Skip to content

Commit 4cd68c6

Browse files
author
Jill Grant
authored
Merge pull request #288575 from halkazwini/nw-nsgflow
Updates: Flow logging for network security groups
2 parents af93b91 + edddeb2 commit 4cd68c6

File tree

3 files changed

+13
-15
lines changed

3 files changed

+13
-15
lines changed

‎articles/network-watcher/media/nsg-flow-logs-overview/nsg-flow-logs-portal.png

-145 KB
Binary file not shown.

‎articles/network-watcher/media/nsg-flow-logs-overview/tuple.png

-11.7 KB
Loading

‎articles/network-watcher/nsg-flow-logs-overview.md

Lines changed: 13 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ author: halkazwini
66
ms.author: halkazwini
77
ms.service: azure-network-watcher
88
ms.topic: concept-article
9-
ms.date: 09/26/2024
9+
ms.date: 10/16/2024
1010

1111
#CustomerIntent: As an Azure administrator, I want to learn about NSG flow logs so that I can log my network traffic to analyze and optimize the network performance.
1212
---
@@ -17,8 +17,6 @@ ms.date: 09/26/2024
1717

1818
Network security group (NSG) flow logging is a feature of Azure Network Watcher that allows you to log information about IP traffic flowing through a [network security group](../virtual-network/network-security-groups-overview.md). Flow data is sent to Azure Storage from where you can access it and export it to any visualization tool, security information and event management (SIEM) solution, or intrusion detection system (IDS) of your choice.
1919

20-
:::image type="content" source="./media/nsg-flow-logs-overview/nsg-flow-logs-portal.png" alt-text="Screenshot showing Network Watcher NSG flow logs page in the Azure portal.":::
21-
2220
## Why use flow logs?
2321

2422
It's vital to monitor, manage, and know your own network so that you can protect and optimize it. You need to know the current state of the network, who's connecting, and where users are connecting from. You also need to know which ports are open to the internet, what network behavior is expected, what network behavior is irregular, and when sudden rises in traffic happen.
@@ -125,7 +123,7 @@ Here's an example format of a version 1 NSG flow log:
125123
"time": "2017-02-16T22:00:32.8950000Z",
126124
"systemId": "55ff55ff-aa66-bb77-cc88-99dd99dd99dd",
127125
"category": "NetworkSecurityGroupFlowEvent",
128-
"resourceId": "/SUBSCRIPTIONS/00000000-0000-0000-0000-000000000000/RESOURCEGROUPS/FABRIKAMRG/PROVIDERS/MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/FABRIAKMVM1-NSG",
126+
"resourceId": "/SUBSCRIPTIONS/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/RESOURCEGROUPS/FABRIKAMRG/PROVIDERS/MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/FABRIAKMVM1-NSG",
129127
"operationName": "NetworkSecurityGroupFlowEvents",
130128
"properties": {
131129
"Version": 1,
@@ -162,7 +160,7 @@ Here's an example format of a version 1 NSG flow log:
162160
"time": "2017-02-16T22:01:32.8960000Z",
163161
"systemId": "55ff55ff-aa66-bb77-cc88-99dd99dd99dd",
164162
"category": "NetworkSecurityGroupFlowEvent",
165-
"resourceId": "/SUBSCRIPTIONS/00000000-0000-0000-0000-000000000000/RESOURCEGROUPS/FABRIKAMRG/PROVIDERS/MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/FABRIAKMVM1-NSG",
163+
"resourceId": "/SUBSCRIPTIONS/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/RESOURCEGROUPS/FABRIKAMRG/PROVIDERS/MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/FABRIAKMVM1-NSG",
166164
"operationName": "NetworkSecurityGroupFlowEvents",
167165
"properties": {
168166
"Version": 1,
@@ -200,7 +198,7 @@ Here's an example format of a version 1 NSG flow log:
200198
"time": "2017-02-16T22:00:32.8950000Z",
201199
"systemId": "55ff55ff-aa66-bb77-cc88-99dd99dd99dd",
202200
"category": "NetworkSecurityGroupFlowEvent",
203-
"resourceId": "/SUBSCRIPTIONS/00000000-0000-0000-0000-000000000000/RESOURCEGROUPS/FABRIKAMRG/PROVIDERS/MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/FABRIAKMVM1-NSG",
201+
"resourceId": "/SUBSCRIPTIONS/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/RESOURCEGROUPS/FABRIKAMRG/PROVIDERS/MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/FABRIAKMVM1-NSG",
204202
"operationName": "NetworkSecurityGroupFlowEvents",
205203
"properties": {
206204
"Version": 1,
@@ -237,7 +235,7 @@ Here's an example format of a version 1 NSG flow log:
237235
"time": "2017-02-16T22:01:32.8960000Z",
238236
"systemId": "55ff55ff-aa66-bb77-cc88-99dd99dd99dd",
239237
"category": "NetworkSecurityGroupFlowEvent",
240-
"resourceId": "/SUBSCRIPTIONS/00000000-0000-0000-0000-000000000000/RESOURCEGROUPS/FABRIKAMRG/PROVIDERS/MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/FABRIAKMVM1-NSG",
238+
"resourceId": "/SUBSCRIPTIONS/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/RESOURCEGROUPS/FABRIKAMRG/PROVIDERS/MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/FABRIAKMVM1-NSG",
241239
"operationName": "NetworkSecurityGroupFlowEvents",
242240
"properties": {
243241
"Version": 1,
@@ -273,7 +271,7 @@ Here's an example format of a version 1 NSG flow log:
273271
"time": "2017-02-16T22:02:32.9040000Z",
274272
"systemId": "55ff55ff-aa66-bb77-cc88-99dd99dd99dd",
275273
"category": "NetworkSecurityGroupFlowEvent",
276-
"resourceId": "/SUBSCRIPTIONS/00000000-0000-0000-0000-000000000000/RESOURCEGROUPS/FABRIKAMRG/PROVIDERS/MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/FABRIAKMVM1-NSG",
274+
"resourceId": "/SUBSCRIPTIONS/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/RESOURCEGROUPS/FABRIKAMRG/PROVIDERS/MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/FABRIAKMVM1-NSG",
277275
"operationName": "NetworkSecurityGroupFlowEvents",
278276
"properties": {
279277
"Version": 1,
@@ -323,7 +321,7 @@ Here's an example format of a version 2 NSG flow log:
323321
"time": "2018-11-13T12:00:35.3899262Z",
324322
"systemId": "66aa66aa-bb77-cc88-dd99-00ee00ee00ee",
325323
"category": "NetworkSecurityGroupFlowEvent",
326-
"resourceId": "/SUBSCRIPTIONS/00000000-0000-0000-0000-000000000000/RESOURCEGROUPS/FABRIKAMRG/PROVIDERS/MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/FABRIAKMVM1-NSG",
324+
"resourceId": "/SUBSCRIPTIONS/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/RESOURCEGROUPS/FABRIKAMRG/PROVIDERS/MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/FABRIAKMVM1-NSG",
327325
"operationName": "NetworkSecurityGroupFlowEvents",
328326
"properties": {
329327
"Version": 2,
@@ -362,7 +360,7 @@ Here's an example format of a version 2 NSG flow log:
362360
"time": "2018-11-13T12:01:35.3918317Z",
363361
"systemId": "66aa66aa-bb77-cc88-dd99-00ee00ee00ee",
364362
"category": "NetworkSecurityGroupFlowEvent",
365-
"resourceId": "/SUBSCRIPTIONS/00000000-0000-0000-0000-000000000000/RESOURCEGROUPS/FABRIKAMRG/PROVIDERS/MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/FABRIAKMVM1-NSG",
363+
"resourceId": "/SUBSCRIPTIONS/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/RESOURCEGROUPS/FABRIKAMRG/PROVIDERS/MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/FABRIAKMVM1-NSG",
366364
"operationName": "NetworkSecurityGroupFlowEvents",
367365
"properties": {
368366
"Version": 2,
@@ -391,13 +389,13 @@ Here's an example format of a version 2 NSG flow log:
391389

392390
### Log tuple and bandwidth calculation
393391

394-
![Screenshot that shows an example of a flow log tuple.](./media/nsg-flow-logs-overview/tuple.png)
392+
:::image type="content" source="./media/nsg-flow-logs-overview/tuple.png" alt-text="Screenshot that shows an example of a flow log tuple." lightbox="./media/nsg-flow-logs-overview/tuple.png":::
395393

396-
Here's an example bandwidth calculation for flow tuples from a TCP conversation between 185.170.185.105:35370 and 10.2.0.4:23:
394+
Here's an example of bandwidth calculation for flow tuples from a TCP conversation between `203.0.113.105:35370` and `10.0.0.5:443`:
397395

398-
`1493763938,185.170.185.105,10.2.0.4,35370,23,T,I,A,B,,,,`
399-
`1493695838,185.170.185.105,10.2.0.4,35370,23,T,I,A,C,1021,588096,8005,4610880`
400-
`1493696138,185.170.185.105,10.2.0.4,35370,23,T,I,A,E,52,29952,47,27072`
396+
`1708978215,203.0.113.105,10.0.0.5,35370,443,T,I,A,B,,,,`
397+
`1708978215,203.0.113.105,10.0.0.5,35370,443,T,I,A,C,1021,588096,8005,4610880`
398+
`1708978215,203.0.113.105,10.0.0.5,35370,443,T,I,A,E,52,29952,47,27072`
401399

402400
For continuation (`C`) and end (`E`) flow states, byte and packet counts are aggregate counts from the time of the previous flow's tuple record. In the example conversation, the total number of packets transferred is 1021+52+8005+47 = 9125. The total number of bytes transferred is 588096+29952+4610880+27072 = 5256000.
403401

0 commit comments

Comments
 (0)