All Products
Search
Document Center

Cloud Enterprise Network:Configure a flow log

Last Updated:Sep 19, 2023

Transit routers support the flow log feature. Flow logs are used to capture the information about inter-region network traffic between transit routers and about connections on virtual border routers (VBRs). You can analyze the bandwidth usage, troubleshoot network errors, and reduce data transfer fees based on the captured information.

What is a flow log?

Flow logs

Flow logs are used to capture traffic information during a specified time window. You can set the time window to 1 minute or 10 minutes. During the specified time window, the flow log first aggregates the captured traffic information, and then writes the traffic information to Log Service as flow log entries. You can query and analyze the log entries in the Log Service console.

The fields in log entries vary based on the monitored object. The following table describes the fields in log entries generated by inter-region connections and VBR connections.

Note

In the following table, Supported indicates that the field is supported and Not supported indicates that the field is not supported.

Log field

Description

Inter-region connection

VBR connection

account-id

The ID of the Alibaba Cloud account

SupportedSupported

attachment-id

The ID of the network instance connection

Not supportedSupported

cen-id

The ID of the Cloud Enterprise Network (CEN) instance

SupportedSupported

src-region-id

The ID of the source region

SupportedSupported

srcaddr

The source IP address

SupportedSupported

srcport

The source port

SupportedSupported

dst-region-id

The ID of the destination region

SupportedNot supported

dstaddr

The destination IP address

SupportedSupported

dstport

The destination port

SupportedSupported

protocol

The protocol

SupportedSupported

packets

The number of data packets

SupportedSupported

bytes

The size of data packets

SupportedSupported

start

The beginning of the time window

SupportedSupported

end

The end of the time window

SupportedSupported

direction

The direction in which the network traffic flows over the VBR connection

  • in: The network traffic flows from the on-premises network to Alibaba Cloud.

  • out: The network traffic flows from Alibaba Cloud to the on-premises network.

Not supportedSupported

Billing rules

After you enable the flow log feature for a transit router, you are charged for the following billable items:

  • Flow log collection fee

    You are charged a flow log collection fee based on the number of flow log entries that are collected.

    Note

    Network log retrieval is free of charge. The time when the fee will be charged will be posted in the product announcements.

  • Service fee of Log Service

    Flow log entries are stored in Log Service. You can view and analyze the flow log entries in Log Service. You are charged for data storage and retrieval when you use Log Service. For more information, see Log Service billing.

Limits

  • Only Enterprise Edition transit routers support the flow log feature. Basic Edition transit routers do not support the flow log feature.

    If you want to use flow logs in a region where a Basic Edition transit router is deployed, upgrade the transit router from Basic Edition to Enterprise Edition first. For more information, see Upgrade Basic Edition transit routers.

  • Only flow logs in the following regions can capture the information about network traffic over VBR connections:

    China (Hangzhou), China (Shanghai), China (Nanjing-Local Region), China (Shenzhen), China (Heyuan), China (Guangzhou), China (Qingdao), China (Beijing), China (Zhangjiakou), China (Hohhot), China (Ulanqab), China (Chengdu), Singapore, China (Hong Kong), Malaysia (Kuala Lumpur), India (Mumbai), Indonesia (Jakarta), Philippines (Manila), Japan (Tokyo), Germany (Frankfurt), UK (London), US (Virginia), US (Silicon Valley), and Australia (Sydney).

  • Flow logs are used to capture information about outbound traffic on transit routers. Information about inbound traffic on transit routers is not captured.

    For example, an Elastic Compute Service (ECS) instance in the US (Silicon Valley) region accesses an ECS instance in the US (Virginia) region through CEN. After you enable the flow log feature for the transit router in the US (Virginia) region, you can check the log entries about packets sent from the ECS instance in the US (Virginia) region to the ECS instance in the US (Silicon Valley) region. However, packets sent from the ECS instance in the US (Silicon Valley) region to the ECS instance in the US (Virginia) region are not recorded. If you want to record the packets sent from the ECS instance in the US (Silicon Valley) region to the ECS instance in the US (Virginia) region, you must also enable the flow log feature on the transit router that is in the US (Silicon Valley) region.

Prerequisites

  • An inter-region connection is created between two regions if you want to capture the information about the network traffic between the regions. For more information, see Manage inter-region connections.

  • A VBR is connected to an Enterprise Edition transit router if you want to capture the information about the network traffic on the VBR. For more information, see Connect VBRs.

Create a flow log

  1. Log on to the CEN console.
  2. On the Instances page, click the ID of the CEN instance that you want to manage.
  3. Navigate to the Basic Settings > Transit Router tab and click the ID of the transit router that you want to manage.
  4. On the details page of the transit router, click the Flow Logs tab.

  5. If your Alibaba Cloud account does not have Log Service activated, you must first activate Log Service before you can use flow logs.

    On the Flow Logs tab, click Activate Now. On the Log Service page, view and select the Log Service Terms of Service check box, and then click Activate Now. After you activate Log Service, return to the Flow Logs tab.

    Note

    If your Alibaba Cloud account already has Log Service activated, skip this step.

  6. On the Flow Logs tab, click Create Flow Log.

  7. In the Create Flow Log dialog box, set the following parameters and click OK.

    Parameter

    Description

    Name

    Enter a name for the flow log.

    Description

    Enter a description for the flow log.

    Region

    The region where the current transit router is deployed is displayed by default.

    Transit Router ID

    The ID of the current transit router is displayed by default.

    Instance

    Select the instance whose network traffic you want to capture.

    • Inter-region (default): Select Inter-region and an inter-region connection if you want to capture the information about the inter-region network traffic between transit routers.

    • VBR: Select VBR and a VBR connection if you want to capture the information about the network traffic transmitted over a VBR connection.

    Project

    Select a project to store traffic information.

    You can select an existing project or create one. If you select Create Project, the system creates a project.

    Logstore

    Select a Logstore to store log entries.

    You can select an existing Logstore or create one.

    Collection Interval

    Select the duration of the time window. Valid values:

    • 1 Minute

    • 10 Minutes

    Notes on Creating Service Linked Roles

    When you create a flow log, the system automatically creates the service-linked role AliyunServiceRoleForSLSAudit. Log Service can assume the AliyunServiceRoleForSLSAudit role to obtain required read and write permissions on transit routers to collect traffic information.

    If the AliyunServiceRoleForSLSAudit role already exists, the system does not create it again. For more information, see Manage the AliyunServiceRoleForSLSAudit service-linked role.

    After you create a flow log, the flow log is enabled by default. You can click the name of a project or a Logstore in the Log Service column to go to the Log Service console and analyze the captured traffic information. For more information, see Log search overview and Log analysis overview.

Disable a flow log

You can enable or disable a flow log based on your business requirements.

  1. Log on to the CEN console.
  2. On the Instances page, click the ID of the CEN instance that you want to manage.
  3. Navigate to the Basic Settings > Transit Router tab and click the ID of the transit router that you want to manage.
  4. On the details page of the transit router, click the Flow Logs tab. On the Flow Logs tab, find the flow log that you want to disable and click Disable in the Actions column.

  5. In the Disable Flow Log message, click OK.

    If you want to enable the flow log, you can click Enable in the Actions column. Then, click OK in the Enable Flow Log message.

Delete a flow log

You can delete a flow log that you no longer use.

  1. Log on to the CEN console.
  2. On the Instances page, click the ID of the CEN instance that you want to manage.
  3. Navigate to the Basic Settings > Transit Router tab and click the ID of the transit router that you want to manage.
  4. On the details page of the transit router, click the Flow Logs tab. On the Flow Logs tab, find the flow log that you want to delete and click Delete in the Actions column.

  5. In the Delete Flow Log message, click OK.

References