Capture IP traffic from VPCs, vSwitches, and ENIs with flow logs, and store it in SLS for querying, visualization, and alerting.
How flow logs work
The flow log service collects traffic from VPCs, vSwitches, and ENIs, and stores it in SLS.
Each record aggregates a network session within a capture window. A session is identified by its 5-tuple: source IP, destination IP, source port, destination port, and protocol. Each record includes:
-
Duration and volume: how long the session lasted and how much data was transferred
-
Traffic direction: inbound or outbound relative to the network interface
-
Network element ID: the ENI, vSwitch, or VPC associated with the session
Use cases
-
Traffic monitoring: identify traffic patterns and how applications communicate across your network.
-
Troubleshooting: diagnose connectivity issues, packet loss, and performance bottlenecks with flow-level data.
-
Security auditing: maintain traceable records of network activity and detect unauthorized access by reviewing rejected traffic.
-
Threat detection: identify unusual traffic spikes, port scans, or connections to suspicious IP addresses.
Prerequisites
Ensure the following:
-
A VPC with at least one vSwitch and one ENI (for example, an ECS instance).
-
You have RAM permissions to manage VPC flow logs and SLS.
Authorize the flow log service
Complete the following steps the first time you use flow logs:
-
Go to the Flow Log page.
-
Click Create Now, then click Authorize. This creates a RAM role
AliyunVPCLogArchiveRoleand a RAM policyAliyunVPCLogArchiveRolePolicy, which grant the VPC service write access to your SLS Logstore. -
On the Flow Log page, click Activate Now, then click Enable Now.
If you created flow log instances during the public preview, click Activate Now to view and manage them.
-
Go to the Simple Log Service console and activate SLS if not already done.
Create a flow log
-
Go to the Flow Logs page in the VPC console.
-
Click Create a flow log.
-
In the Collection Configuration section, configure the following:
When multiple flow log instances capture traffic from the same NIC, the smallest sampling interval among all instances is used.
Parameter
Description
Flow Log Name
The flow log name.
Region
The region of the target resource.
Resource Types and Resource Instance
Select ENIs, vSwitch, or VPC. Selecting a VPC or vSwitch monitors all ENIs in it.
Data Transfer Type
The traffic to capture: allowed, denied, or both. Access controls include security groups and network ACLs.
IP Version
Select IPv4 for IPv4 traffic only, or Dual-stack for both IPv4 and IPv6. IPv6 is supported in: China (Hangzhou), China (Shanghai), China (Qingdao), China (Beijing), China (Hohhot), China (Shenzhen), Singapore, US (Silicon Valley), and US (Virginia).
Sampling Interval (Minutes)
The capture window: 1, 5, or 10 minutes. A shorter interval produces more frequent entries for faster issue detection but generates more data. For example, a persistent TCP connection generates 60 entries/hour at 1 minute vs. 6 entries/hour at 10 minutes.
Sampling Path
The network elements to capture traffic from. Deselect All Scenarios first, then choose from: IPv4 gateway, NAT Gateway, VPN Gateway, Transit Router (TR), gateway endpoint, virtual border router (VBR), Express Connect Router (ECR), and Gateway Load Balancer (GWLB). Narrowing the capture path reduces log volume and cost.
-
In the Analysis and Delivery section, select at least one destination:
-
Deliver to Log Service: Select a Project and Logstore. For your first flow log, click Create Project and Create Logstore to isolate flow log data. To centralize analysis for multiple flow logs, select the same Logstore.
-
Enable Log Analysis Report: Automatically create an index and create a dashboard in your Logstore for SQL queries and visual analytics on flow logs. SLS billing applies.
-
Enable NIS Traffic Analysis: Not yet available.
-
-
Click OK.
After creation, the system starts collecting traffic automatically.
Analyze flow logs
Query raw flow log data in SLS
Search, filter, and analyze raw flow log data with SLS queries.
-
Go to the Flow Logs page in the VPC console.
-
In the Simple Log Service column, click the Logstore name of the target flow log.
-
On the Logstore page:
-
View Raw Logs to inspect individual flow log entries.
-
Enter a query statement to search and analyze flow logs.
-
Use pre-built dashboards in the Flowlog Log Center
The Flowlog Log Center provides pre-built dashboards for common analysis tasks.
-
Go to the Flowlog Log Center and click Add .
-
On the Create Instance panel, enter an Instance Name, select the Project and Logstore that contain your flow logs, and click OK.
-
Click the instance ID to open Flow Log Details. The Monitoring Center provides the following:
Dashboard
Description
Overview
Accept/reject trends, inbound/outbound traffic trends, total packets and bytes per VPC and ENI, and geographic distribution of source and destination IPs.
Policy Statistics
Accept and reject trends by 5-tuple. Accept: traffic allowed by security groups and network ACLs. Reject: traffic denied. Use this dashboard to identify blocked connections and validate access control rules.
ENI Traffic
Inbound and outbound traffic per ENI.
Inter-ECS Traffic
Traffic between ECS instances.
Custom Query
Run SQL queries against flow log data. See the query and analysis guide.
Analyze traffic between CIDR blocks (optional)
Analyze inter-CIDR-block traffic, detect threats, and trace traffic from ECS instances to specific network segments.
-
On the Flow Log Details page, click CIDR Block Settings.
-
On the CIDR Block Settings tab, turn on Inter-Domain Analysis. This creates a data transformation task that enriches flow logs with network segment information. Data transformation incurs charges.
-
After the transformation task starts, the following dashboards are available:
Dashboard
Description
Inter-domain Traffic
Traffic volume between CIDR blocks.
ECS-to-Domain Traffic
Traffic from ECS instances to specific CIDR blocks.
Threat Intelligence
Threat intelligence for source and destination IPs. Identify connections to known malicious addresses.
Custom Query
Run queries against flow logs enriched with network segment data. See the query and analysis guide.