You should take a look at the honeynet project as it's probably the most well known implementation of a honey pot, and it includes plenty of tools and instructions to set up the honey pot and properly set up logging information. You can also see this thread as the accepted answer here provides a lot of detail and perspective about what you should think about when you're setting up a honeypot.
Any time you're doing any kind of analysis or interaction with malware you should be running it inside of a Virtual Machine. Security procedures aside you never know what you're going to run into when you're doing analysis.
That being said, there is plenty of malware that operates differently if it detects it's running inside of a virtual machine vs. a real system but if you're just getting started I would recommend doing your analysis inside of a VM.