다른 모든 VPC 흐름 로그 구성의 경우 networkmanagement.googleapis.com/vpc_flows 로그를 확인하세요. 이 로그는 가상 프라이빗 클라우드(VPC) 네트워크(프리뷰), 서브넷(프리뷰), Cloud Interconnect의 VLAN 연결, Cloud VPN 터널의 로그 항목을 수집합니다.
Compute Engine API를 사용하여 서브넷에 VPC 흐름 로그를 사용 설정한 경우 흐름 로그를 보려면 쿼리가 compute.googleapis.com을 타겟팅해야 합니다. 예를 들어 다음 쿼리를 입력하면서 PROJECT_ID는 Google Cloud 프로젝트 ID로 바꾸고 SUBNET_NAME은 해당 서브넷으로 바꿉니다.
다음 표에서는 Google Cloud 프로젝트에서 흐름 로그를 보기 위해 실행할 수 있는 로그 탐색기 쿼리 예시를 보여줍니다.
networkmanagement.googleapis.com/vpc_flows 쿼리 섹션의 예에서는 각 리소스가 단일 VPC 흐름 로그 구성에 의해 로깅된다고 가정합니다. 리소스당 여러 VPC 흐름 로그 구성을 사용하는 경우 쿼리할 구성을 지정하여 쿼리 결과에서 중복 로그를 제외합니다. 쿼리에서 여러 구성을 지정할 수도 있습니다.
확인할 로그
쿼리
모든 흐름 로그
resource.type=("gce_subnetwork" OR "vpc_flow_logs_config")
logName=("projects/PROJECT_ID/logs/compute.googleapis.com%2Fvpc_flows" OR
"projects/PROJECT_ID/logs/networkmanagement.googleapis.com%2Fvpc_flows")
resource.type="gce_subnetwork"
logName="projects/PROJECT_ID/logs/compute.googleapis.com%2Fvpc_flows"
(jsonPayload.src_instance.vm_name="VM_NAME" OR
jsonPayload.dest_instance.vm_name="VM_NAME")
resource.type="gce_subnetwork"
logName="projects/PROJECT_ID/logs/compute.googleapis.com%2Fvpc_flows"
(jsonPayload.src_gke_details.cluster.cluster_name="CLUSTER_NAME" OR
jsonPayload.dest_gke_details.cluster.cluster_name="CLUSTER_NAME")
서브넷의 이그레스 전용 트래픽의 로그
resource.type="gce_subnetwork"
logName="projects/PROJECT_ID/logs/compute.googleapis.com%2Fvpc_flows" AND
jsonPayload.reporter="SRC" AND
jsonPayload.src_vpc.subnetwork_name="SUBNET_NAME" AND
(jsonPayload.dest_vpc.subnetwork_name!="SUBNET_NAME"
OR NOT jsonPayload.dest_vpc.subnetwork_name:*)
Virtual Private Cloud(VPC) 네트워크의 모든 이그레스 트래픽에 대한 로그
resource.type="gce_subnetwork"
logName="projects/PROJECT_ID/logs/compute.googleapis.com%2Fvpc_flows" AND
jsonPayload.reporter="SRC" AND
jsonPayload.src_vpc.vpc_name="VPC_NAME" AND
(jsonPayload.dest_vpc.vpc_name!="VPC_NAME" OR NOT jsonPayload.dest_vpc:*)
Logging 버킷의 more_vert추가 작업 메뉴에서 싱크 세부정보 보기를 클릭합니다.
VPC 흐름 로그를 삭제할 수 있는 제외 규칙이 없는지 확인합니다.
Google Cloud CLI 또는 API를 사용하여 로그 필터링 구성이 지정된 서브넷의 모든 트래픽을 필터링하는지 확인합니다. 예를 들어 filterExpr이 false로 설정된 경우 로그가 표시되지 않습니다.
일부 로그에 RTT 또는 바이트 값이 없음
샘플링된 패킷이 RTT를 캡처하기에 부족한 경우 RTT 측정이 누락될 수 있습니다. 이 현상은 소량 연결에서 발생할 가능성이 높습니다.
RTT 값은 VM에서 보고된 TCP 흐름에서만 사용할 수 있습니다.
일부 패킷은 페이로드 없이 전송됩니다. 헤더만 있는 패킷이 샘플링된 경우 바이트 값은 0이 됩니다.
일부 흐름이 누락됨
인그레스 패킷은 인그레스 VPC 방화벽 규칙 이후에 샘플링됩니다. 로깅할 것으로 예상하는 패킷을 거부하는 인그레스 방화벽 규칙이 없는지 확인합니다. VPC 방화벽 규칙이 인그레스 패킷을 차단하는지 확실하지 않으면 방화벽 규칙 로깅을 사용 설정하여 로그를 검사할 수 있습니다.
TCP, UDP, ICMP, ESP GRE 프로토콜만 지원됩니다. VPC 흐름 로그는 다른 프로토콜을 지원하지 않습니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-05(UTC)"],[],[],null,["# Access flow logs\n================\n\nThis page describes how to access flow logs by using Cloud Logging.\n\nAccess flow logs in the Logs Explorer\n-------------------------------------\n\nVPC Flow Logs writes logs to the Google Cloud project of the log\nreporter. You can view flow logs in the\n[Logs Explorer](/logging/docs/view/logs-explorer-interface).\nVPC Flow Logs uses the following logs to collect log entries:\n\n- The `compute.googleapis.com/vpc_flows` log collects log entries for subnets. View this log if you [enabled VPC Flow Logs by using the Compute Engine API](/vpc/docs/using-flow-logs#compute-engine).\n- For all other VPC Flow Logs configurations, view the `networkmanagement.googleapis.com/vpc_flows` log. This log collects log entries for Virtual Private Cloud (VPC) networks ([Preview](/products#product-launch-stages)), subnets ([Preview](/products#product-launch-stages)), VLAN attachments for Cloud Interconnect, and Cloud VPN tunnels.\n\n### Configure IAM\n\nTo configure access control for logging, see the\n[access control guide for Logging](/logging/docs/access-control#permissions_and_roles).\n\n### View flow logs by using resource filters\n\nTo view flow logs in a Google Cloud project by using resource filters, see the\nfollowing sections. You can also view these logs by using Logs Explorer\nqueries, as described in\n[Filter flow logs by using queries](#flow-logs-queries).\n\n#### View flow logs for all subnets (`compute.googleapis.com/vpc_flows`)\n\n1. In the Google Cloud console, go to the **Logs Explorer** page.\n\n [Go to Logs Explorer](https://console.cloud.google.com/logs/query)\n2. Click **All resources**.\n\n3. In the **Select resource** list, click **Subnetwork** and then click\n **Apply**.\n\n4. Click **All log names**.\n\n5. In the **Select log names** list, find **Compute Engine** , click\n **vpc_flows** , and then click **Apply**.\n\n#### View flow logs for a specific subnet (`compute.googleapis.com/vpc_flows`)\n\n1. In the Google Cloud console, go to the **Logs Explorer** page.\n\n [Go to Logs Explorer](https://console.cloud.google.com/logs/query)\n2. Click **All resources**.\n\n3. In the **Select resource** list, click **Subnetwork**.\n\n4. In the **Subnetwork ID** list, select the subnet and then click\n **Apply**.\n\n5. Click **All log names**.\n\n6. In the **Select log names** list, find **Compute Engine** , click\n **vpc_flows** , and then click **Apply**.\n\n#### View flow logs for all resources (`networkmanagement.googleapis.com/vpc_flows`)\n\n1. In the Google Cloud console, go to the **Logs Explorer** page.\n\n [Go to Logs Explorer](https://console.cloud.google.com/logs/query)\n2. Click **All resources**.\n\n3. In the **Select resource** list, click **VPC Flow Logs Config** and\n then click **Apply**.\n\n#### View flow logs for a specific configuration (`networkmanagement.googleapis.com/vpc_flows`)\n\n1. In the Google Cloud console, go to the **Logs Explorer** page.\n\n [Go to Logs Explorer](https://console.cloud.google.com/logs/query)\n2. Click **All resources**.\n\n3. In the **Select resource** list, click **VPC Flow Logs Config** and\n select the VPC Flow Logs configuration that you want to view.\n\n4. Click **Apply**.\n\n### Filter flow logs by using queries\n\n1. In the Google Cloud console, go to the **Logs Explorer** page.\n\n [Go to Logs Explorer](https://console.cloud.google.com/logs/query)\n2. If you don't see the query editor field in the **Query** pane, click the\n **Show query** toggle.\n\n3. In the query editor field, enter a query:\n\n - If you\n [enabled](/vpc/docs/using-flow-logs#compute-engine)\n VPC Flow Logs for a subnet by using the Compute Engine API,\n to view flow logs, the query must target\n `compute.googleapis.com`. For example, enter the following query, replacing\n \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e with your Google Cloud project ID and\n \u003cvar translate=\"no\"\u003eSUBNET_NAME\u003c/var\u003e with your subnet:\n\n ```\n resource.type=\"gce_subnetwork\"\n logName=\"projects/PROJECT_ID/logs/compute.googleapis.com%2Fvpc_flows\"\n resource.labels.subnetwork_name=\"SUBNET_NAME\"\n ```\n - For all other queries, the query must target\n `networkmanagement.googleapis.com`. For example,\n to view flow logs for a specific source Cloud VPN tunnel,\n enter the following query:\n\n ```\n resource.type=\"vpc_flow_logs_config\"\n logName=\"projects/PROJECT_ID/logs/networkmanagement.googleapis.com%2Fvpc_flows\"\n jsonPayload.reporter=\"src_gateway\"\n labels.target_resource_name=\"projects/PROJECT_ID/regions/REGION/vpnTunnels/NAME\"\n ```\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: the Google Cloud project ID\n - \u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e: the region of the Cloud VPN tunnel\n - \u003cvar translate=\"no\"\u003eNAME\u003c/var\u003e: the name of the Cloud VPN tunnel\n\n For more examples of queries that you can run to view your flow logs, see\n [Examples of Logs Explorer queries for VPC Flow Logs](#example-queries).\n4. Click **Run query**.\n\n#### Examples of Logs Explorer queries for VPC Flow Logs\n\nThe following table provides examples of Logs Explorer queries that you can\nrun to view your flow logs in a Google Cloud project.\n\nThe examples in the\n*Queries for the networkmanagement.googleapis.com/vpc_flows* section\nassume that each resource is logged by a single\nVPC Flow Logs configuration. If you use multiple\nVPC Flow Logs configurations per resource, specify the\nconfiguration that you want to query to exclude duplicate logs\nfrom the query results. You can also specify multiple configurations\nin a query.\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: the project ID\n- \u003cvar translate=\"no\"\u003eSUBNET_NAME\u003c/var\u003e: the name of the subnet\n- \u003cvar translate=\"no\"\u003eVM_NAME\u003c/var\u003e: the name of the VM\n- \u003cvar translate=\"no\"\u003eSUBNET_RANGE\u003c/var\u003e: a CIDR range, such as `192.168.1.0/24`\n- \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e: the name of the GKE cluster\n- \u003cvar translate=\"no\"\u003eVPC_NAME\u003c/var\u003e: the name of the VPC network\n- \u003cvar translate=\"no\"\u003ePORT1\u003c/var\u003e and \u003cvar translate=\"no\"\u003ePORT2\u003c/var\u003e: the destination ports\n- \u003cvar translate=\"no\"\u003ePROTOCOL\u003c/var\u003e: the communication protocol\n- \u003cvar translate=\"no\"\u003eCONFIG_NAME\u003c/var\u003e: the name of the VPC Flow Logs configuration\n- \u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e: the region of the VLAN attachment or Cloud VPN tunnel\n- \u003cvar translate=\"no\"\u003eNAME\u003c/var\u003e: the name of the Cloud VPN tunnel\n\nRoute logs to BigQuery, Pub/Sub, and custom targets\n---------------------------------------------------\n\nYou can route flow logs from Logging to a destination\nof your choice as described in the\n[Routing and storage overview](/logging/docs/routing/overview) in the Logging\ndocumentation.\nRefer to the previous section for example filters.\n\nTroubleshooting\n---------------\n\n### No `vpc_flows` appear in Logging for the `gce_subnetwork` resource\n\n- Confirm that logging is [enabled](/vpc/docs/using-flow-logs#enable-logging-existing) for the given subnet.\n- VPC flows are only supported for VPC networks. If you have a [legacy network](/vpc/docs/legacy), you don't see any logs.\n- In [Shared VPC](/vpc/docs/shared-vpc) networks, logs only appear in the host project, not the service projects. Make sure that you look for the logs in the host project.\n- Logging exclusion filters block specified logs. Make sure that there are no exclusion rules that discard VPC Flow Logs:\n 1. Go to [Log router](https://console.cloud.google.com/logs/router).\n 2. In the more_vert **More actions** menu for your logging bucket, click **View sink details**.\n 3. Make sure that there are no exclusion rules that might discard VPC Flow Logs.\n- Use the Google Cloud CLI or API to determine if a [log\n filtering](/vpc/docs/about-flow-logs-records#filtering) configuration is filtering all the traffic in a given subnet. For example, if `filterExpr` is set to `false`, you don't see any logs.\n\n### No RTT or byte values on some of the logs\n\n- RTT measurements may be missing if not enough packets were sampled to capture RTT. This is more likely to happen for low volume connections.\n- RTT values are available only for TCP flows reported from VMs.\n- Some packets are sent with no payload. If header-only packets were sampled, the bytes value will be 0.\n\n### Some flows are missing\n\n- Ingress packets are sampled after ingress [VPC firewall rules](/firewall/docs/firewalls). Make sure that there aren't any ingress firewall rules that deny the packets that you expect to be logged. If you're not sure whether VPC firewall rules are blocking ingress packets, you can enable [Firewall Rules Logging](/firewall/docs/firewall-rules-logging) and inspect the logs.\n- Only TCP, UDP, ICMP, ESP, and GRE protocols are supported. VPC Flow Logs does not support any other protocols.\n- Logs [are sampled](/vpc/docs/flow-logs#log-sampling). Some packets in very low volume flows might be missed.\n\n### Missing GKE annotations in some logs\n\nMake sure that your GKE cluster is a [supported version](/kubernetes-engine/docs/release-schedule).\n\n### Missing logs for some GKE flows\n\nMake sure [Intranode\nvisibility](/kubernetes-engine/docs/how-to/intranode-visibility) is enabled in\nthe cluster. Otherwise, flows between Pods on the same node are not logged.\n\nWhat's next\n-----------\n\n- View [Logging](/logging/docs) documentation\n- View [Logging sinks](/logging/docs/export/configure_export_v2) documentation\n- Analyze flow logs in [Flow Analyzer](/network-intelligence-center/docs/flow-analyzer/overview)"]]
