Set up the Flowlog center

Analyze flow logs through the Flowlog Log Center

By analyzing flow logs, you can check access control rules, monitor network traffic, and troubleshoot network faults.

1. Log on to theLog Service console.

2. In log applicationregion, clickView more log applications, and then in log application dialog box, clickFlowlog Log Center.

3. In Flowlog Managementpage, clickAdd.

4. In Create an instance panel, configure the following parameters, and then clickOK.

   parameter	Description
   instanceID	logservice provides by defaultinstanceID. You can also customize the instanceID.
   instance name	Configure the instance name.
   Project	Select the Project that you have created. The Project must be the same as the Project configured in the flowlog that you createdct remain consistent.
   Logstore	Select the Logstore that you have created. The Logstore must be the same as the Logstore configured in the flowlog that you createdstore remain consistent.

   After the instance is created successfully, you can view it in Flowlog Log Center listview the createdinstance.

5. In instanceID column, click the instanceID.

6. In FlowlogDetailspage, You canview andanalysisflowlog information.

   

   monitoringcenterprovides the following dashboards and custom queriesfeature:

   • Overview: Displaysflowlog overall information.

   • policy statistics: DisplaysAccepttrends, Rejecttrends, Acceptcount statistics (consisting of 5-tuples), Rejectcount statistics (consisting of 5-tuples) and other information.A 5-tuple is a set consisting of source network segment, source port, protocol type, destination network segment, and destination port.

     • Accept: Security groups and networkACLthe traffic allowed to be logged.

     • Reject: Security groups and networkACLtraffic denied to be logged.

   • ENIflow volume: Displays the incoming and outgoing traffic of the ENIflow volume information.

   • ECS-flow volume: DisplaysECS instance traffic.

   • custom query: You canby yourselfquery andanalysisVPCflowlog.For more information, seequery andanalysislog.

7. In FlowlogDetailspage, clicknetwork segmentSettings, and then in network segmentSettings tab, and turn on theEnable“Inter-domain analysis” switch.

   After the inter-domain analysis feature is enabled, the system automatically creates a data processing task to generate VPCflowlog, Used foranalysistraffic between different network segments.data processingfeaturewill incur certain fees. You canSelect whether toEnableInter-domain analysisfeature.For more information about data processingfeatureFor specific billing details, seebased on usagefeaturebilling mode billing items.

   logservice has preset multiple network segments, as shown in the following figure.When you need toanalysistraffic between different network segments, you only need to enable it with one clickEnableInter-domain analysisfeature.If the preset network segments do not meet your requirements, You cancustom addnetwork segment.

   Inter-domain analysisprovides the following dashboards and custom queriesfeature:

   • inter-domain traffic: Displaystraffic between different network segments.

   • ECSto segment traffic: DisplaysECS instance traffic to the destination network segment.

   • threat intelligence: DisplayssourceIPaddress and destinationIP address threat intelligence information.

   • custom query: You canby yourselfquery andanalysis with network segment informationVPCflowlog.For more information, seequery andanalysislog.