Flow log overview
Flow logs capture inbound and outbound network traffic of Smart Access Gateway (SAG) instances. Use flow log data to monitor traffic patterns, troubleshoot network errors, and make informed capacity and cost decisions.
Use cases
Traffic monitoring
-
Identify unexpected or unauthorized traffic flows across SAG instances.
-
Track bandwidth consumption for connected branches and sites.
-
Audit inbound and outbound traffic to meet compliance requirements.
Troubleshooting
-
Pinpoint the source of network errors using 5-tuple data (source IP, destination IP, source port, destination port, and protocol).
-
Correlate traffic anomalies with specific time windows using the
startandendfields.
Capacity and cost planning
-
Analyze packet and byte counts to forecast bandwidth needs.
-
Identify top-traffic flows and optimize routing to reduce costs.
Flow log types
Flow logs are classified by storage location:
|
Type |
Storage target |
Querying log data |
Pricing |
|
Log Service flow logs |
Alibaba Cloud Log Service |
Query and analyze in Log Service |
Free during public preview; Log Service charges separately for log storage and retrieval |
|
NetFlow flow logs |
NetFlow collectors (external) |
Query on your NetFlow collectors |
— |
How Log Service flow logs work: Each log entry covers a specific 5-tuple over a configurable time period. During that period, traffic data is aggregated and stored as a single log entry.
How NetFlow flow logs work: Captured traffic is encapsulated into NetFlow packets and transmitted to your NetFlow collectors.
Supported devices
Flow logs are supported only on SAG-1000 devices running version 1.7.0 or later. If your device runs an earlier version, upgrade it first.
Fields in flow log entries
|
Field |
Description |
Log Service |
NetFlow |
|
|
ID of the SAG instance |
Yes |
No |
|
|
Serial number of the SAG device |
Yes |
No |
|
|
ID of the Alibaba Cloud account |
Yes |
No |
|
|
Start of the log collection period |
Yes |
Yes |
|
|
End of the log collection period |
Yes |
Yes |
|
|
Protocol used to transfer network traffic |
Yes |
Yes |
|
|
Source IP address |
Yes |
Yes |
|
|
Source port |
Yes |
Yes |
|
|
Destination IP address |
Yes |
Yes |
|
|
Destination port |
Yes |
Yes |
|
|
Number of data packets |
Yes |
Yes |
|
|
Size of data packets |
Yes |
Yes |
|
|
TCP flags |
Yes |
Yes |
|
|
Type of service (ToS) field in the IP header |
Yes |
Yes |
|
|
ID of the port that receives packets |
Yes |
Yes |
|
|
ID of the port that transmits packets |
Yes |
Yes |
Instance_id,snid, andali-uidare not supported by NetFlow flow logs.
Get started
Follow these steps to start capturing flow log data:
-
Create a flow log — choose Log Service or a NetFlow collector as the storage target. The storage target determines the flow log type. See Create a flow log.
-
Associate the flow log with an SAG instance — after creation, associate the flow log with an SAG instance to start capturing its traffic. See Associate a flow log with an SAG instance.
-
Query flow log data — analyze captured traffic to monitor network activity, reduce costs, and troubleshoot errors. See Query flow log data.