You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
title: 'Configure ExpressRoute Traffic Collector for ExpressRoute Direct using the Azure portal (Preview)'
3
-
description: Learn how to create an ExpressRoute Traffic Collector resource to import logs into a Log Analytics workspace.
2
+
title: Configure Traffic Collector for ExpressRoute Direct
3
+
titleSuffix: Azure ExpressRoute
4
+
description: This article shows you how to create an ExpressRoute Traffic Collector resource and import logs into a Log Analytics workspace.
4
5
services: expressroute
5
6
author: duongau
6
7
ms.service: expressroute
7
-
ms.topic: tutorial
8
-
ms.date: 07/15/2022
8
+
ms.topic: how-to
9
+
ms.date: 08/09/2023
9
10
ms.author: duau
11
+
#Customer intent: As a network engineer, I want to configure ExpressRoute Traffic Collector to import flow logs into a Log Analytics workspace.
10
12
---
11
13
12
-
# Configure ExpressRoute Traffic Collector for ExpressRoute Direct using the Azure portal (Preview)
14
+
# Configure Traffic Collector for ExpressRoute Direct
13
15
14
-
This article will help you deploy an ExpressRoute Traffic Collector using the Azure portal. You'll learn how to add and remove an ExpressRoute Traffic Collector, associate it to an ExpressRoute Direct circuit and Log Analytics workspace. Once the ExpressRoute Traffic Collector is deployed, sampled flow logs will get imported into a Log Analytics workspace. For more information, see [About ExpressRoute Traffic Collector](traffic-collector.md).
16
+
This article helps you deploy an ExpressRoute Traffic Collector using the Azure portal. You learn how to add and remove an ExpressRoute Traffic Collector, associate it to an ExpressRoute Direct circuit and Log Analytics workspace. Once the ExpressRoute Traffic Collector is deployed, sampled flow logs get imported into a Log Analytics workspace. For more information, see [About ExpressRoute Traffic Collector](traffic-collector.md).
15
17
16
-
> [!IMPORTANT]
17
-
> ExpressRoute Traffic Collector is currently in PREVIEW.
18
-
> See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
18
+
## Prerequisites
19
+
20
+
- An ExpressRoute Direct circuit with Private or Microsoft peering configured.
21
+
- A Log Analytics workspace (Create new or use existing workspace).
19
22
20
23
## Limitations
21
24
22
25
- ExpressRoute Traffic Collector supports a maximum ExpressRoute Direct circuit size of 100 Gbps.
23
-
- You can associate up to 20 ExpressRoute Direct circuits with ExpressRoute Traffic Collector as long as the total circuit bandwidth doesn't exceed 100 Gbps.
24
-
25
-
## Prerequisites
26
-
27
-
- ExpressRoute Direct circuit with Private or Microsoft peering configured.
28
-
- A Log Analytics workspace (Create new or use existing).
26
+
- You can associate up to 20 ExpressRoute Direct circuits with ExpressRoute Traffic Collector. The total circuit bandwidth can't exceed 100 Gbps.
27
+
- The ExpressRoute Direct circuit, Traffic Collector and the Log Analytics workspace must be in the same geo-political region. Cross geo-political resource association isn't supported.
28
+
- The ExpressRoute Direct circuit and Traffic Collector must be deployed in the same subscription. Cross subscription deployments aren't available.
29
29
30
30
> [!NOTE]
31
-
> - The ExpressRoute Direct circuit, ExpressRoute Traffic Collector and the Log Analytics workspace must be in the same geo-political region. Cross geo-political resource association is not supported.
32
-
> - The ExpressRoute Direct circuit and ExpressRoute Traffic Collector must be deployed in the same subscription. Cross subscription deployment is currently not available.
33
-
> - Log Analytics and ExpressRoute Traffic Collector can be deployed in cross subscription.
31
+
> - Log Analytics and ExpressRoute Traffic Collector can be deployed in a different subscription.
34
32
> - When ExpressRoute Traffic Collector gets deployed in an Azure region that supports availability zones, it will have availability zone enabled by default.
35
33
36
34
## Permissions
37
35
38
-
- Minimum contributor access is required to deploy ExpressRoute Traffic Collector.
39
-
- Minimum contributor access is required to associate ExpressRoute Direct circuit with ExpressRoute Traffic Collector.
40
-
- Monitor contributor role is required to associate Log Analytics workspace with ExpressRoute Traffic Collector.
36
+
- Minimum of **contributor** access is required to deploy ExpressRoute Traffic Collector.
37
+
- Minimum of **contributor** access is required to associate ExpressRoute Direct circuit with ExpressRoute Traffic Collector.
38
+
-**Monitor contributor** role is required to associate Log Analytics workspace with ExpressRoute Traffic Collector.
41
39
42
40
For more information, see [Identity and access management](../active-directory/fundamentals/active-directory-ops-guide-iam.md).
43
41
44
42
## Deploy ExpressRoute Traffic Collector
45
43
46
-
1. Sign in to the [Azure portal](https://portal.azure.com/)
44
+
1. Sign in to the [Azure portal](https://portal.azure.com/).
47
45
48
-
1. In the portal, go to the list of ExpressRoute circuits and select **ExpressRoute Traffic Collectors**. Then select **+ Create new**.
46
+
1. In the portal, go to the ExpressRoute circuits page and select **ExpressRoute Traffic Collectors** from the top of the page. Select **+ Create new** from the drop-down menu.
49
47
50
48
:::image type="content" source="./media/how-to-configure-traffic-collector/circuit-list.png" alt-text="Screenshot of the create new ExpressRoute Traffic Collector button from the ExpressRoute circuit list page.":::
51
49
@@ -61,11 +59,13 @@ For more information, see [Identity and access management](../active-directory/f
61
59
| Region | Select a region to deploy this resource into. This resource needs to be in the same geo-political region as the Log Analytics workspace and the ExpressRoute Direct circuits. |
62
60
| Collector Policy | This value is automatically filled in as **Default**. |
63
61
64
-
1. On the **Select ExpressRoute circuit** tab, select **+ Add ExpressRoute Circuits**. Select the checkbox next to the circuit you would like to add to the Traffic Collector and then select **Add**. Once you're satisfied with the circuits added, select **Next**.
62
+
1. On the **Select ExpressRoute circuit** tab, select **+ Add ExpressRoute Circuits**.
63
+
64
+
1. On the **Add Circuits** page, select the checkbox next to the circuit you would like Traffic Collector to monitor and then select **Add**. Select **Next** to configure where logs gets forwarded to.
65
65
66
66
:::image type="content" source="./media/how-to-configure-traffic-collector/select-circuits.png" alt-text="Screenshot of the select ExpressRoute circuits tab and add circuits page.":::
67
67
68
-
1. On the **Forward Logs** tab, select the checkbox for **Send to Log Analytics workspace**. You can create a new Log Analytics workspace or choose an existing. The workspace can be in a different Azure subscription but has to be in the same geo-political region. Select **Next** once a workspace has been chosen.
68
+
1. On the **Forward Logs** tab, select the checkbox for **Send to Log Analytics workspace**. You can create a new Log Analytics workspace or select an existing one. The workspace can be in a different Azure subscription but has to be in the same geo-political region. Select **Next** once a workspace has been chosen.
69
69
70
70
:::image type="content" source="./media/how-to-configure-traffic-collector/forward-logs.png" alt-text="Screenshot of the forward logs tab to Logs Analytics workspace.":::
71
71
@@ -91,6 +91,6 @@ Once all circuits have been removed from the ExpressRoute Traffic Collector, sel
91
91
92
92
:::image type="content" source="./media/how-to-configure-traffic-collector/overview.png" alt-text="Screenshot of delete button on overview page." lightbox="./media/how-to-configure-traffic-collector/overview.png":::
-Learn about [ExpressRoute Traffic Collector metrics](expressroute-monitoring-metrics-alerts.md#expressroute-traffic-collector-metrics) to monitor your ExpressRoute Traffic Collector resource.
Copy file name to clipboardExpand all lines: articles/expressroute/traffic-collector.md
+52-14Lines changed: 52 additions & 14 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,28 +1,25 @@
1
1
---
2
-
title: Enable flow logging using Azure ExpressRoute Traffic Collector (Preview)
3
-
description: Learn about ExpressRoute Traffic Collector and the different use cases where this feature will be helpful.
2
+
title: Azure ExpressRoute Traffic Collector
3
+
titleSuffix: Azure ExpressRoute
4
+
description: Learn about ExpressRoute Traffic Collector and the different use cases where this feature is helpful.
4
5
services: expressroute
5
6
author: duongau
6
7
ms.service: expressroute
7
8
ms.topic: conceptual
8
-
ms.date: 08/02/2022
9
+
ms.date: 08/21/2023
9
10
ms.author: duau
10
11
ms.custom: references_regions
11
12
---
12
13
13
-
# Enable flow logging using ExpressRoute Traffic Collector (Preview)
14
+
# Azure ExpressRoute Traffic Collector
14
15
15
-
ExpressRoute Traffic Collector enables sampling of network flows sent over your ExpressRoute Direct circuits. Flow logs get sent to a [Log Analytics workspace](../azure-monitor/logs/log-analytics-overview.md) where you can create your own log queries for further analysis, export the data to any visualization tool or SIEM (Security Information and Event Management) of your choice. Flow logging can be enabled for both private peering and Microsoft peering with ExpressRoute Traffic Collector.
16
-
17
-
> [!IMPORTANT]
18
-
> ExpressRoute Traffic Collector is currently in PREVIEW.
19
-
> See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
16
+
ExpressRoute Traffic Collector enables sampling of network flows sent over your ExpressRoute Direct circuits. Flow logs get sent to a [Log Analytics workspace](../azure-monitor/logs/log-analytics-overview.md) where you can create your own log queries for further analysis. You can also export the data to any visualization tool or SIEM (Security Information and Event Management) of your choice. Flow logs can be enabled for both private peering and Microsoft peering with ExpressRoute Traffic Collector.
20
17
21
18
:::image type="content" source="./media/traffic-collector/main-diagram.png" alt-text="Diagram of ExpressRoute traffic collector in an Azure environment.":::
22
19
23
20
## Use cases
24
21
25
-
Flow logs can help you derive various traffic insights. Most common use cases are:
22
+
Flow logs can help you look into various traffic insights. Some common use cases are:
26
23
27
24
### Network monitoring
28
25
@@ -44,7 +41,7 @@ Flow logs can help you derive various traffic insights. Most common use cases ar
44
41
45
42
## Flow log collection and sampling
46
43
47
-
ExpressRoute Traffic Collector enables flow collection for Azure private peering and Microsoft peering. Flow logs are collected every minute. All packets collected for a given flow gets aggregated and imported into a Log Analytics workspace for further analysis. During flow collection, not every packet is captured into its own flow record. ExpressRoute Traffic Collector uses a sampling rate of 1:4096, meaning 1 out of every 4096 packets gets captured. Therefore, sampling rate short flows (in total bytes) may not get collected. This sampling size doesn't affect network traffic analysis when sampled data is aggregated over a longer period of time. Flow collection time and sampling rate are fixed and can't be changed.
44
+
Flow logs are collected at an interval of every 1 minute. All packets collected for a given flow get aggregated and imported into a Log Analytics workspace for further analysis. During flow collection, not every packet is captured into its own flow record. ExpressRoute Traffic Collector uses a sampling rate of 1:4096, meaning 1 out of every 4096 packets gets captured. Therefore, sampling rate short flows (in total bytes) may not get collected. This sampling size doesn't affect network traffic analysis when sampled data is aggregated over a longer period of time. Flow collection time and sampling rate are fixed and can't be changed.
0 commit comments