Virtual Private Cloud:Overview of flow logs

• Resource Type: Choose the resource type for which you want to collect traffic. Valid values: VPC, vSwitch, and ENI.

  Note

  When an ENI has inbound or outbound traffic, you can go to the Flow Log page and view the collected data by clicking View ENI Collection Scope in the Actions column.

• Resource Instance: Choose the resource instance for which you want to collect traffic.

• Data Transfer Type: Choose the type of traffic that you want to collect. Valid values: All Traffic, Allowed Traffic, and Denied Traffic.

• IP Version: Choose the type of IP address for traffic collection. Currently, only IPv4 is supported.

• Project: You can choose either Create Project or Select Project to store the collected traffic.

• Logstore: You can choose either Create Logstore or Select Logstore to store the collected traffic.

• Enable Log Analysis Report: This feature enables indexing and creates a dashboard for a logstore. This allows you to perform SQL statements and visualize data analysis.

  Indexing in Log Service is billed based on data usage, while dashboards are provided at no additional cost. For more information, see Billable items.

• Sampling Interval (Minutes): Specify the sampling interval. Available intervals are 1, 5, and 10 minutes, with the default set to 10 minutes.

  Note

  After a flow log is created, you can go to the Flow Log page and select Edit under the Sampling Interval (Minutes) column to adjust the sampling interval.

• Sampling Path: Select the sampling path for the flow log. Available paths include All Scenarios, Traffic Through IPv4 Gateway, Traffic Through NAT Gateway, Traffic Through VPN Gateway, Traffic Through Transit Router, Traffic That Accesses Cloud Service Through Gateway Endpoint, and Traffic That Accesses Express Connect Circuit Through VBR. By default, All Scenarios is selected, but you can customize the option to collect traffic from other scenarios.

By analyzing flow logs, you can check access control rules, monitor network traffic, and troubleshoot network issues.

Use Logstore

1. On the Flow Log page, click the Logstore link in the Simple Log Service column.

2. In the Log Management Console, select Search & Analysis to analyze the flow logs using the features available in the console.

Use Flow Log Center

1. Log on to the Log Service Console.

2. In the Log Application section, click View More Log Applications. In the Log Application dialog box, select Flow Log Center.

3. On the Flow Log Management page, click Add. In the Create Instance panel, select the project and Logstore you configured when creating the flow log.

4. After the instance is created, click the instance ID in the Flow Log Center. On the Flow Log Details page, you can view and analyze the data.

   

   You can find various dashboards and customize queries in the Monitoring Center.

   • Overview: Displays the status of flow logs.

   • Policy Statistics: Shows trends for accepted and rejected traffic and 5-tuple details of accepts and rejects, which include the source CIDR block, source port, protocol type, destination CIDR block, and destination port.

     • Accept: Traffic permitted by security groups or ACLs.

     • Reject: Traffic blocked by security groups or ACLs.

   • ENI Traffic: Displays inbound and outbound traffic details for ENIs.

   • Inter-ECS Traffic: Illustrates the traffic flow between ECS instances.

   • Custom Query: Allows you to query and analyze logs.

5. On the Flow Log Details page, click CIDR Block Settings and enable the Inter-Domain Analysis.

   When you enable the inter-domain analysis feature, the system automatically creates data transformation tasks, and generates VPC flow logs with CIDR block information for you to analyze the traffic between CIDR blocks. As the data transformation feature incurs additional charges, decide whether to enable inter-domain analysis based on your needs.

   With the following CIDR blocks predefined by Simple Log Service, you can enable the inter-domain analysis feature when necessary. If the predefined CIDR blocks do not meet your needs, you can add custom CIDR blocks.

   

   Inter-Domain Analysis provides the following dashboards and custom query capabilities:

   • Inter-domain Traffic: Shows traffic patterns between different CIDR blocks.

   • ECS-to-Domain Traffic: Displays traffic from ECS instances to various destination CIDR blocks.

   • Threat Intelligence: Provides threat intelligence information for source and destination IP addresses.

   • Custom Query: Allows you to query and analyze VPC flow logs.