Previous Session/State Info?

[utahbmxer]

Hi
Just moved one of my VMs into my DMZ vlan, which is on the same physical interfaces as the LAN vlan.  This is a minecraft server which has worked flawlessly before attaching to the other vlan.  Having an issue where after 15-20 minutes the clients will just drop, and the server reports as 'xxxxxx left the game'.

This got me interested in knowing the life of the connection and why the connection/state was closed by the server.  I started poking around in logs, and stuff.  At one point I had netflow data going to my Graylog instance, but I must have turned that off as all I have now is filterlog and nginx/waf logs.

So my question is, obviously we have the filterlog which shows the src, dst, interface, action, and so on.  Is there any log like conntrack or similar which will report the states end reason (age-out, FIN, RST, etc), bytes sent/recv, and other metrics?  Would be nice to know for instances where something happened and I can't run a tcpdump while reproducing.

Thanks in advance!