Skip to content

Commit 1d1b9ab

Browse files
AnnaMHuffAnnaMHuff
authored
Merge pull request #303909 from halkazwini/nw-flowlogs
VNet flow logs tutorial
2 parents 43a6d71 + d8b4c17 commit 1d1b9ab

File tree

8 files changed

+299
-6
lines changed

8 files changed

+299
-6
lines changed

‎articles/network-watcher/media/register-microsoft-insights.png

13.4 KB
Loading

‎articles/network-watcher/media/vnet-flow-logs-tutorial/create-vnet-flow-log.png

67.8 KB
Loading

‎articles/network-watcher/media/vnet-flow-logs-tutorial/flow-log-file.png

135 KB
Loading

‎articles/network-watcher/media/vnet-flow-logs-tutorial/flow-logs-list.png

114 KB
Loading

‎articles/network-watcher/media/vnet-flow-logs-tutorial/flow-logs-tutorial-diagram.png

40.1 KB
Loading

‎articles/network-watcher/toc.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -133,6 +133,8 @@
133133
items:
134134
- name: Overview
135135
href: vnet-flow-logs-overview.md
136+
- name: Log network traffic
137+
href: vnet-flow-logs-tutorial.md
136138
- name: Manage VNet flow logs
137139
href: vnet-flow-logs-manage.md
138140
- name: Audit and deploy using Azure Policy

‎articles/network-watcher/vnet-flow-logs-overview.md

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,8 @@ ms.author: halkazwini
77
ms.service: azure-network-watcher
88
ms.topic: concept-article
99
ms.date: 05/19/2025
10+
ms.custom: build-2025
1011

11-
#CustomerIntent: As an Azure administrator, I want to learn about virtual network flow logs so that I can log my network traffic to analyze and optimize network performance.
12-
ms.custom:
13-
- build-2025
1412
# Customer intent: As an Azure administrator, I want to implement virtual network flow logs so that I can effectively monitor network traffic, optimize performance, and ensure compliance within my virtual network.
1513
---
1614

@@ -273,6 +271,6 @@ The following tables list the supported regions where you can enable virtual net
273271

274272
## Related content
275273

276-
- To learn how to create, change, enable, disable, or delete virtual network flow logs, see the [Manage virtual network flow logs](vnet-flow-logs-manage.md).
277-
- To learn how to use Azure built-in policies to audit or deploy virtual network flow logs, see [Manage virtual network flow logs using Azure Policy](traffic-analytics-policy-portal.md).
278-
- To learn about traffic analytics, see [Traffic analytics overview](traffic-analytics.md) and [Schema and data aggregation in Azure Network Watcher traffic analytics](traffic-analytics-schema.md).
274+
- [Tutorial: Log network traffic to and from a virtual network using the Azure portal](vnet-flow-logs-tutorial.md)
275+
- [Create, change, enable, disable, or delete virtual network flow logs](vnet-flow-logs-manage.md)
276+
- [Traffic analytics overview](traffic-analytics.md)

‎articles/network-watcher/vnet-flow-logs-tutorial.md

Lines changed: 293 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,293 @@
1+
---
2+
title: 'Tutorial: Log network traffic'
3+
titleSuffix: Azure Network Watcher
4+
description: In this tutorial, you learn how to log network traffic flow to and from a virtual network (VNet) using Network Watcher virtual network flow logs.
5+
author: halkazwini
6+
ms.author: halkazwini
7+
ms.service: azure-network-watcher
8+
ms.topic: tutorial
9+
ms.date: 08/06/2025
10+
11+
# CustomerIntent: As an Azure administrator, I need to log the network traffic to and from a virtual network so I can analyze the data for anomalies.
12+
---
13+
14+
# Tutorial: Log network traffic to and from a virtual network using the Azure portal
15+
16+
Virtual network flow logging is a feature of Azure Network Watcher that allows you to log information about IP traffic flowing through an Azure virtual network. For more information about virtual network flow logging, see [Virtual network flow logs](vnet-flow-logs-overview.md).
17+
18+
This tutorial helps you use VNet flow logs to log a virtual machine's network traffic that flows through the virtual network.
19+
20+
:::image type="content" source="./media/vnet-flow-logs-tutorial/flow-logs-tutorial-diagram.png" alt-text="Diagram shows the resources created during the tutorial.":::
21+
22+
In this tutorial, you learn how to:
23+
24+
> [!div class="checklist"]
25+
> - Create a virtual network
26+
> - Create a virtual machine
27+
> - Register Microsoft.insights provider
28+
> - Enable flow logging for a virtual network using Network Watcher flow logs
29+
> - Download logged data
30+
> - View logged data
31+
32+
## Prerequisites
33+
34+
- An Azure account with an active subscription. If you don't have one, create a [free account](https://azure.microsoft.com/free/?WT.mc_id=A261C142F) before you begin.
35+
36+
## Create a virtual network
37+
38+
In this section, you create **myVNet** virtual network with one subnet for the virtual machine.
39+
40+
1. Sign in to the [Azure portal](https://portal.azure.com).
41+
42+
1. In the search box at the top of the portal, enter ***virtual networks***. Select **Virtual networks** from the search results.
43+
44+
:::image type="content" source="./media/virtual-networks-portal-search.png" alt-text="Screenshot that shows how to search for virtual networks in the Azure portal." lightbox="./media/virtual-networks-portal-search.png":::
45+
46+
1. Select **+ Create**. In **Create virtual network**, enter or select the following values in the **Basics** tab:
47+
48+
| Setting | Value |
49+
| --- | --- |
50+
| **Project details** | |
51+
| Subscription | Select your Azure subscription. |
52+
| Resource Group | Select **Create new**. </br> Enter ***myResourceGroup*** in **Name**. </br> Select **OK**. |
53+
| **Instance details** | |
54+
| Name | Enter ***myVNet***. |
55+
| Region | Select **(US) East US**. |
56+
57+
1. Select **Review + create**.
58+
59+
1. Review the settings, and then select **Create**.
60+
61+
## Create a virtual machine
62+
63+
In this section, you create **myVM** virtual machine.
64+
65+
1. In the search box at the top of the portal, enter ***virtual machines***. Select **Virtual machines** from the search results.
66+
67+
1. Select **+ Create** and then select **Virtual machine**.
68+
69+
1. In **Create a virtual machine**, enter or select the following values in the **Basics** tab:
70+
71+
| Setting | Value |
72+
| --- | --- |
73+
| **Project Details** | |
74+
| Subscription | Select your Azure subscription. |
75+
| Resource Group | Select **myResourceGroup**. |
76+
| **Instance details** | |
77+
| Virtual machine name | Enter ***myVM***. |
78+
| Region | Select **(US) East US**. |
79+
| Availability Options | Select **No infrastructure redundancy required**. |
80+
| Security type | Select **Standard**. |
81+
| Image | Select the image that you prefer. This tutorial uses **Windows Server 2022 Datacenter: Azure Edition - x64 Gen2**. |
82+
| Size | Choose a VM size or leave the default setting. |
83+
| **Administrator account** | |
84+
| Username | Enter a username. |
85+
| Password | Enter a password. |
86+
| Confirm password | Reenter password. |
87+
88+
1. Select the **Networking** tab, or select **Next: Disks**, then **Next: Networking**.
89+
90+
1. In the Networking tab, select the following values:
91+
92+
| Setting | Value |
93+
| --- | --- |
94+
| **Network interface** | |
95+
| Virtual network | Select **myVNet**. |
96+
| Subnet | Select **mySubnet**. |
97+
| Public IP | Select **(new) myVM-ip**. |
98+
| NIC network security group | Select **Basic**. |
99+
| Public inbound ports | Select **Allow selected ports**. |
100+
| Select inbound ports | Select **RDP (3389)**. |
101+
102+
> [!CAUTION]
103+
> Leaving the RDP port open to the internet is only recommended for testing. For production environments, it's recommended to restrict access to the RDP port to a specific IP address or range of IP addresses. You can also block internet access to the RDP port and use [Azure Bastion](../bastion/bastion-overview.md) to securely connect to your virtual machine from the Azure portal.
104+
105+
1. Select **Review + create**.
106+
107+
1. Review the settings, and then select **Create**.
108+
109+
1. Once the deployment is complete, select **Go to resource** to go to the **Overview** page of **myVM**.
110+
111+
1. Select **Connect** then select **RDP**.
112+
113+
1. Select **Download RDP File** and open the downloaded file.
114+
115+
1. Select **Connect** and then enter the username and password that you created in the previous steps. Accept the certificate if prompted.
116+
117+
## Register Insights provider
118+
119+
Flow logging requires the **Microsoft.Insights** provider. To check its status, follow these steps:
120+
121+
1. In the search box at the top of the portal, enter ***subscriptions***. Select **Subscriptions** from the search results.
122+
123+
1. Select the Azure subscription that you want to enable the provider for in **Subscriptions**.
124+
125+
1. Under **Settings**, select **Resource providers**.
126+
127+
1. Enter ***insight*** in the filter box.
128+
129+
1. Confirm the status of the provider displayed is **Registered**. If the status is **NotRegistered**, select the **Microsoft.Insights** provider then select **Register**.
130+
131+
:::image type="content" source="./media/register-microsoft-insights.png" alt-text="Screenshot that shows how to register Microsoft Insights provider in the Azure portal." lightbox="./media/register-microsoft-insights.png":::
132+
133+
## Create a storage account
134+
135+
In this section, you create a storage account to use it to store the flow logs.
136+
137+
1. In the search box at the top of the portal, enter ***storage accounts***. Select **Storage accounts** from the search results.
138+
139+
1. Select **+ Create**. In **Create a storage account**, enter or select the following values in the **Basics** tab:
140+
141+
| Setting | Value |
142+
| --- | --- |
143+
| **Project details** | |
144+
| Subscription | Select your Azure subscription. |
145+
| Resource Group | Select **myResourceGroup**. |
146+
| **Instance details** | |
147+
| Storage account name | Enter a unique name. This tutorial uses **nwteststorageaccount**. |
148+
| Region | Select **(US) East US**. The storage account must be in the same region as the virtual machine and its network security group. |
149+
| Primary service | Select **Azure Blob Storage or Azure Data Lake Storage Gen 2**. |
150+
| Performance | Select **Standard**. Flow logs only support Standard-tier storage accounts. |
151+
| Redundancy | Select the redundancy you prefer. This tutorial uses **Locally-redundant storage (LRS)**. |
152+
153+
1. Select the **Review** tab or select the **Review** button at the bottom.
154+
155+
1. Review the settings, and then select **Create**.
156+
157+
## Create a flow log
158+
159+
In this section, you create a virtual network flow log that's saved into the storage account created previously in the tutorial.
160+
161+
1. In the search box at the top of the portal, enter ***network watcher***. Select **Network Watcher** from the search results.
162+
163+
1. Under **Logs**, select **Flow logs**.
164+
165+
1. In **Network Watcher | Flow logs**, select **+ Create** or **Create flow log** blue button.
166+
167+
:::image type="content" source="./media/flow-logs.png" alt-text="Screenshot of Network Watcher flow logs in the Azure portal." lightbox="./media/flow-logs.png":::
168+
169+
1. Enter or select the following values in **Create a flow log**:
170+
171+
| Setting | Value |
172+
| ------- | ----- |
173+
| **Project details** | |
174+
| Subscription | Select the Azure subscription of your network security group that you want to log. |
175+
| Flow log type | Select **Virtual network**. |
176+
| Virtual Network | Select **+ Select target resource**. <br> In **Select virtual network**, select **myVNet**. Then, select **Confirm selection**. |
177+
| Flow Log Name | Leave the default of **myVNet-myresourcegroup-flowlog**. |
178+
| **Instance details** | |
179+
| Subscription | Select the Azure subscription of your storage account. |
180+
| Storage accounts | Select the storage account you created in the previous steps. |
181+
| Retention (days) | Enter ***10*** to retain the flow logs data in the storage account for 10 days. To keep the flow logs data in the storage account forever (until you delete it), enter ***0***. For information about storage pricing, see [Azure Storage pricing](https://azure.microsoft.com/pricing/details/storage/). |
182+
183+
:::image type="content" source="./media/vnet-flow-logs-tutorial/create-vnet-flow-log.png" alt-text="Screenshot of create a flow log page in the Azure portal." lightbox="./media/vnet-flow-logs-tutorial/create-vnet-flow-log.png":::
184+
185+
> [!NOTE]
186+
> The Azure portal creates virtual network flow logs in the **NetworkWatcherRG** resource group.
187+
188+
1. Select **Review + create**.
189+
190+
1. Review the settings, and then select **Create**.
191+
192+
1. Once the deployment is complete, select **Go to resource** to confirm the flow log created and listed in the **Flow logs** page.
193+
194+
:::image type="content" source="./media/vnet-flow-logs-tutorial/flow-logs-list.png" alt-text="Screenshot of Flow logs page in the Azure portal showing the newly created flow log." lightbox="./media/vnet-flow-logs-tutorial/flow-logs-list.png":::
195+
196+
1. Go back to your RDP session with **myVM** virtual machine.
197+
198+
1. Open Microsoft Edge and go to `www.bing.com`.
199+
200+
## Download the flow log
201+
202+
In this section, you go to the storage account you previously selected and download the flow log created in the previous section.
203+
204+
1. In the search box at the top of the portal, enter ***storage accounts***. Select **Storage accounts** from the search results.
205+
206+
2. Select **nwteststorageaccount** or the storage account you previously created and selected to store the logs.
207+
208+
3. Under **Data storage**, select **Containers**.
209+
210+
4. Select the **insights-logs-flowlogflowevent** container.
211+
212+
5. In the container, navigate the folder hierarchy until you get to the `PT1H.json` file that you want to download. Virtual network flow log files follow the following path::
213+
214+
```
215+
https://{storageAccountName}.blob.core.windows.net/insights-logs-flowlogflowevent/flowLogResourceID=/{subscriptionID}_NETWORKWATCHERRG/NETWORKWATCHER_{Region}_{ResourceName}-{ResourceGroupName}-FLOWLOGS/y={year}/m={month}/d={day}/h={hour}/m=00/macAddress={macAddress}/PT1H.json
216+
```
217+
218+
6. Select the ellipsis **...** to the right of the PT1H.json file, then select **Download**.
219+
220+
:::image type="content" source="./media/vnet-flow-logs-tutorial/flow-log-file.png" alt-text="Screenshot showing how to download virtual network flow log data from the storage account in the Azure portal." lightbox="./media/vnet-flow-logs-tutorial/flow-log-file.png":::
221+
222+
> [!NOTE]
223+
> You can use Azure Storage Explorer to access and download flow logs from your storage account. For more information, see [Get started with Storage Explorer](../vs-azure-tools-storage-manage-with-storage-explorer.md).
224+
225+
## View the flow log
226+
227+
Open the downloaded `PT1H.json` file using a text editor of your choice. The following example is a section taken from the downloaded `PT1H.json` file, which shows a flow processed by the rule **DefaultRule_AllowInternetOutBound**.
228+
229+
```json
230+
{
231+
"time": "2025-08-06T20:39:33.3186341Z",
232+
"flowLogGUID": "00000000-0000-0000-0000-000000000000",
233+
"macAddress": "6045BDD6DD48",
234+
"category": "FlowLogFlowEvent",
235+
"resourceId": "/SUBSCRIPTIONS/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e//RESOURCEGROUPS/NETWORKWATCHERRG/PROVIDERS/MICROSOFT.NETWORK/NETWORKWATCHERS/NETWORKWATCHER_EASTUS/FLOWLOGS/MYVNET-MYRESOURCEGROUP-FLOWLOG",
236+
"flowLogVersion": 4,
237+
"operationName": "FlowLogFlowEvent",
238+
"flowRecords": {
239+
"flows": [
240+
{
241+
"aclID": "00000000-0000-0000-0000-000000000000",
242+
"flowGroups": [
243+
{
244+
"rule": "DefaultRule_AllowInternetOutBound",
245+
"flowTuples": [
246+
"1754512773,10.0.0.4,13.107.21.200,49982,443,6,O,C,NX,7,1158,12,8143"
247+
]
248+
}
249+
]
250+
}
251+
]
252+
}
253+
}
254+
```
255+
256+
The comma-separated information for **flowTuples** is as follows:
257+
258+
| Example data | What data represents | Explanation |
259+
| ------------ | -------------------- | ---------- |
260+
| 1754512773 | Time stamp | The time stamp of when the flow occurred in UNIX EPOCH format. In the previous example, the date converts to August 06, 2025 08:39:33 PM UTC/GMT. |
261+
| 10.0.0.4 | Source IP address | The source IP address that the flow originated from. 10.0.0.4 is the private IP address of the VM you previously created.
262+
| 13.107.21.200 | Destination IP address | The destination IP address that the flow was destined to. 13.107.21.200 is the IP address of `www.bing.com`. Since the traffic is destined outside Azure, the security rule **DefaultRule_AllowInternetOutBound** processed the flow. |
263+
| 49982 | Source port | The source port that the flow originated from. |
264+
| 443 | Destination port | The destination port that the flow was destined to. |
265+
| 6 | Protocol | The layer 4 protocol of the flow in IANA assigned values: 6: TCP. |
266+
| O | Direction | The direction of the flow. O: Outbound. |
267+
| C | Flow state | The state of the flow. C: Continuing for an ongoing flow. |
268+
| NX | Flow encryption | The connection is unencrypted. |
269+
| 7 | Packets sent | The total number of TCP packets sent to destination since the last update. |
270+
| 1158 | Bytes sent | The total number of TCP packet bytes sent from source to destination since the last update. Packet bytes include the packet header and payload. |
271+
| 12 | Packets received | The total number of TCP packets received from destination since the last update. |
272+
| 8143 | Bytes received | The total number of TCP packet bytes received from destination since the last update. Packet bytes include packet header and payload.|
273+
274+
## Clean up resources
275+
276+
When no longer needed, delete **myResourceGroup** resource group and all of the resources it contains:
277+
278+
1. In the search box at the top of the portal, enter ***myResourceGroup***. Select **myResourceGroup** from the search results.
279+
280+
1. Select **Delete resource group**.
281+
282+
1. In **Delete a resource group**, enter ***myResourceGroup***, and then select **Delete**.
283+
284+
1. Select **Delete** to confirm the deletion of the resource group and all its resources.
285+
286+
> [!NOTE]
287+
> The **NetworkWatcher_eastus/myVNet-myresourcegroup-flowlog** resource is in the **NetworkWatcherRG** resource group, but it'll be deleted after deleting the **myVNet** virtual network (by deleting the **myResourceGroup** resource group).
288+
289+
## Related content
290+
291+
- [Virtual network flow logs](vnet-flow-logs-overview.md)
292+
- [Create, change, enable, disable, or delete virtual network flow logs](vnet-flow-logs-manage.md)
293+
- [Traffic analytics overview](traffic-analytics.md)

0 commit comments

Comments
 (0)