All Products
Search
Document Center

Cloud Enterprise Network:Configure a flow log

Last Updated:Dec 05, 2024

Transit routers support the flow log feature. Flow logs are used to capture traffic information for transit routers and network instance connections, including inter-region connections, virtual private cloud (VPC) connections, VPN connections, Express Connect Router (ECR) connections, and virtual border router (VBR) connections. Traffic information captured by flow logs is delivered to Simple Log Service as flow log entries. You can query and analyze flow logs in the Simple Log Service console to gain insights into traffic transmission details about transit routers. Flow logs do not affect network performance because flow logs bypass traffic paths when capturing traffic information.

Flow log overview

How it works

image

Flow logs are used to capture traffic information during a specified time window. You can set the time window to 1 minute or 10 minutes. During the specified time window, flow logs first aggregate the captured traffic information, and then write the traffic information to Simple Log Service as flow log entries. You can query and analyze the log entries in the Simple Log Service console. For example, flow logs can be used in the following scenarios:

  • Query the traffic transmission details about inter-region connections, VPC connections, VPN connections, ECR connections, and VBR connections.

  • Analyze traffic that does not match a route.

  • Analyze traffic that matches a blackhole route.

Supported resources

Flow logs can capture traffic information for the following resources:

Note

Only Enterprise Edition transit routers and resources connected to Enterprise Edition transit routers support flow logs. Basic Edition transit routers and resources connected to Basic Edition transit routers do not support flow logs. To capture traffic information for Basic Edition transit routers and resources connected to Basic Edition transit routers, you must first upgrade the Basic Edition transit routers to Enterprise Edition. For more information, see Upgrade Basic Edition transit routers.

Supported resource

Supported traffic direction

Inter-region connection

Outbound network traffic from transit routers.

VPC connection

Both inbound and outbound network traffic.

  • in: Network traffic that goes from the elastic network interfaces (ENIs) of transit routers to transit routers.

  • out: Network traffic that goes from transit routers to the ENIs of transit routers.

Note

If you use a flow log to capture traffic information for a VPC, the flow log records only the information about traffic that is forwarded by transit router ENIs. For more information about traffic forwarded by other ENIs in the VPC, see Flow logs.

VPN connection

Both inbound and outbound network traffic.

  • in: Network traffic that goes from IPsec-VPN connections to transit routers.

  • out: Network traffic that goes from transit routers to IPsec-VPN connections.

ECR connection

Both inbound and outbound network traffic.

  • in: Network traffic that goes from ECRs to transit routers.

  • out: Network traffic that goes from transit routers to ECRs.

VBR connection

Both inbound and outbound network traffic.

  • in: Network traffic that goes from VBRs to transit routers.

  • out: Network traffic that goes from transit routers to VBRs.

Enterprise Edition transit routers

After you create a flow log for an Enterprise Edition transit router, the flow log is enabled for all resources that are connected to the Enterprise Edition transit router and support flow logs. The flow log captures traffic information for VPC connections, VPN connections, ECR connections, VBR connections, and inter-region connections on the Enterprise Edition transit router.

For more information about the directions of network traffic that can be captured by flow logs for each resource, see the preceding content in this table.

Fields in flow log entries

The following table describes the fields in flow log entries. After you create a flow log for a resource, if a field is empty, the field is not supported by the resource or the field is not collected by the flow log.

Field

Description

Supported flow log version

account-id

The ID of the Alibaba Cloud account to which the CEN instance belongs.

2

attachment-id

The ID of the network instance connection.

2

bytes

The number of bytes in the packets.

2

cen-id

The ID of the CEN instance.

2

direction

The direction of network traffic.

  • in: inbound traffic to the transit router.

  • out: outbound traffic from the transit router.

For more information, see Supported resources.

2

dscp

The differentiated services code point (DSCP) value in the packet.

This field records the DSCP value modified by the traffic marking policy when the flow log capture traffic information for an inter-region connection.

3

dst-region-id

The region ID of the network instance connection.

This field records the region ID of the destination transit router when the flow log captures traffic information for an inter-region connection.

2

dstaddr

The destination IP address.

2

dstport

The destination port.

2

end

The timestamp that indicates the end of the capture window.

Specify a UNIX timestamp which represents the number of milliseconds that have elapsed since the epoch time January 1, 1970, 00:00:00 UTC.

2

flowlog-resource-type

The type of resource for which the flow log is enabled. Valid values:

  • TransitRouterAttachment: network instance connection

  • TransitRouter: transit router

3

packets

The number of packets.

2

packets-lost-blackhole

The number of packets that are dropped because the packets match a blackhole route.

3

packets-lost-mtu-exceeded

The number of packets that are dropped due to oversize maximum transmission units (MTUs).

3

packets-lost-no-route

The number of packets that are dropped because the packets do not match a route.

3

packets-lost-ttl-expired

The number of packets that are dropped due to time-to-live (TTL) timeouts.

Note

In most cases, the cause of such packets is network loops.

3

protocol

The packet protocol.

2

src-region-id

The region ID of the network instance connection.

This field records the region ID of the source transit router when the flow log captures traffic information for an inter-region connection.

2

srcaddr

The source IP address.

2

srcport

The source port.

2

start

The timestamp that indicates the start of the capture window.

Specify a UNIX timestamp which represents the number of milliseconds that have elapsed since the epoch time January 1, 1970, 00:00:00 UTC.

2

tr-dst-az-id

The zone ID of the ENI used by the destination transit router.

This field is recorded only when the flow log captures information about traffic that goes to VPCs in the same region.

3

tr-dst-eni

The ID of the ENI used by the destination transit router.

This field is recorded only when the flow log captures information about traffic that goes to VPCs in the same region.

3

tr-dst-resource-account-id

The ID of the Alibaba Cloud account to which the destination network instance belongs.

3

tr-dst-resource-id

The ID of the destination network instance.

This field records the ID of the peer transit router when the destination resource and transit router are in different regions.

3

tr-dst-vsw-id

The ID of the vSwitch used by the ENI of the destination transit router.

This field is recorded only when the flow log captures information about traffic that goes to VPCs in the same region.

3

tr-id

The region ID of the transit router to which the flow log belongs.

3

tr-pair-attachment-id

This field records the ID of the ingress network instance connection or egress network instance connection based on the traffic direction.

  • If the traffic direction is in, this field records the ID of the egress network instance connection.

  • If the traffic direction is out, this field records the ID of the ingress network instance connection.

    This field is empty if you use the flow log to capture traffic information for an inter-region VPC, VPN, ECR, or VBR connection.

    Note

    This field is also empty if the captured traffic is dropped. If the flow log capture information about dropped traffic, the values of the following fields are not 0: packets-lost-blackhole, packets-lost-mtu-exceeded, packets-lost-no-route, and packets-lost-ttl-expired.

3

tr-src-az-id

The zone ID of the ENI used by the source transit router.

This field is recorded only when the flow log captures information about traffic that comes from VPCs in the same region.

3

tr-src-eni

The ID of the ENI used by the source transit router.

This field is recorded only when the flow log captures information about traffic that comes from VPCs in the same region.

3

tr-src-resource-account-id

The ID of the Alibaba Cloud account to which the source network instance belongs.

3

tr-src-resource-id

The ID of the source network instance.

3

tr-src-vsw-id

The ID of the vSwitch used by the ENI of the source transit router.

This field is recorded only when the flow log captures information about traffic that comes from VPCs in the same region.

3

type

The traffic type. Valid values:

  • v4: IPv4 traffic

  • v6: IPv6 traffic

3

version

The flow log version.

3

Limits

  • Flow logs cannot capture multicast traffic information.

  • If you have an existing flow log and want to use fields of a later flow log version, you need to delete the flow log and create a new one.

    When you create a flow log, it is created in the latest version by default. The latest flow log version supports all fields of earlier flow log versions. You can view the version of a flow log in the CEN console.2024-06-06_11-19-02

  • If a single TCP connection contains only packets that are used for connection establishment, connection reset, or connection closure, the flow log of the transit router does not record the connection.

    For example, if a TCP connection has not completed three-way handshakes or the client request is reset by the firewall, the connection is not recorded in the flow log. This design aims to prevent excessive flow log entries generated by TCP scanners.

Billing

After you enable the flow log feature for a transit router, you are charged for the following billable items:

  • Flow log collection fee

    You are charged a flow log collection fee based on the number of flow log entries that are collected.

    Note

    Network log retrieval is free of charge. The time when the fee will be charged will be posted in the product announcements.

  • Service fee of Simple Log Service

    Flow log entries are stored in Simple Log Service. You can view and analyze the flow log entries in Simple Log Service. You are charged for data storage and retrieval when you use Simple Log Service. For more information, see Billing overview.

Prerequisites

Before you create a flow log, make sure that the required resources are prepared. For more information about how to create resources, see the following topics:

Creates a flow log

  1. Log on to the CEN console.

  2. On the Instances page, click the ID of the CEN instance that you want to manage.

  3. On the Basic Settings > Transit Router tab, click the ID of the transit router of the resource for which you want to enable a flow log.

  4. On the details page of a transit router, click the Flow Logs tab.

  5. If Simple Log Service is not activated in your Alibaba Cloud account, you must first activate Simple Log Service before you can use flow logs.

    On the Flow Logs tab, click Activate Now. On the Simple Log Service page, view and select the Simple Log Service Terms of Service check box, and then click Activate Now. After you activate Simple Log Service, return to the Flow Logs tab.

    Note

    If Simple Log Service is already activated in your Alibaba Cloud account, skip this step.

  6. On the Flow Logs tab, click Create Flow Log.

  7. In the Create Flow Log dialog box, set the following parameters and click OK.

    Parameter

    Description

    Name

    Enter a name for the flow log.

    Description

    Enter a description for the flow log.

    Region

    The region where the current transit router is deployed is displayed by default.

    Transit Router ID

    The ID of the current transit router is displayed by default.

    Instance

    Select a resource type and select the resource for which the flow log is created. Supported resources:

    • Transit Router

      If you select Transit Router, you do not need to select a specific resource. The system automatically enables the flow log for the VPC connections, VPN connections, ECR connections, VBR connections, and inter-region connections on the transit router in the current region.

    • Inter-region Connection

    • VPC Connections

    • VPN Connection

    • ECR Connection

    • VBR Connection

    Project

    Select a project to store flow logs.

    You can select an existing project or create one. You can only select a project in the same region as the transit router or create a project in the region of the transit router.

    Logstore

    Select a Logstore to store flow logs.

    You can select an existing Logstore or create one.

    Log Format

    Select the fields that you want to include in the flow log. The following formats are supported:

    • Default Format (default)

      Use the fields selected by the system. This format does not allow you to add or delete fields.

    • Custom Format

      Other than the required fields, including srcaddr, dstaddr, and bytes, you can also specify custom fields that you want to use.

    After you select a log format, the system automatically generates a string of log fields, as shown in the following sample string. You can click Copy Selected Formats to copy the string and call API operations to create flow logs that use the copied flow log format.

    ${srcaddr}${dstaddr}${bytes}${version}${flowlog-resource-type}${account-id}${cen-id}${tr-id}${src-region-id}${dst-region-id}${attachment-id}${tr-pair-attachment-id}${tr-src-resource-account-id}${tr-dst-resource-account-id}${tr-src-resource-id}${tr-dst-resource-id}${tr-src-vsw-id}${tr-dst-vsw-id}${tr-src-eni}${tr-dst-eni}${tr-src-az-id}${tr-dst-az-id}${srcport}${dstport}${protocol}${dscp}${packets}${start}${end}${type}${packets-lost-no-route}${packets-lost-blackhole}${packets-lost-mtu-exceeded}${packets-lost-ttl-expired}${direction}

    Sampling Interval

    Select the duration of the capture window. Valid values:

    • 1 Minute (default)

    • 10 Minutes

    Tag

    Add tags to the flow log based on your business requirements.

    • Tag Key: The tag key can be up to 64 characters in length. It cannot be an empty string or start with acs: or aliyun or contain http:// or https://.

    • Tag Value: The tag value can be an empty string with a maximum length of 128 characters. It cannot start with acs: or aliyun or contain http:// or https://.

    You can add one or more tags to a flow log. For more information about tags, see Manage tags.

    Notes on Creating Service-linked Role

    When you create a flow log, the system automatically creates the service-linked role AliyunServiceRoleForTRFlowLog. Transit routers assume this service-linked role to read and modify Simple Log Service so that transit routers can call the Simple Log Service API to collect traffic information for specified resources.

    If the AliyunServiceRoleForTRFlowLog role already exists, the system does not create it again. For more information about AliyunServiceRoleForTRFlowLog, see System policies for CEN.

Query and analyze flow logs

After you create a flow log, the flow log is enabled by default. It takes a few minutes to initialize Simple Log Service after activation. After the initialization is complete, Simple Log Service automatically starts to record traffic information. You can click the name of a project or a Logstore in the Simple Log Service column to go to the Simple Log Service console and analyze the captured traffic information. For more information, see Log search overview and Log analysis overview.

2024-06-06_11-19-02

What to do next

Operation

Procedure

Disable a flow log

  1. Log on to the CEN console.

  2. On the Instances page, click the ID of the CEN instance that you want to manage.

  3. Go to the Basic Information > Transit Router tab and click the ID of the transit router that you want to manage.

  4. On the details page of the transit router, click the Flow Logs tab. On the Flow Logs tab, find the flow log that you want to disable and click Disable in the Actions column.

  5. In the Disable Flow Log message, click OK.

    To enable the flow log, click Enable in the Actions column. Then, click OK in the Enable Flow Log message.

Delete a flow log

Deleted flow logs no longer record traffic information. However, existing flow log data is retained.

  1. Log on to the CEN console.

  2. On the Instances page, click the ID of the CEN instance that you want to manage.

  3. Go to the Basic Information > Transit Router tab and click the ID of the transit router that you want to manage.

  4. On the details page of the transit router, click the Flow Logs tab. On the Flow Logs tab, find the flow log that you want to delete and click Delete in the Actions column.

  5. In the Delete Flow Log message, click OK.

References