CEN flow logs

Introduction

The flow log feature aggregates traffic data that is captured within a specified time window and writes the aggregated traffic data as flow logs to Simple Log Service. You can query and analyze the logs in the Simple Log Service console.

The traffic data that is captured varies based on the object from which the traffic data is captured.

Assets

• Custom project and Logstore

  Important

  • Do not delete the project or Logstore that is related to flow logs. Otherwise, flow logs cannot be sent to Simple Log Service.

  • When you create a custom Logstore, note that billable items that are involved vary based on the billing mode of the Logstore. For more information, see Billable items.

• Dedicated dashboards

  None

Billing

Limits

• Flow logs cannot capture multicast traffic information.

• If you have an existing flow log and want to use fields of a later flow log version, you need to delete the flow log and create a new one.

  When you create a flow log, it is created in the latest version by default. The latest flow log version supports all fields of earlier flow log versions. You can view the version of a flow log in the CEN console.

• If a single TCP connection contains only packets that are used for connection establishment, connection reset, or connection closure, the flow log of the transit router does not record the connection.

  For example, if a TCP connection has not completed three-way handshakes or the client request is reset by the firewall, the connection is not recorded in the flow log. This design aims to prevent excessive flow log entries generated by TCP scanners.