|
1 | 1 | ---
|
2 | 2 | title: NSG flow logs
|
3 | 3 | titleSuffix: Azure Network Watcher
|
4 |
| -description: Learn about NSG flow logs feature of Azure Network Watcher. |
5 |
| -services: network-watcher |
| 4 | +description: Learn about NSG flow logs feature of Azure Network Watcher, which allows you to log information about IP traffic flowing through a network security group. |
| 5 | +ms.author: halkazwini |
6 | 6 | author: halkazwini
|
7 | 7 | ms.service: network-watcher
|
8 |
| -ms.topic: conceptual |
9 |
| -ms.workload: infrastructure-services |
10 |
| -ms.date: 05/24/2023 |
11 |
| -ms.author: halkazwini |
12 |
| -ms.custom: template-concept, engagement-fy23 |
| 8 | +ms.topic: concept-article |
| 9 | +ms.date: 09/20/2023 |
| 10 | + |
| 11 | +#CustomerIntent: As an Azure administrator, I want to learn about NSG flow logs so that I can better monitor and optimize my network. |
13 | 12 | ---
|
14 | 13 |
|
15 | 14 | # Flow logging for network security groups
|
@@ -560,53 +559,14 @@ This problem might be related to:
|
560 | 559 |
|
561 | 560 | Support for automation via Azure Resource Manager templates (ARM templates) is now available for NSG flow logs. For more information, see [Configure network security group flow logs using an Azure Resource Manager (ARM) template](quickstart-configure-network-security-group-flow-logs-from-arm-template.md).
|
562 | 561 |
|
563 |
| -## Frequently asked questions (FAQ) |
564 |
| - |
565 |
| -### What do NSG flow logs do? |
566 |
| - |
567 |
| -NSG flow logs enable you to log 5-tuple flow information about all traffic passing through your network security groups. The raw flow logs are written to an Azure Storage account. From there, you can further process, analyze, query, or export them as needed. |
568 |
| - |
569 |
| -### Do flow logs affect my network latency or performance? |
570 |
| - |
571 |
| -Flow log data is collected outside the path of your network traffic, so it doesn't affect network throughput or latency. You can create or delete flow logs without any risk of impact to network performance. |
572 |
| - |
573 |
| -### How do I use NSG flow logs with a storage account behind a firewall? |
574 |
| - |
575 |
| -To use a storage account behind a firewall, you have to provide an exception for trusted Microsoft services to access the storage account: |
576 |
| - |
577 |
| -1. Go to the storage account by entering the account's name in the portal search. |
578 |
| -1. In the **Networking** section, select **Firewalls and virtual networks** at the top of the page. Then make sure that the following items are configured: |
579 |
| - |
580 |
| - - For **Public network access**, select **Enabled from selected virtual networks and IP addresses**. |
581 |
| - - For **Firewall**, select **Add your client IP address**. |
582 |
| - |
583 |
| - > [!Note] |
584 |
| - > A client IP address is provided here by default. Use `ipconfig` to verify that this IP address matches the machine that you're using to access the storage account. If the client IP address doesn't match your machine, you might get an "Unauthorized" error when you're trying to access the storage account to read NSG flow logs. |
585 |
| -
|
586 |
| - - For **Exceptions**, select **Allow Azure service on the trusted services list to access this storage account**. |
587 |
| - |
588 |
| -1. On the NSG flow logs page, find your target network security group and then enable flow logging using the previously configured storage account. |
589 |
| - |
590 |
| -Check the storage logs after a few minutes. You should see an updated time stamp or a new JSON file created. |
591 |
| - |
592 |
| -### How do I use NSG flow logs with a storage account behind a service endpoint? |
593 |
| - |
594 |
| -NSG flow logs are compatible with service endpoints without requiring any extra configuration. For more information, see [Enable a service endpoint](../virtual-network/tutorial-restrict-network-access-to-resources.md#enable-a-service-endpoint). |
595 |
| - |
596 |
| -### What's the difference between versions 1 and 2 of flow logs? |
597 |
| - |
598 |
| -Version 2 of flow logs introduces the concept of *flow state* and stores information about transmitted bytes and packets. [Read more](#log-format). |
599 |
| - |
600 | 562 | ## Pricing
|
601 | 563 |
|
602 | 564 | NSG flow logs are charged per gigabyte of logs collected and come with a free tier of 5 GB/month per subscription. For more information, see [Network Watcher pricing](https://azure.microsoft.com/pricing/details/network-watcher/).
|
603 | 565 |
|
604 | 566 | Storage of logs is charged separately. For relevant prices, see [Azure Blob Storage pricing](https://azure.microsoft.com/pricing/details/storage/blobs/).
|
605 | 567 |
|
606 |
| -## Next steps |
| 568 | +## Related content |
607 | 569 |
|
608 | 570 | - To learn how to manage NSG flow logs, see [Create, change, disable, or delete NSG flow logs using the Azure portal](nsg-flow-logging.md).
|
| 571 | +- To find answers to some of the most frequently asked questions about NSG flow logs, see [NSG flow logs FAQ](frequently-asked-questions.yml#nsg-flow-logs). |
609 | 572 | - To learn about traffic analytics, see [Traffic analytics overview](traffic-analytics.md).
|
610 |
| -- To learn how to read flow logs, see [Read NSG flow logs](network-watcher-read-nsg-flow-logs.md). |
611 |
| - |
612 |
| - |
0 commit comments