1. From your VDI Desktop, open the browser and log into your VMC on AWS SDDC
   https://vmc.vmware.com/console/sddcs
   • Username: vmcexpert#-xx@vmware-hol.com
   • Password: VMware1!
2. On your SDDC Tile Click View Details
3. Select Open NSX Manager (next to Open vCenter)
   • Select the blue box Access Via the Internet
4. Click the Security Tab
5. Modify the Distributed Firewall
6. Click Add Policy
7. Name the Policy Class Log Test
   • Check the box next to the policy you created, Add Rule is now available
8. Select Add Rule
9. Name the Rule Allow All HTML

9. Under Sources click the pencil, select RFC1918, click Apply
10. Under Destination click the pencil, select RFC1918, click Apply

11. Under Services click the pencil, filter for http, select HTTP and HTTPS, click Apply
12. Under Actions leave Allow selected, the rule should be enabled by default
13. Publish the DFW rule by clicking the blue Publish button

14. Select the Gear in the far right side of the Allow All HTML rule
15. Move the slider next to logging to enable logging 
16. Set the Log Label to vmcexpert#-##_Test (using your Student ID)
17. Click Apply 
18. Click Publish

19. Click Open vCenter from the SDDC Console
20. Click Show Credentials
21. Copy the Password and Click Open vCenter
22. Log into vCenter as:
    • cloudadmin@vmc.local
    • {Paste in the copied Password}
23. In vCenter, Click the frontend VM and record its IP address

24. Select the Ubuntu-DT VM and click Open Console
25. Enter the Password of VMware1! if prompted
26. Launch the Firefox browser in the Ubunt-DT VM and type in {the address of your Frontend VM} for the Cats & Dogs Application
27. Click the Gato & Cachorro buttons multiple times until the image that appears is a hedgehog.
28. When this image (hedgehog) appears an error is generated and logged with log-insight and captured by vRealize Operations.  You are also performing this step to generate some firewall logs
29. In a new Browser tab, go to VMware.com and one or more public websites

1. Click the stacked squares in the upper right-hand corner
2. Right-Click VMware Aria Operations for Logs
3. Click Open link in new tab

4. If Collapsed, Click the double arrows to expand the left pane
   • Expand the Configuration Section
   • Click Subscriptions
5. Notice we are using the PERPETUAL Subscription. This subscription comes with VMC on AWS and only allows you to view Audit logs and Firewall Logs.
   To view other types of logs (Application logs, non-SDDC logs, etc..) the subscription must be upgraded.

8. Click Dashboards to view the available dashboards
9. In the Search Bar, type Gateway Firewall
10. Select Gateway Firewall - Traffic (latest version)
11. Review the Pie Graphs for Top Sources and Top Destinations
    You'll see an aggregated and processed view of all network traffic leaving the SDDC in the past 5 mins.
12. In the Upper right corner note that you can increase the time scale to review date beyond the last 5 mins

13. Select Dashboards in the left column
14. Click on All Dashboards:
    • Select NSX-T events for VMware Cloud SDDC v6.0
    • Select Distributed Firewall - Traffic
15. Observe the traffic, you may have to change the time window by selecting 30M or 1H to see relevant data

16. From the left hand navigation pane, select Home
17. In the search bar, type vmcexpert* to see traffic that has PASSed the DFW rule.  You may need to change the time period to 30M or 1H.  
    • HINT:  Use your full student account name (vmcexpert#-##) to see events for your SDDC only.    

18. Return to the VMware Cloud on AWS SDDC console tab in your browser, ensuring that you are in your SDDC
    • Select Networking & Security
    • Select Distributed Firewall under Security
19. Open the Class Log Test policy to see the Allow All HTML rule
20. Change Allow to Reject under Action
21. Publish the rule change

22. Return to the Ubuntu Desktop Console window, relaunch from vCenter if it has timed out.
23. Open Firefox and connect to your FrontEnd VM IP address recorded earlier making sure to use http.
    • This should result in an immediate unable to connect message
    • If the DFW rule had been set to DROP, you would have to wait for the http timeout to see the failed message
    • From the Firefox web browser access vmware.com, try google.com.  That access isn't blocked by the DFW.
24. Return to your open Aria Operations for Logs browser tab, or start a new Aria Operations for Logs session if closed
25. From the left hand navigation pane, select Home
26. In the search bar, type vmcexpert* to see traffic that has been REJECTed by the DFW rule.  You may need to change the time period to 30M or 1H.  
    • HINT:  Use your full student account name (vmcexpert#-##) to see events for your SDDC only.

27. From the Aria Operations for Logs navigation pane, select Dashboards
28. Click the All Dashboards drop down
    • Select NSX-T events for VMware Cloud SDDC V6.0
    • Select Distributed Firewall - Traffic
29. Observe Application Ports Denied,  there should be entries from the REJECT rule.  You might need to adjust the time band to 30M or 1H
30. When finished, return to the SDDC console, updating the DFW setting back to ALLOW from REJECT and PUBLISH the rule.
    • You can Verify that the DFW is set correctly by accessing the Cats & Dogs app from your Ubuntu Desktop

31. Click Alerts in the left hand navigation pane
32. Click Alert --> Alert Definitions to review the built-in alerts
33. In the search bar type  vcenter and hit return to see the Alert definitions
34. Select the Audit Events for VMware Cloud SDDC | User Session Login Alert
35. Review the settings and notice there is currently no notification set when this alert is triggered, the rule is also disabled by default.
36. In the upper right hand, click the edit Icon, close any warning for partitions if present.  

37. Under Trigger Condition 1, click Choose Notification and  Input Your Email address in the notify field, then click the +
38. Move the slider to enable the alert
39. Click Save
40. If logged into vCenter, logout.  Login to your vCenter server.  You should receive both user and application login notifications.
41. After verifying incoming email notifications, Disable the alert by moving the slider, edit the alert and remove your email address by clicking the 'x' and then Save.

42. In the left pane, click Content Packs to review the available content packs for Log Insight Cloud
43. Notice that not all content packs are enabled. Enabling a content pack allows Log Insight to begin processing log messages for the system
44. If Disabled, Enable the content packs for:
    • Audit Events for VMware Cloud SDDC (v2)
    • General

45. Select Public, then Applications
    • NOTE:  You may need to clear the search bar in order to see the desired results
46. Enable Apache - HTTP Server and Nginx
47. Select Others
48. Enable the Linux and Linux - Systemd Content Packs, if not already enabled

49. Click on Dashboards.  In the search bar type the name of one of the content packs you enabled (Linux, Nginx etc).  You'll now notice additional dashboards (Activity, Alerts, etc...)

1. In the log Insight cloud interface expand Configuration
2. Click Cloud Proxy
   If there are any existing inactive Proxies, click Delete and confirm the deletion to remove them
3. Click ADD Proxy
4. Click Existing
5. Select the Aria Automation Proxy you deployed earlier
6. Click Add

7. In the left pane under the Configuration section, click Operations for Log Agents
8. Under Agent Configuration clink New next to File Logs, add configuration settings for the following.  Note: hit Save as you complete each section.
   • MongoDB
     • Directory: /var/log/mongodb
     • include files: *.log
   • syslog
     • Directory: /var/log
     • Include files: *.log
   • docker
     • Directory: /var/lib/docker/containers
     • Include files: *.log

9. At the top of the page, in the Agents search field, click the drop-down and select Create New Group
10. Name the Group Linux_XX (Linux_01) matching your student number
11. Click OK

12. Configure the Group as follows:
    • Filter
      • OS
      • Starts with
      • Ubuntu*

13. Under the Agent Configuration section add the following configuration settings:
    • Under General Click New, and add the general section logging
      • Set the logging level to verbose
    • Click Save
      • Under Common Click New, and add the section global
    • Click Save

14. In the Agent Configuration section, Under Parsers, Let's create and define 4 parsers:
    1. Next to Parsers Click New, name the section syslog_appname_parser 
       • Set the Parser to use/extend to CLF (default Common Log Format)
       • Set Format to:

Click Save

2. Next to Parsers Click New, name the section syslog_parser
   • Set the Parser to use/extend to CLF (default Common Log Format)
   • Decode Field click Add
     • set the field to appname
     • set the value to syslog_appname_parser
   • Set Format to:

Click Save

3. Next to Parsers Click New, name the section auth_Parser_sles
   • Set the Parser to use/extend to CLF (default Common Log Format)
     • Set Next Parser to syslog_parser
     • Set Format to:

Click Save

4. Net to Parsers Click New, name the section auth_Parser
   • Set the Parser to use/extend to CLF (default Common Log Format)
     • Set Next Parser to syslog_parser
     • Set Format to:

Click Save

15. In the Agent Configuration section, Under File Logs, Let's create and define 4 log configurations:
    1. Next to File Log Click New, name the section auth
       • Set the Directory to: /var/log
       • Set Include files to: auth.log;auth.log.?
       • Tag Field click New Tag
         • set the field to vmc_cp
         • set the value to linux
       • Set Parse fields by to: auth_parser

Click Save

2. Next to File Log Click New, name the section messages
   • Set the Directory to: /var/log
   • Set Include files to: messages;messages.?
   • Tag Field click New Tag
     • set the field to vmc_cp
     • set the value to linux
   • Set Parse fields by to: syslog_parser

Click Save

3. Next to File Log Click New, name the section syslog
   • Set the Directory to: /var/log
   • Set Include files to: syslog;syslog.?
   • Tag Field click New Tag
     • set the field to vmc_cp
     • set the value to linux
   • Set Parse fields by to: syslog_parser

Click Save

4. Next to File Log Click New, name the section docker
   • Set the Directory to: /var/log
   • Set Include files to: docker
   • Tag Field click New Tag
     • set the field to vmc_cp
     • set the value to linux
   • Set Parse fields by to: syslog_parser

Click Save

16. At the top of the VMware Aria Operations for Logs Agents page choose All Agents in the search field

You should now see the agents from your Cats & Dog application, there would also be more than 10 events recorded.  Click on the Status field to sort by Active if you see multiple Disconnected agents.

Return to the Aria Operations for Logs Explore Logs and observe a change in the data stream.  You can adjust the time band as necessary, 5M - 30M - 1H etc.