Virtual Private Cloud (VPC) provides the flow log feature to record information about inbound and outbound traffic of an elastic network interface (ENI). You can use the flow log feature to check access control list (ACL) rules, monitor network traffic, and troubleshoot network errors.
Features and supported regions
If you use the flow log feature for the first time, you need to click Activate Now in the VPC console.
If you have created flow logs, the flow logs are displayed after you click Activate Now.
Area | Supported region |
Asia Pacific | China (Hangzhou), China (Shanghai), China (Qingdao), China (Beijing), China (Zhangjiakou), China (Hohhot), China (Ulanqab), China (Shenzhen), China (Heyuan), China (Guangzhou), China (Chengdu), China (Hong Kong), China (Fuzhou - Local Region), Japan (Tokyo), South Korea (Seoul), Singapore, Australia (Sydney), Malaysia (Kuala Lumpur), Indonesia (Jakarta), Philippines (Manila), and India (Mumbai) |
Europe & Americas | Germany (Frankfurt), UK (London), US (Silicon Valley), and US (Virginia) |
Middle East | UAE (Dubai) and SAU (Riyadh) Important The SAU (Riyadh) region is operated by a partner. |
Feature description
Flow logs can capture information about network traffic of a specified ENI, VPC, or vSwitch. After you enable the flow log feature for a VPC or a vSwitch, traffic information about ENIs in the VPC or vSwitch is captured. Flow logs also capture traffic information about ENIs that are created after the flow log feature is enabled.
The flow logs created in the Simple Log Service console are displayed in the flow log list in the VPC console. However, you cannot modify, start, stop, or delete the flow logs in the VPC console.
The traffic information captured by the flow log feature is written to Simple Log Service as flow log entries. Each flow log entry includes a 5-tuple of a traffic flow captured within the capture window. The capture window is approximately 10 minutes. During the capture window, traffic information is captured and aggregated into a flow log entry.
The following table describes the fields of a flow log entry.
Field | Description |
version | The version of the flow log. |
vswitch-id | The ID of the vSwitch to which the ENI belongs. |
vm-id | The ID of the Elastic Compute Service (ECS) instance with which the ENI is associated. |
vpc-id | The ID of the VPC to which the ENI belongs. |
account-id | The account ID. |
eni-id | The ENI ID. |
srcaddr | The source IP address. |
srcport | The source port. |
dstaddr | The destination IP address. |
dstport | The destination port. |
protocol | The Internet Assigned Numbers Authority (IANA) protocol number of the traffic. For more information, see Protocol Numbers. |
direction | The traffic direction. Valid values:
|
packets | The number of data packets. |
bytes | The size of data packets. |
start | The time when the capture starts. |
tcp-flags | The following section describes some TCP flags and corresponding masks:
For more information about TCP flags, see RFC: 793. |
end | The time when the capture ends. |
log-status | The logging status of the flow log. Valid values:
|
action | The action that was performed on the traffic flow. Valid values:
|
Billing
For more information, see Billing of flow logs.
Limits
Name/ID | Description | Default value | Adjustable |
vpc_quota_flowlog_inst_nums_per_user | Maximum number of flow logs that can be created by each account | 10 | You can increase the quota by performing the following operations:
|
N/A | ECS instance families that do not support flow logs |
| Upgrade the ECS instances that do not support flow logs. For more information, see Upgrade the instance types of subscription instances and Change the instance type of a pay-as-you-go instance. |
Procedure
Activate Simple Log Service
The traffic information captured by the flow log feature is stored in Simple Log Service. You must activate Simple Log Service before you create a flow log.
Optional. Create an AccessKey pair
If you want to write data by using an API or SDK, you must create an AccessKey pair. If you want to collect logs by using Logtail, you do not need to create an AccessKey pair.
Create a project
You must create a project in Simple Log Service. For more information, see Create a project.
Create a Logstore
A Logstore is a collection of resources in a project. All data in a Logstore is retrieved from the same source. After you create a project, you must create a Logstore. For more information, see Create a Logstore.
Specify a resource from which traffic information is captured
Before you create a flow log, you must specify the resource from which traffic information is captured. You can capture traffic information from an ENI, VPC, or vSwitch. For more information, see Create a secondary ENI, Create and manage a VPC, and Create and manage a vSwitch.
Create a flow log
You can create a flow log to capture information about inbound and outbound traffic of ENIs in a VPC. For more information, see Create and manage flow logs.
View flow logs
After you create a flow log, you can view the flow log. You can analyze cross-region data transmission, control data transfer costs, and troubleshoot network issues based on the captured traffic information.