Cloud Enterprise Network:Configure a flow log

Flow log overview

How flow logs work

A flow log captures traffic information within a specified aggregation interval. You can set the aggregation interval to 1 minute or 10 minutes. During the aggregation interval, the flow log aggregates the captured traffic information and delivers it to Simple Log Service. You can query and analyze the flow logs in the Simple Log Service console to understand traffic details. For example:

• View traffic details for inter-region, VPC, VPN, ECR, or VBR connections.

• Analyze traffic that does not match any routes.

• Analyze traffic that matches a blackhole route.

Limits

• Flow logs do not support capturing multicast traffic.

• If you want to use fields from a newer version for an existing flow log, you must delete the flow log and create a new one.

  By default, a new flow log uses the latest version. The latest version is compatible with all fields from previous versions. You can view the version of a flow log in the Cloud Enterprise Network console.

• The transit router flow log does not record a Transmission Control Protocol (TCP) connection if it contains only connection establishment, reset, or termination packets.

  For example, if a TCP connection does not complete the three-way handshake, or if a client's connection request is reset by a firewall, the flow log does not record the connection. This design prevents TCP scan attacks from generating many flow logs.

Billing overview

When you use the flow log feature of a transit router, the following fees are incurred:

• Network log extraction fees

  Transit Router charges network log extraction fees for the extracted logs.

  Note

  Network log extraction fees are not currently charged. You will be notified of the billing start time.

• Simple Log Service fees

  The traffic information captured by flow logs is stored in Alibaba Cloud Simple Log Service. You can view and analyze the data in Simple Log Service. Simple Log Service charges for data storage and queries. For more information, see Billing overview of Simple Log Service.

Prerequisites

Before you create a flow log for a resource, make sure that the required resource exists. To create the required resources, see the following topics:

• Create a VPC connection

• Create a VPN connection

• Create a VBR connection

• Create an ECR connection

• Create an inter-region connection

• Create a transit router instance

Create a flow log

1. Log on to the CEN console.

2. On the Instances page, click the ID of the CEN instance that you want to manage.

3. On the Basic Settings > Transit Router tab, find the transit router instance associated with the resource where you want to enable flow logs, and click its instance ID.

4. On the TransitRouter instance details page, click the Flow Log tab.

5. If Simple Log Service is not activated for your Alibaba Cloud account, activate it before you use the flow log feature.

   On the Flow Log tab, click Enable Now. On the Simple Log Service page, review and select the Simple Log Service Agreement, and then click Enable Now. After the service is enabled, return to the Flow Log tab.

   Note

   If Simple Log Service is already activated for your Alibaba Cloud account, skip this step.

6. On the Flow Logs tab, click Create Flow Log.

7. In the Create Flow Log dialog box, set the following parameters and click Confirm.

   Configuration item	Description
   Name	Enter a name for the flow log.
   Description	Enter a description for the flow log.
   Region	The system displays the region of the current transit router by default.
   Transit Router Instance ID	The system displays the ID of the current transit router by default.
   Instance	First, select a resource type. Then, select the resource whose traffic you want to capture. The following resource types are supported: TR If you select this resource type, you do not need to select a resource. The system enables the flow log feature for all VPC, VPN, ECR, VBR, and inter-region connections under the transit router in the current region. Inter-region connection VPC connection VPN connection ECR connection VBR connection
   Simple Log Service Project	Select a project to manage flow logs. You can select an existing project or create a new one. You can only select or create a project in the same region as the current transit router.
   Simple Log Service Logstore	Select a Logstore to store flow logs. You can select an existing Logstore or create a new one.
   Log Format	Select the fields that you want to record in the flow log. The following formats are supported: Default Format (default) Uses the fields selected by the system. You cannot add or remove fields in this format. Custom Format In addition to the required fields (srcaddr, dstaddr, and bytes), you can customize the fields to be recorded. After you select a log format, the system automatically generates the log format as a string (as shown below). Click Copy Selected Format. You can use the copied format to create flow logs of the same format in batches when you call the API. ${srcaddr}${dstaddr}${bytes}${version}${flowlog-resource-type}${account-id}${cen-id}${tr-id}${src-region-id}${dst-region-id}${attachment-id}${tr-pair-attachment-id}${tr-src-resource-account-id}${tr-dst-resource-account-id}${tr-src-resource-id}${tr-dst-resource-id}${tr-src-vsw-id}${tr-dst-vsw-id}${tr-src-eni}${tr-dst-eni}${tr-src-az-id}${tr-dst-az-id}${srcport}${dstport}${protocol}${dscp}${packets}${start}${end}${type}${packets-lost-no-route}${packets-lost-blackhole}${packets-lost-mtu-exceeded}${packets-lost-ttl-expired}${direction}
   Sampling Interval (minutes)	Select the aggregation interval for the flow log to capture traffic information. Valid values: 1 Minute (default) 10 Minutes
   Tag	Add tags to the flow log. Tag Key: The tag key can be up to 64 characters in length. It cannot be an empty string or start with acs: or aliyun or contain http:// or https://. Tag Value: The tag value can be an empty string with a maximum length of 128 characters. It cannot start with acs: or aliyun or contain http:// or https://. You can add multiple tags to a flow log. For more information about tags, see Tags.
   Service-linked Role Creation Notice	When you create a flow log, the system automatically creates a service-linked role named AliyunServiceRoleForTRFlowLog. The transit router assumes this role to obtain permissions to read and modify Simple Log Service resources. This allows the transit router to call Simple Log Service API operations to collect traffic information from specified resources. If the AliyunServiceRoleForTRFlowLog role already exists, the system does not create it again. For more information about the policy of the AliyunServiceRoleForTRFlowLog service-linked role, see System access policies of Cloud Enterprise Network.

More operations

References

• Create a flow log

• Delete a flow log

• Edit the properties of a flow log

• Activate a flow log

• Deactivate a flow log

• Query flow logs