Transit routers support the flow log feature. Flow logs are used to capture traffic information for transit routers and network instance connections, including inter-region connections, virtual private cloud (VPC) connections, VPN connections, Express Connect Router (ECR) connections, and virtual border router (VBR) connections. Traffic information captured by flow logs is delivered to Simple Log Service as flow log entries. You can query and analyze flow logs in the Simple Log Service console to gain insights into traffic transmission details about transit routers. Flow logs do not affect network performance because flow logs bypass traffic paths when capturing traffic information.
Flow log overview
How it works
Flow logs are used to capture traffic information during a specified time window. You can set the time window to 1 minute or 10 minutes. During the specified time window, flow logs first aggregate the captured traffic information, and then write the traffic information to Simple Log Service as flow log entries. You can query and analyze the log entries in the Simple Log Service console. For example, flow logs can be used in the following scenarios:
Query the traffic transmission details about inter-region connections, VPC connections, VPN connections, ECR connections, and VBR connections.
Analyze traffic that does not match a route.
Analyze traffic that matches a blackhole route.
Supported resources
Flow logs can capture traffic information for the following resources:
Only Enterprise Edition transit routers and resources connected to Enterprise Edition transit routers support flow logs. Basic Edition transit routers and resources connected to Basic Edition transit routers do not support flow logs. To capture traffic information for Basic Edition transit routers and resources connected to Basic Edition transit routers, you must first upgrade the Basic Edition transit routers to Enterprise Edition. For more information, see Upgrade Basic Edition transit routers.
Supported resource | Supported traffic direction |
Inter-region connection | Outbound network traffic from transit routers. |
VPC connection | Both inbound and outbound network traffic.
Note If you use a flow log to capture traffic information for a VPC, the flow log records only the information about traffic that is forwarded by transit router ENIs. For more information about traffic forwarded by other ENIs in the VPC, see Flow logs. |
VPN connection | Both inbound and outbound network traffic.
|
ECR connection | Both inbound and outbound network traffic.
|
VBR connection | Both inbound and outbound network traffic.
|
Enterprise Edition transit routers | After you create a flow log for an Enterprise Edition transit router, the flow log is enabled for all resources that are connected to the Enterprise Edition transit router and support flow logs. The flow log captures traffic information for VPC connections, VPN connections, ECR connections, VBR connections, and inter-region connections on the Enterprise Edition transit router. For more information about the directions of network traffic that can be captured by flow logs for each resource, see the preceding content in this table. |
Fields in flow log entries
The following table describes the fields in flow log entries. After you create a flow log for a resource, if a field is empty, the field is not supported by the resource or the field is not collected by the flow log.
Field | Description | Supported flow log version |
account-id | The ID of the Alibaba Cloud account to which the CEN instance belongs. | 2 |
attachment-id | The ID of the network instance connection. | 2 |
bytes | The number of bytes in the packets. | 2 |
cen-id | The ID of the CEN instance. | 2 |
direction | The direction of network traffic.
For more information, see Supported resources. | 2 |
dscp | The differentiated services code point (DSCP) value in the packet. This field records the DSCP value modified by the traffic marking policy when the flow log capture traffic information for an inter-region connection. | 3 |
dst-region-id | The region ID of the network instance connection. This field records the region ID of the destination transit router when the flow log captures traffic information for an inter-region connection. | 2 |
dstaddr | The destination IP address. | 2 |
dstport | The destination port. | 2 |
end | The timestamp that indicates the end of the capture window. Specify a UNIX timestamp which represents the number of milliseconds that have elapsed since the epoch time January 1, 1970, 00:00:00 UTC. | 2 |
flowlog-resource-type | The type of resource for which the flow log is enabled. Valid values:
| 3 |
packets | The number of packets. | 2 |
packets-lost-blackhole | The number of packets that are dropped because the packets match a blackhole route. | 3 |
packets-lost-mtu-exceeded | The number of packets that are dropped due to oversize maximum transmission units (MTUs). | 3 |
packets-lost-no-route | The number of packets that are dropped because the packets do not match a route. | 3 |
packets-lost-ttl-expired | The number of packets that are dropped due to time-to-live (TTL) timeouts. Note In most cases, the cause of such packets is network loops. | 3 |
protocol | The packet protocol. | 2 |
src-region-id | The region ID of the network instance connection. This field records the region ID of the source transit router when the flow log captures traffic information for an inter-region connection. | 2 |
srcaddr | The source IP address. | 2 |
srcport | The source port. | 2 |
start | The timestamp that indicates the start of the capture window. Specify a UNIX timestamp which represents the number of milliseconds that have elapsed since the epoch time January 1, 1970, 00:00:00 UTC. | 2 |
tr-dst-az-id | The zone ID of the ENI used by the destination transit router. This field is recorded only when the flow log captures information about traffic that goes to VPCs in the same region. | 3 |
tr-dst-eni | The ID of the ENI used by the destination transit router. This field is recorded only when the flow log captures information about traffic that goes to VPCs in the same region. | 3 |
tr-dst-resource-account-id | The ID of the Alibaba Cloud account to which the destination network instance belongs. | 3 |
tr-dst-resource-id | The ID of the destination network instance. This field records the ID of the peer transit router when the destination resource and transit router are in different regions. | 3 |
tr-dst-vsw-id | The ID of the vSwitch used by the ENI of the destination transit router. This field is recorded only when the flow log captures information about traffic that goes to VPCs in the same region. | 3 |
tr-id | The region ID of the transit router to which the flow log belongs. | 3 |
tr-pair-attachment-id | This field records the ID of the ingress network instance connection or egress network instance connection based on the traffic direction.
| 3 |
tr-src-az-id | The zone ID of the ENI used by the source transit router. This field is recorded only when the flow log captures information about traffic that comes from VPCs in the same region. | 3 |
tr-src-eni | The ID of the ENI used by the source transit router. This field is recorded only when the flow log captures information about traffic that comes from VPCs in the same region. | 3 |
tr-src-resource-account-id | The ID of the Alibaba Cloud account to which the source network instance belongs. | 3 |
tr-src-resource-id | The ID of the source network instance. | 3 |
tr-src-vsw-id | The ID of the vSwitch used by the ENI of the source transit router. This field is recorded only when the flow log captures information about traffic that comes from VPCs in the same region. | 3 |
type | The traffic type. Valid values:
| 3 |
version | The flow log version. | 3 |
Limits
Flow logs cannot capture multicast traffic information.
If you have an existing flow log and want to use fields of a later flow log version, you need to delete the flow log and create a new one.
When you create a flow log, it is created in the latest version by default. The latest flow log version supports all fields of earlier flow log versions. You can view the version of a flow log in the CEN console.
If a single TCP connection contains only packets that are used for connection establishment, connection reset, or connection closure, the flow log of the transit router does not record the connection.
For example, if a TCP connection has not completed three-way handshakes or the client request is reset by the firewall, the connection is not recorded in the flow log. This design aims to prevent excessive flow log entries generated by TCP scanners.
Billing
After you enable the flow log feature for a transit router, you are charged for the following billable items:
Flow log collection fee
You are charged a flow log collection fee based on the number of flow log entries that are collected.
NoteNetwork log retrieval is free of charge. The time when the fee will be charged will be posted in the product announcements.
Service fee of Simple Log Service
Flow log entries are stored in Simple Log Service. You can view and analyze the flow log entries in Simple Log Service. You are charged for data storage and retrieval when you use Simple Log Service. For more information, see Billing overview.
Prerequisites
Before you create a flow log, make sure that the required resources are prepared. For more information about how to create resources, see the following topics:
Creates a flow log
Log on to the CEN console.
On the Instances page, click the ID of the CEN instance that you want to manage.
On the
tab, click the ID of the transit router of the resource for which you want to enable a flow log.On the details page of a transit router, click the Flow Logs tab.
If Simple Log Service is not activated in your Alibaba Cloud account, you must first activate Simple Log Service before you can use flow logs.
On the Flow Logs tab, click Activate Now. On the Simple Log Service page, view and select the Simple Log Service Terms of Service check box, and then click Activate Now. After you activate Simple Log Service, return to the Flow Logs tab.
NoteIf Simple Log Service is already activated in your Alibaba Cloud account, skip this step.
On the Flow Logs tab, click Create Flow Log.
In the Create Flow Log dialog box, set the following parameters and click OK.
Parameter
Description
Name
Enter a name for the flow log.
Description
Enter a description for the flow log.
Region
The region where the current transit router is deployed is displayed by default.
Transit Router ID
The ID of the current transit router is displayed by default.
Instance
Select a resource type and select the resource for which the flow log is created. Supported resources:
Transit Router
If you select Transit Router, you do not need to select a specific resource. The system automatically enables the flow log for the VPC connections, VPN connections, ECR connections, VBR connections, and inter-region connections on the transit router in the current region.
Inter-region Connection
VPC Connections
VPN Connection
ECR Connection
VBR Connection
Project
Select a project to store flow logs.
You can select an existing project or create one. You can only select a project in the same region as the transit router or create a project in the region of the transit router.
Logstore
Select a Logstore to store flow logs.
You can select an existing Logstore or create one.
Log Format
Select the fields that you want to include in the flow log. The following formats are supported:
Default Format (default)
Use the fields selected by the system. This format does not allow you to add or delete fields.
Custom Format
Other than the required fields, including srcaddr, dstaddr, and bytes, you can also specify custom fields that you want to use.
After you select a log format, the system automatically generates a string of log fields, as shown in the following sample string. You can click Copy Selected Formats to copy the string and call API operations to create flow logs that use the copied flow log format.
${srcaddr}${dstaddr}${bytes}${version}${flowlog-resource-type}${account-id}${cen-id}${tr-id}${src-region-id}${dst-region-id}${attachment-id}${tr-pair-attachment-id}${tr-src-resource-account-id}${tr-dst-resource-account-id}${tr-src-resource-id}${tr-dst-resource-id}${tr-src-vsw-id}${tr-dst-vsw-id}${tr-src-eni}${tr-dst-eni}${tr-src-az-id}${tr-dst-az-id}${srcport}${dstport}${protocol}${dscp}${packets}${start}${end}${type}${packets-lost-no-route}${packets-lost-blackhole}${packets-lost-mtu-exceeded}${packets-lost-ttl-expired}${direction}
Sampling Interval
Select the duration of the capture window. Valid values:
1 Minute (default)
10 Minutes
Tag
Add tags to the flow log based on your business requirements.
Tag Key: The tag key can be up to 64 characters in length. It cannot be an empty string or start with
acs:
oraliyun
or containhttp://
orhttps://
.Tag Value: The tag value can be an empty string with a maximum length of 128 characters. It cannot start with
acs:
oraliyun
or containhttp://
orhttps://
.
You can add one or more tags to a flow log. For more information about tags, see Manage tags.
Notes on Creating Service-linked Role
When you create a flow log, the system automatically creates the service-linked role AliyunServiceRoleForTRFlowLog. Transit routers assume this service-linked role to read and modify Simple Log Service so that transit routers can call the Simple Log Service API to collect traffic information for specified resources.
If the AliyunServiceRoleForTRFlowLog role already exists, the system does not create it again. For more information about AliyunServiceRoleForTRFlowLog, see System policies for CEN.
Query and analyze flow logs
After you create a flow log, the flow log is enabled by default. It takes a few minutes to initialize Simple Log Service after activation. After the initialization is complete, Simple Log Service automatically starts to record traffic information. You can click the name of a project or a Logstore in the Simple Log Service column to go to the Simple Log Service console and analyze the captured traffic information. For more information, see Log search overview and Log analysis overview.
What to do next
Operation | Procedure |
Disable a flow log |
|
Delete a flow log | Deleted flow logs no longer record traffic information. However, existing flow log data is retained.
|