Network Intelligence Service:Veri kaynağı yönetimi

Mevcut bir veri kaynağı ekleme

Mevcut bir VPC flow log veya TR flow log kaydını doğrudan NIS Traffic Analyzer'a ekleyebilirsiniz.

1. Hedef NIS Traffic Analyzer'ın ayrıntılar sayfasına gidin. Basic Information > VPC flow log sekmesinde Add data source seçeneğine tıklayın.

2. Add data source sayfasında VPC flow log veya TR flow log sekmesine tıklayın. Flow log kaydının bulunduğu Region değerini seçin, hedef flow log kaydının yanındaki onay kutusunu işaretleyin ve ardından OK seçeneğine tıklayın.

   Yeni bir veri kaynağının örnekleme aralığı, mevcut NIS Traffic Analyzer'ın örnekleme aralığından küçük veya buna eşit olmalıdır.

Yeni bir veri kaynağı oluşturma ve ekleme

Yeni bir VPC flow log veya TR flow log kaydı oluşturup bunu NIS Traffic Analyzer'a ekleyebilirsiniz.

1. Hedef NIS Traffic Analyzer'ın ayrıntılar sayfasına gidin. Basic Information > VPC flow log sekmesinde Add data source seçeneğine tıklayın.

2. Add data source sayfasında oluşturmak istediğiniz veri kaynağının sekmesine tıklayın:

   VPC flow log

   1. Create flow log seçeneğine tıklayın ve iletişim kutusunda Collection Settings parametrelerini yapılandırın:

      Önemli

      Yeni bir veri kaynağının örnekleme aralığı, mevcut NIS Traffic Analyzer'ın örnekleme aralığından küçük veya buna eşit olmalıdır.

      Parameter

      Region: Select the region of the target resource. Resource Type and Resource Instance: Select the collection granularity. You can select VPC, vSwitch, or ENI. If you select a VPC or vSwitch, the system monitors traffic for all ENIs within the selected resource. Data Transfer Type: Select whether to capture traffic that is allowed or rejected by access controls, such as security group and network ACL rules. IP Version: Select IPv4 to capture only IPv4 traffic, or select Dual-stack to capture both IPv4 and IPv6 traffic. The following regions support IPv6: China (Hangzhou), China (Shanghai), China (Qingdao), China (Beijing), China (Hohhot), China (Shenzhen), Singapore, US (Silicon Valley), and US (Virginia). Sampling Interval (Minutes): Specifies the duration of the capture window for aggregating traffic information. You can set the interval to 1, 5, or 10 minutes. A shorter interval generates flow logs more frequently and provides more timely data, which helps you detect and locate issues faster. A longer interval provides less timely data but reduces the number of log entries and helps save costs. For example, for a TCP session that maintains a persistent connection, a 1-minute window produces 60 log entries per hour, while a 10-minute window produces only 6 log entries. If multiple flow log instances in a VPC collect traffic from the same ENI, the system uses the shortest sampling interval among all instances as the actual capture period. Sampling Path: To reduce costs, you can select specific capture scenarios. To select a specific scenario, first deselect the default All Scenarios option. You can capture traffic that passes through the following network components: an IPv4 gateway, a NAT Gateway, a VPN Gateway, a Transit Router (TR), a gateway endpoint, a virtual border router (VBR), an Express Connect Router (ECR), a Gateway Load Balancer (GWLB) Endpoint, and traffic to the Internet. Flow Log Record Format: Specifies the set of fields to include in the flow log output. Alibaba Cloud Default Format: Outputs all default fields. For details, see log fields. Custom Format: Subscribe only to the fields you need, reducing unnecessary field output and lowering flow log costs. Quick select: Click 5-tuple or 2-tuple to populate the corresponding field combinations. After population, you can add or remove fields. Manual select: Select fields from the dropdow list. You must select at least one field.

   2. Flow log kaydı oluşturulduktan sonra sistem bu kaydı otomatik olarak NIS Traffic Analyzer'a ekler.

   TR flow log

   1. Create flow log seçeneğine tıklayın. Create flow log iletişim kutusunda:

      Parameter

      First, configure Collection Settings: CEN: Select the Cloud Enterprise Network (CEN) where the target Transit Router is deployed. Transit Router: Select the target Transit Router (TR). Instance: Specifies the resource to monitor. The direction of traffic collection depends on the resource type: For an Inter-region Connection, only one-way outbound traffic from the TR is collected. For a VBR Connection, VPC Connection, VPN Connections, or ECR Connection, both inbound and outbound traffic are collected. If you select TR, traffic is collected for all network instance connections on the TR, including inter-region, VBR, VPC, VPN, and ECR connections. The collection direction for each connection type is the same as described above. Sampling Interval: The time window for aggregating traffic into flow log records. You can select 1 minute, 5 minutes, or 10 minutes. A shorter window generates flow logs more frequently, which helps you detect and troubleshoot issues faster. A longer window reduces timeliness but also decreases the number of log entries to save costs. Önemli The sampling interval of a new data source must be less than or equal to the sampling interval of the current NIS Traffic Analyzer. Configure Analysis and Delivery > Sampling Fields: Default Format: Uses the default set of log fields. Custom Format: Allows you to select specific fields to include in the log. This option supports more fields than the default format. Selecting fewer fields can simplify log data and reduce costs. The srcaddr, dstaddr, and bytes fields are required. After you select a log format, the system generates a string representation of the format. Click Copy selected format to reuse this format when you call an API to create flow logs in bulk. After you confirm the settings, click OK.

   2. Flow log kaydı oluşturulduktan sonra TR trafiğini analiz etmeye başlamak için Deliver to Traffic Analyzer seçeneğine tıklayın.

Veri kaynağını kaldırma

Hedef veri kaynağının Remove Data Source sütununda Remove Data Source seçeneğine tıklayın.

Bir veri kaynağını kaldırmak, yalnızca bu kaynağın NIS Traffic Analyzer ile ilişkisini keser. Depolanmış analiz verileri ve flow log toplama görevi silinmez. Toplama görevini silmek için bkz. VPC flow log silme ve TR flow log silme.