All systems are virtual? You mentioned no over-provisioning, but do you actually have reserved CPU/Memory allocated in ESX? Make sure the reservations are explicitly set per guest system.
... View more
Based on this blog posting from Splunk, it sounds like VPC flow logs are something they are working to add.
http://blogs.splunk.com/2015/08/04/an-aws-summer-part-1/
If there's a way to do it now, that would be great as I'm looking to do the same.
... View more