Cloud Enterprise Network:Configure a flow log

What is a flow log?

Flow logs are used to capture traffic information during a specified time window. You can set the time window to 1 minute or 10 minutes. During the specified time window, the flow log first aggregates the captured traffic information, and then writes the traffic information to Log Service as flow log entries. You can query and analyze the log entries in the Log Service console.

The fields in log entries vary based on the monitored object. The following table describes the fields in log entries generated by inter-region connections and VBR connections.

Note In the following table, indicates that the field is supported and indicates that the field is not supported.

Log field	Description	Inter-region connection	VBR connection
account-id	The ID of the Alibaba Cloud account
attachment-id	The ID of the network instance connection
cen-id	The ID of the Cloud Enterprise Network (CEN) instance
src-region-id	The ID of the source region
srcaddr	The source IP address
srcport	The source port
dst-region-id	The ID of the destination region
dstaddr	The destination IP address
dstport	The destination port
protocol	The protocol
packets	The number of data packets
bytes	The size of data packets
start	The beginning of the time window
end	The end of the time window
direction	The direction in which the network traffic flows over the VBR connection in: The network traffic flows from the on-premises network to Alibaba Cloud. out: The network traffic flows from Alibaba Cloud to the on-premises network.

Billing rules

Limits

• Only Enterprise Edition transit routers support the flow log feature. Basic Edition transit routers do not support the flow log feature.

  If you want to use flow logs in a region where a Basic Edition transit router is deployed, upgrade the transit router from Basic Edition to Enterprise Edition first. For more information, see Upgrade Basic Edition transit routers.

• Only flow logs in the following regions can capture the information about network traffic over VBR connections:

  China (Hangzhou), China (Shanghai), China (Nanjing-Local Region), China (Shenzhen), China (Heyuan), China (Guangzhou), China (Qingdao), China (Beijing), China (Zhangjiakou), China (Hohhot), China (Ulanqab), China (Chengdu), Singapore, China (Hong Kong), Malaysia (Kuala Lumpur), India (Mumbai), Indonesia (Jakarta), Philippines (Manila), Japan (Tokyo), Germany (Frankfurt), UK (London), US (Virginia), US (Silicon Valley), and Australia (Sydney).

• Flow logs are used to capture information about outbound traffic on transit routers. Information about inbound traffic on transit routers is not captured.

  For example, an Elastic Compute Service (ECS) instance in the US (Silicon Valley) region accesses an ECS instance in the US (Virginia) region through CEN. After you enable the flow log feature for the transit router in the US (Virginia) region, you can check the log entries about packets sent from the ECS instance in the US (Virginia) region to the ECS instance in the US (Silicon Valley) region. However, packets sent from the ECS instance in the US (Silicon Valley) region to the ECS instance in the US (Virginia) region are not recorded. If you want to record the packets sent from the ECS instance in the US (Silicon Valley) region to the ECS instance in the US (Virginia) region, you must also enable the flow log feature on the transit router that is in the US (Silicon Valley) region.

Prerequisites

• An inter-region connection is created between two regions if you want to capture the information about the network traffic between the regions. For more information, see Manage inter-region connections.
• A VBR is connected to an Enterprise Edition transit router if you want to capture the information about the network traffic on the VBR. For more information, see Create a VBR connection.

Create a flow log

1. Log on to the CEN console.
2. On the Instances page, find the CEN instance that you want to manage and click the instance ID.
3. Choose Basic Settings > Transit Router, find the transit router that you want to manage, and then click the ID of the transit router.
4. On the details page of the transit router, click the Flow Logs tab.
5. If your Alibaba Cloud account does not have Log Service activated, you must first activate Log Service before you can use flow logs.
   On the Flow Logs tab, click Activate Now. On the Log Service page, view and select the Log Service Terms of Service check box, and then click Activate Now. After you activate Log Service, return to the Flow Logs tab.

   Note If your Alibaba Cloud account already has Log Service activated, skip this step.
6. On the Flow Logs tab, click Create Flow Log.
7. In the Create Flow Log dialog box, set the following parameters and click OK.

   Parameter	Description
   Name	Enter a name for the flow log.
   Description	Enter a description for the flow log.
   Region	The region where the current transit router is deployed is displayed by default.
   Transit Router ID	The ID of the current transit router is displayed by default.
   Instance	Select the instance whose network traffic you want to capture. Inter-region (default): Select Inter-region and an inter-region connection if you want to capture the information about the inter-region network traffic between transit routers. VBR: Select VBR and a VBR connection if you want to capture the information about the network traffic transmitted over a VBR connection.
   Project	Select a project to store traffic information. You can select an existing project or create one. If you select Create Project, the system creates a project.
   Logstore	Select a Logstore to store log entries. You can select an existing Logstore or create one.
   Collection Interval	Select the duration of the time window. Valid values: 1 Minute 10 Minutes
   Notes on Creating Service Linked Roles	When you create a flow log, the system automatically creates the service-linked role AliyunServiceRoleForSLSAudit. Log Service can assume the AliyunServiceRoleForSLSAudit role to obtain required read and write permissions on transit routers to collect traffic information. If the AliyunServiceRoleForSLSAudit role already exists, the system does not create it again. For more information, see Manage the AliyunServiceRoleForSLSAudit service-linked role.

   After you create a flow log, the flow log is enabled by default. You can click the name of a project or a Logstore in the Log Service column to go to the Log Service console and analyze the captured traffic information. For more information, see Log search overview and Log analysis overview.

Disable a flow log

You can enable or disable a flow log based on your business requirements.

1. Log on to the CEN console.
2. On the Instances page, find the CEN instance that you want to manage and click the instance ID.
3. Choose Basic Settings > Transit Router, find the transit router that you want to manage, and then click the ID of the transit router.
4. On the details page of the transit router, click the Flow Logs tab. On the Flow Logs tab, find the flow log that you want to disable and click Stop in the Actions column.
5. In the Stop message, click OK.
   If you want to enable the flow log, you can click Start in the Actions column. Then, click OK in the Start message.

Delete a flow log

You can delete a flow log that you no longer use.

1. Log on to the CEN console.
2. On the Instances page, find the CEN instance that you want to manage and click the instance ID.
3. Choose Basic Settings > Transit Router, find the transit router that you want to manage, and then click the ID of the transit router.
4. On the details page of the transit router, click the Flow Logs tab. On the Flow Logs tab, find the flow log that you want to delete and click Delete in the Actions column.
5. In the Delete Flow Log message, click OK.

References

• CreateFlowlog: creates a flow log.
• ModifyFlowLogAttribute: modifies the name and description of a flow log.
• ActiveFlowLog: enables a flow log.
• DeactiveFlowLog: disables a flow log.
• DeleteFlowlog: deletes a flow log.
• DescribeFlowlogs: queries the configuration of a flow log.