Flow Logs (FL) supports the collection of flow logs of ENI, NAT Gateway, and cross-region CCN traffic only within the specified VPC range but not in the classic network.
Note:
The FL service for NAT Gateway and cross-region CCN traffic is currently in beta. To try it out, please submit a ticket.
The FL feature is available in all regions, but there are regional restrictions in the Cloud Log Service (CLS). Therefore, data in several regions may not be delivered to CLS. For more information, see Available Regions.
The configuration of a flow log cannot be modified after creation. For example, the CLS to which the flow log is published cannot be modified.
FL does not support capturing the following IP traffic:
Traffic generated by Windows instances for activation of Windows license.
DHCP traffic.
Only one flow log can be created for each ENI.
FL collects the original outbound traffic and limited inbound traffic of the ENI on a CVM.
Assume you create a flow log for the ENI on a CVM:
When the CVM accesses the public network through a cloud load balancer, the “1” traffic will be collected for the outbound direction and the “2” traffic will be collected for the inbound direction.
When the CVM accesses the public network through a NAT Gateway, the “3” traffic will be collected for the outbound direction and the “4” traffic will be collected for the inbound direction.
Dashboard-Enabled Flow Log Types
Currently, advanced analysis dashboards can be created and viewed only for flow logs of the ENI type in the logset and log topic with the "Flowlog" flag.
Note:
In Topic Configuration, you can create the logset “flowlog_logset” and a log topic with the “Flowlog” flag.
Restricted Models
The Families and Models that support the FL feature: M6ce, M6p, SA3se, S4m, DA3, ITA3, I6t, I6, SA3, S5se, SA2, SK1, S4, S5, SN3ne, S3ne, S2ne, SA2a, S3ne, SW3a, SW3b, SW3ne, ITA3, IT5c, IT5, IT5c, IT3, I3, D3, DA2, D2, M6, MA2, M4, C6, IT3a, IT3b, IT3c, C4ne, CN3ne, C3ne, GI1, PNV4, GNV4v, GNV4, GT4, GI3X, GN7, and GN7vw.
The following models no longer support creating flow logs for data collection, and the existing flow logs on the models will not report data from July 25, 2022:
Standard: S3, SA1, S2, S1, and SA5
MEM optimized: M3, M2, and M1
Compute optimized: C4, CN3, C3, and C2
Batch compute: BC1 and BS1
High-performance computing cluster: HCCIC5 and HCCG5v
