Access flow logs
This page describes how to access flow logs by using Cloud Logging.
Access flow logs in the Logs Explorer
You can view VPC Flow Logs by using the Logs Explorer. In the Logs Explorer, you can use resource filters and queries to view your flow logs.
Configure IAM
To configure access control for logging, see the access control guide for Logging.
Access flow logs by using resource filters
To view all flow logs or flow logs for a specific subnet, see the following sections. You can also view these logs by using Logs Explorer queries, as described in Access flow logs by using queries.
Access all flow logs
Console
In the Google Cloud console, go to the Logs Explorer page.
Click All resources.
In the Select resource list, click Subnetwork and then click Apply.
Click Log name.
In the Select log names list, click vpc_flows and then click Apply.
Access flow logs for a specific subnet
Console
In the Google Cloud console, go to the Logs Explorer page.
Click All resources.
In the Select resource list, click Subnetwork.
In the Subnetwork ID list, select the subnetwork and then click Apply.
In the Select log names list, click vpc_flows and then click Apply.
Access flow logs by using queries
Console
In the Google Cloud console, go to the Logs Explorer page.
If you don't see the query editor field in the Query pane, click the Show query toggle.
In the query editor field, enter a query. For example, to view flow logs for a specific subnet, enter the following query, replacing
PROJECT_ID
with your project ID andSUBNET_NAME
with your subnetwork:resource.type="gce_subnetwork" logName="projects/PROJECT_ID/logs/compute.googleapis.com%2Fvpc_flows" resource.labels.subnetwork_name="SUBNET_NAME"
For more examples of queries that you can run to view your flow logs, see Examples of Logs Explorer queries for VPC Flow Logs.
Click Run query.
Examples of Logs Explorer queries for VPC Flow Logs
The following table provides examples of Logs Explorer queries that you can run to view your flow logs.
Logs you want to view | Query |
---|---|
All logs | resource.type="gce_subnetwork" logName="projects/PROJECT_ID/logs/compute.googleapis.com%2Fvpc_flows" |
Logs for a specific subnet | resource.type="gce_subnetwork" logName="projects/PROJECT_ID/logs/compute.googleapis.com%2Fvpc_flows" resource.labels.subnetwork_name="SUBNET_NAME" |
Logs for a specific virtual machine (VM) instance | resource.type="gce_subnetwork" logName="projects/PROJECT_ID/logs/compute.googleapis.com%2Fvpc_flows" (jsonPayload.src_instance.vm_name="VM_NAME" OR jsonPayload.dest_instance.vm_name="VM_NAME") |
Logs for traffic to a specific subnetwork range | resource.type="gce_subnetwork" logName="projects/PROJECT_ID/logs/compute.googleapis.com%2Fvpc_flows" ip_in_net(jsonPayload.connection.dest_ip, SUBNET_RANGE) |
Logs for a specific Google Kubernetes Engine (GKE) cluster | resource.type="gce_subnetwork" logName="projects/PROJECT_ID/logs/compute.googleapis.com%2Fvpc_flows" (jsonPayload.src_gke_details.cluster.cluster_name="CLUSTER_NAME" OR jsonPayload.dest_gke_details.cluster.cluster_name="CLUSTER_NAME") |
Logs for only egress traffic from a subnetwork | logName="projects/PROJECT_ID/logs/compute.googleapis.com%2Fvpc_flows" AND jsonPayload.reporter="SRC" AND jsonPayload.src_vpc.subnetwork_name="SUBNET_NAME" AND (jsonPayload.dest_vpc.subnetwork_name!="SUBNET_NAME" OR NOT jsonPayload.dest_vpc.subnetwork_name:*) |
Logs for all egress traffic from a Virtual Private Cloud (VPC) network | logName="projects/PROJECT_ID/logs/compute.googleapis.com%2Fvpc_flows" AND jsonPayload.reporter="SRC" AND jsonPayload.src_vpc.vpc_name="VPC_NAME" AND (jsonPayload.dest_vpc.vpc_name!="VPC_NAME" OR NOT jsonPayload.dest_vpc:*) |
Logs for an individual destination port | resource.type="gce_subnetwork" logName="projects/PROJECT_ID/logs/compute.googleapis.com%2Fvpc_flows" jsonPayload.connection.dest_port=PORT jsonPayload.connection.protocol=PROTOCOL |
Logs for multiple destination ports | resource.type="gce_subnetwork" logName="projects/PROJECT_ID/logs/compute.googleapis.com%2Fvpc_flows" jsonPayload.connection.dest_port=(PORT1 OR PORT2) jsonPayload.connection.protocol=PROTOCOL |
Replace the following:
PROJECT_ID
: the project ID.SUBNET_NAME
: the name of your subnetwork.VM_NAME
: the name of your VM.SUBNET_RANGE
: a CIDR range, such as192.168.1.0/24
.CLUSTER_NAME
: the name of your GKE cluster.VPC_NAME
: the name of your VPC network.PORT1
andPORT2
: the destination ports.PROTOCOL
: the communication protocol.
Route logs to BigQuery, Pub/Sub, and custom targets
You can route flow logs from Logging to a destination of your choice as described in the Routing and storage overview in the Logging documentation. Refer to the previous section for example filters.
Troubleshooting
No vpc_flows
appear in Logging for the gce_subnetwork
resource
- Confirm that logging is enabled for the given subnet.
- VPC flows are only supported for VPC networks. If you have a legacy network, you don't see any logs.
- In Shared VPC networks, logs only appear in the host project, not the service projects. Make sure that you look for the logs in the host project.
- Logging exclusion filters block specified logs.
Make sure that there are no exclusion rules that discard VPC Flow Logs:
- Go to Log router.
- In the More actions menu for your logging bucket, click View sink details.
- Make sure that there are no exclusion rules that might discard VPC Flow Logs.
- Use the Google Cloud CLI or API to determine if a log
filtering configuration is
filtering all the traffic in a given subnet. For example, if
filterExpr
is set tofalse
, you don't see any logs.
No RTT or byte values on some of the logs
- RTT measurements may be missing if not enough packets were sampled to capture RTT. This is more likely to happen for low volume connections.
- RTT values are available only for TCP flows.
- Some packets are sent with no payload. If header-only packets were sampled, the bytes value will be 0.
Some flows are missing
- Ingress packets are sampled after ingress VPC firewall rules. Make sure that there aren't any ingress firewall rules that deny the packets that you expect to be logged. If you're not sure whether VPC firewall rules are blocking ingress packets, you can enable Firewall Rules Logging and inspect the logs.
- Only TCP, UDP, ICMP, ESP, and GRE protocols are supported. VPC Flow Logs does not support any other protocols.
- Logs are sampled. Some packets in very low volume flows might be missed.
Missing GKE annotations in some logs
Make sure that your GKE cluster is a supported version.
Missing logs for some GKE flows
Make sure Intranode visibility is enabled in the cluster. Otherwise, flows between Pods on the same node are not logged.
What's next
- View Logging documentation
- View Logging sinks documentation