.
   2. Review the proposed changes, the reasoning for them and the associated risks.
      Note that accepting the recommendations results in a reconfiguration of the WAF settings that might be difficult to undo.
   3. If you choose to implement the proposed remediation changes, click Accept.
5. To change the time interval for which you are seeing virtual service logs, select a new interval from the drop-down menu or select Custom and specify a time period.
6. To view the details for a specific log event, click the expand button on the left of the log name.
   Information about the logged event is displayed, including WAF signature violations, if any, and details about the client request, any actions, and the application response.
7. If necessary, export the logs for the virtual service in CSV format.
   1. On the right side of the screen, click Export Logs.
   2. (Optional) Select the Friendy Field Names check box if you want to use friendly column headers.
      If you you deselect the check box, the output document will use the field names from the original logs in the column headers.
   3. (Optional) Select the Sanitize Data check box if you want the log data to be sanitized by prepending tab characters to data that otherwise could be interpreted as a spreadsheet formula.
      Deselect the check box if you do not want the data to be sanitized, for example, if the added tabs may prevent a script from reading it correctly.
   4. (Optional) If you want to export only specific columns, deselect the Export All Columns check box and select the names of the columns that you want to export.
   5. Click Export.