tencent cloud

Feedback

Features

Last updated: 2022-05-18 11:38:19

    Flow Logs (FL) service provides log collection, query, data management, data record, and analysis features, helping you easily perform Ops and quickly troubleshoot issues.

    Flow Log Collection

    After a flow log is created, the log stream in the specified range (such as ENI, NAT Gateway, or cross-region CCN traffic) will be automatically collected, and the log data will be delivered to CLS for storage. In the CLS topic, each ENI has a unique log stream which contains flow log records.

    Note:

    The FL service for NAT Gateway and cross-region CCN traffic is currently in beta. To try it out, submit a ticket.

    Flow Log Query

    Flow logs are queried and consumed in CLS. CLS supports querying hundreds of millions of log data entries. You can search for data with full text or multiple keywords across topics, and the results can be returned within seconds.

    Flow Log Storage

    FL integrates with CLS to store and manage log data.

    Creating Dashboard to Display Log Data in Multiple Dimensions

    In the logset "flowlog_logset" dedicated to flow logs, you can create a dashboard for ENI flow logs to visualize and analyze flow log data. One dashboard can be created for each log topic.
    Data display in the dashboard is as shown below. For more information, see Advanced Analysis.

    Flow Log Record

    A flow log records the network flow that passes through the capture window and matches particular rules.

    The flow logs record the network flows filtered by the "quintuple + traffic source region + traffic destination region" rule in a specific capture window; that is, only flow logs that meet the rule in the capture window can be recorded as flow logs of cross-region CCN traffic.

    • Quintuple + traffic source region + traffic destination region
      • A quintuple refers to a collection of five values: source IP address, source port, destination IP address, destination port, and transport layer protocol.
      • The traffic source region refers to the region from which cross-region CCN traffic is sent.
      • The traffic destination region refers to the region to which cross-region CCN traffic arrives.
    • Capture window
      It refers to the time period during which FL takes 1 minute to aggregate data and takes about 5 minutes to publish the flow log records. Flow log records are strings separated with spaces as the following format:
      srcaddr dstregionid dstport start dstaddr version packets ccnid protocol srcregionid bytes action region-id srcport end log-status
    FieldData TypeDescription
    srcaddrtextSource IP.
    dstregionidtextTraffic destination region.
    dstportlongTraffic destination port. This field will take effect only for UDP/TCP protocols and will be displayed as "-" for other protocols.
    startlongThe timestamp when the first packet is received in the current capture window. If there are no packets in the capture window, it will be displayed as the start time of the capture window in Unix seconds.
    dstaddrtextDestination IP.
    versiontextFlow log version.
    packetslongNumber of packets transferred in the capture window. This field will be displayed as "-" when log-status is NODATA.
    ccn-idtextUnique CCN instance ID. To get the information of your CCN instance, contact us.
    protocollongIANA protocol number of the traffic. For more information, see Assigned Internet Protocol Numbers.
    srcregionidtextTraffic source region.
    byteslongNumber of bytes transferred in the capture window. This field will be displayed as "-" when log-status is NODATA.
    actiontextOperation associated with the traffic:
    ACCEPT: Cross-region traffic normally forwarded over CCN.
    REJECT: Cross-region traffic prevented from being forwarded due to traffic throttling.
    region-idtextRegion where logs are recorded.
    srcporttextTraffic source port. This field will take effect only for UDP/TCP protocols and will be displayed as "-" for other protocols.
    endlongThe timestamp when the last packet is received in the current capture window. If there are no packets in the capture window, it will be displayed as the end time of the capture window in Unix seconds.
    log-statustextLogging status of the flow log. Valid values:
    OK: Data is normally logged to the specified destination.
    NODATA: There was no inbound or outbound network flow in the capture window, in which case both the packets and bytes fields will be displayed as -1.
    Contact Us

    Contact our sales team or business advisors to help your business.

    Technical Support

    Open a ticket if you're looking for further assistance. Our Ticket is 7x24 avaliable.

    7x24 Phone Support