Cloud Enterprise Network：Configure a flow log

Flow log overview

How it works

Flow logs are used to capture traffic information during a specified time window. You can set the time window to 1 minute or 10 minutes. During the specified time window, flow logs first aggregate the captured traffic information, and then write the traffic information to Simple Log Service as flow log entries. You can query and analyze the log entries in the Simple Log Service console. For example, flow logs can be used in the following scenarios:

• Query the traffic transmission details about inter-region connections, VPC connections, VPN connections, ECR connections, and VBR connections.

• Analyze traffic that does not match a route.

• Analyze traffic that matches a blackhole route.

Limits

• Flow logs cannot capture multicast traffic information.

• If you have an existing flow log and want to use fields of a later flow log version, you need to delete the flow log and create a new one.

  When you create a flow log, it is created in the latest version by default. The latest flow log version supports all fields of earlier flow log versions. You can view the version of a flow log in the CEN console.

• If a single TCP connection contains only packets that are used for connection establishment, connection reset, or connection closure, the flow log of the transit router does not record the connection.

  For example, if a TCP connection has not completed three-way handshakes or the client request is reset by the firewall, the connection is not recorded in the flow log. This design aims to prevent excessive flow log entries generated by TCP scanners.

Billing

After you enable the flow log feature for a transit router, you are charged for the following billable items:

• Flow log collection fee

  You are charged a flow log collection fee based on the number of flow log entries that are collected.

  Note

  Network log retrieval is free of charge. The time when the fee will be charged will be posted in the product announcements.

• Service fee of Simple Log Service

  Flow log entries are stored in Simple Log Service. You can view and analyze the flow log entries in Simple Log Service. You are charged for data storage and retrieval when you use Simple Log Service. For more information, see Billing overview.

Prerequisites

Before you create a flow log, make sure that the required resources are prepared. For more information about how to create resources, see the following topics:

• Create a VPC connection

• Create a VPN connection

• Create a VBR connection

• Create an ECR connection

• Create an inter-region connection

• Create a transit router

Creates a flow log

1. Log on to the CEN console.

2. On the Instances page, click the ID of the CEN instance that you want to manage.

3. On the Basic Settings > Transit Router tab, click the ID of the transit router of the resource for which you want to enable a flow log.

4. On the details page of a transit router, click the Flow Logs tab.

5. If Simple Log Service is not activated in your Alibaba Cloud account, you must first activate Simple Log Service before you can use flow logs.

   On the Flow Logs tab, click Activate Now. On the Simple Log Service page, view and select the Simple Log Service Terms of Service check box, and then click Activate Now. After you activate Simple Log Service, return to the Flow Logs tab.

   Note

   If Simple Log Service is already activated in your Alibaba Cloud account, skip this step.

6. On the Flow Logs tab, click Create Flow Log.

7. In the Create Flow Log dialog box, set the following parameters and click OK.

   Parameter	Description
   Name	Enter a name for the flow log.
   Description	Enter a description for the flow log.
   Region	The region where the current transit router is deployed is displayed by default.
   Transit Router ID	The ID of the current transit router is displayed by default.
   Instance	Select a resource type and select the resource for which the flow log is created. Supported resources: Transit Router If you select Transit Router, you do not need to select a specific resource. The system automatically enables the flow log for the VPC connections, VPN connections, ECR connections, VBR connections, and inter-region connections on the transit router in the current region. Inter-region Connection VPC Connections VPN Connection ECR Connection VBR Connection
   Project	Select a project to store flow logs. You can select an existing project or create one. You can only select a project in the same region as the transit router or create a project in the region of the transit router.
   Logstore	Select a Logstore to store flow logs. You can select an existing Logstore or create one.
   Log Format	Select the fields that you want to include in the flow log. The following formats are supported: Default Format (default) Use the fields selected by the system. This format does not allow you to add or delete fields. Custom Format Other than the required fields, including srcaddr, dstaddr, and bytes, you can also specify custom fields that you want to use. After you select a log format, the system automatically generates a string of log fields, as shown in the following sample string. You can click Copy Selected Formats to copy the string and call API operations to create flow logs that use the copied flow log format. ${srcaddr}${dstaddr}${bytes}${version}${flowlog-resource-type}${account-id}${cen-id}${tr-id}${src-region-id}${dst-region-id}${attachment-id}${tr-pair-attachment-id}${tr-src-resource-account-id}${tr-dst-resource-account-id}${tr-src-resource-id}${tr-dst-resource-id}${tr-src-vsw-id}${tr-dst-vsw-id}${tr-src-eni}${tr-dst-eni}${tr-src-az-id}${tr-dst-az-id}${srcport}${dstport}${protocol}${dscp}${packets}${start}${end}${type}${packets-lost-no-route}${packets-lost-blackhole}${packets-lost-mtu-exceeded}${packets-lost-ttl-expired}${direction}
   Sampling Interval	Select the duration of the capture window. Valid values: 1 Minute (default) 10 Minutes
   Tag	Add tags to the flow log based on your business requirements. Tag Key: The tag key can be up to 64 characters in length. It cannot be an empty string or start with acs: or aliyun or contain http:// or https://. Tag Value: The tag value can be an empty string with a maximum length of 128 characters. It cannot start with acs: or aliyun or contain http:// or https://. You can add one or more tags to a flow log. For more information about tags, see Manage tags.
   Notes on Creating Service-linked Role	When you create a flow log, the system automatically creates the service-linked role AliyunServiceRoleForTRFlowLog. Transit routers assume this service-linked role to read and modify Simple Log Service so that transit routers can call the Simple Log Service API to collect traffic information for specified resources. If the AliyunServiceRoleForTRFlowLog role already exists, the system does not create it again. For more information about AliyunServiceRoleForTRFlowLog, see System policies for CEN.

What to do next

References

• CreateFlowlog

• DeleteFlowlog

• ModifyFlowLogAttribute

• ActiveFlowLog

• DeactiveFlowLog

• DescribeFlowlogs