ECR flow log-Express Connect(Express Connect)-阿里云帮助中心

How it works

Overview

An ECR flow log captures traffic between a VBR and an ECR. The flow log aggregates the captured traffic over a specified aggregation interval, which is 1 minute by default. At the end of each interval, it publishes the aggregated data as a log record to Simple Log Service (SLS) for further analysis.

ECR flow logs use packet sampling and do not capture every packet. The default sampling ratio is 1:4096. Short-lived traffic flows may not be captured. However, when aggregated over a long period, the sampled data provides a statistically accurate representation of network traffic. If you need more detailed data, you can change the sampling ratio to 1:1024.

Use cases

Network traffic monitoring	Traffic analysis and cost optimization
Capture real-time traffic between VBR instances and ECRs to analyze traffic status, including sources, destinations, latency, and packet loss. Monitor and evaluate network throughput and performance between VBR instances and ECRs.	Filter traffic by 5-tuple to analyze traffic trends and identify high-traffic periods on your Express Connect circuits. Optimize bandwidth costs by analyzing traffic distribution.

Log fields

The following table describes the fields in a flow log record.

Field	Description
`version`	The flow log version.
`account-id`	The ID of the Alibaba Cloud account.
`vbr-id`	The ID of the VBR instance.
`ecr-id`	The ID of the ECR instance.
`src-region-id`	The source region ID.
`srcaddr`	The source IP address.
`srcport`	The source port.
`dst-region-id`	The destination region ID.
`dstaddr`	The destination IP address.
`dstport`	The destination port.
`protocol`	The IANA protocol number of the traffic. For more information, see Protocol Numbers.
`packets`	The number of packets.
`bytes`	The size of the packets in bytes.
`start`	The timestamp for the start of the aggregation interval. The timestamp is in Unix format, indicating the number of seconds that have elapsed since 00:00:00 UTC on January 1, 1970.
`end`	The timestamp for the end of the aggregation interval. The timestamp is in Unix format, indicating the number of seconds that have elapsed since 00:00:00 UTC on January 1, 1970.
`instance-id`	The ID of the instance associated with the ECR, such as a VPC or an Enterprise Edition transit router (TR) instance.
`dscp`	The Differentiated Services Code Point (DSCP) value of the packet.
`ip-version`	The IP version. Valid values: v4: IPv4 v6: IPv6
`ratelimit-drop`	The rate at which packets are dropped due to rate limiting, measured in packets per second (pps).
`direction`	The direction of traffic flow relative to the ECR. in: traffic from the VBR to the ECR. out: traffic from the ECR to the VBR.

Billing

ECR flow log billing includes traffic collection fees for Express Connect and service fees for Simple Log Service. For more information, see ECR flow log billing.

Manage flow logs

Create a flow log

Before you begin, make sure that you have:

Created a virtual border router (VBR) instance.
Activated Simple Log Service.

Log on to the Express Connect console.
In the left-side navigation pane, click Express Connect Router (ECR). On the Express Connect Router (ECR) page, click the ID of the target ECR instance.
Click the Flow Log tab, and then click Create Flow Log.

In the Create Flow Log dialog box, set the following parameters and click OK.

Parameter	Description
Name	Enter a name for the flow log.
VBR instance	Select the ID of the VBR instance to associate with the flow log.
Region	The region of the selected VBR instance is automatically displayed.
Project	Select the Project to store the flow logs. You can select an existing Project or create a new one. The Project must be in the same region as the VBR instance.
Logstore	Select the Logstore to store the flow logs. You can select an existing Logstore or create a new one. Note If you select Create Project, you must also select Create Logstore.
Aggregation interval	The interval at which traffic data is captured and aggregated. Valid values: 1 Minute (default) 10 Minutes
Sampling ratio	The packet sampling ratio. For example, `1:4096` indicates that the flow log captures packets with a sampling probability of `1:4096`. Valid values: 1:4096 (default) 1:2048 1:1024
Description	Enter a description for the flow log.
Notes on Creating Service-Linked Roles	When you create a flow log, the system automatically creates a service-linked role named AliyunServiceRoleForECRFlowLog. This role grants ECR the required permissions to access Simple Log Service to collect traffic data from the specified resources. If the role already exists, it is not created again. For more information, see System policies for Express Connect.

Query and analyze flow logs

After the flow log is created, when the Status column displays Started, you can click the Project and Logstore names in the Simple Log Service column to go to the Log Service console to query and analyze the flow logs. For more information, see Query and Analysis Overview.

More operations

Actions	Procedure
Start a flow log	You can start an Inactive flow log. Once started, it begins to collect traffic data from the VBR connection. On the Flow Log page, find the target flow log, and in the Actions column, click Enable. The status of the flow log changes to Started.
Stop a flow log	If you want to temporarily stop collecting traffic information for VBR connections, you can stop the flow log. Stopping a flow log does not delete it. When you want to collect traffic information for VBR connections again, you can start a flow log that is in the Not Started state. On the Flow Log page, find the target flow log, and in the Actions column, click Disable. The status of the flow log changes to Inactive.
Delete a flow log	Deleting a flow log stops traffic recording for the associated resource, but previously generated log data is not deleted. On the Flow Log page, find the target flow log, and in the Actions column, click Delete.