Configure VPC Flow Logs

Console

1. In the Google Cloud console, go to the VPC networks page.

   Go to VPC networks

2. On the Subnets in current project tab, select one or more subnets and then click menuManage flow logs.

3. In menuManage flow logs, click Add new configuration.

4. Do one of the following:

   • If you selected one subnet, in the Configurations — Subnets section, click Add a configuration.
   • If you selected multiple subnets, in the Configure VPC Flow Logs section, select Network Management API.

5. For Name, enter a name for the new VPC Flow Logs configuration.

6. Optional: Adjust the Aggregation interval and any of the settings in the Advanced settings section:

   • Whether to configure log filtering. By default, Keep only logs that match a filter is deselected.
   • Whether to include metadata in the final log entries. By default, Metadata annotations includes all fields.
   • The Secondary sampling rate. 100% means that all entries generated by the primary flow log sampling process are kept. The primary flow log sampling rate isn't configurable. For more information, see Log sampling and processing.

7. Click Save.

gcloud

To enable VPC Flow Logs for a subnet, use the gcloud network-management vpc-flow-logs-configs create command.

You enable VPC Flow Logs by creating a VPC Flow Logs configuration. You can create the configuration with all of its parameters set to their default values, or you can customize the default values.

In the gcloud CLI, set your project to the Google Cloud project ID of the subnet and run one of the following commands:

• To create a default VPC Flow Logs configuration, run the following command:

  gcloud network-management vpc-flow-logs-configs create CONFIG_NAME \
      --location=global \
      --subnet=SUBNET
  

• To create a custom VPC Flow Logs configuration, specify each parameter that you want to customize.

  For example, to customize the aggregation interval, filtering, secondary sampling rate, and metadata parameters when creating a VPC Flow Logs configuration, run the following command:

  gcloud network-management vpc-flow-logs-configs create CONFIG_NAME \
      --location=global \
      --subnet=SUBNET \
      --aggregation-interval=AGGREGATION_INTERVAL \
      --filter-expr=FILTER_EXPRESSION \
      --flow-sampling=SAMPLING_RATE \
      --metadata=LOGGING_METADATA
  

  Replace the following:

  • CONFIG_NAME: a name for the configuration.
  • SUBNET: the subnet that you want to log. Must be specified in the following format: "projects/PROJECT_ID/regions/REGION/subnetworks/NAME", where:
    • PROJECT_ID is the ID of the Google Cloud project that contains the subnet. The configuration must be created in this project.
    • REGION is the region of the subnet.
    • NAME is the name of the subnet.

  To set the optional parameters in a custom configuration, replace the following:

  • AGGREGATION_INTERVAL: the aggregation interval for flow logs generated by this configuration. This parameter can be set to interval-5-sec(default), interval-30-sec, interval-1-min, interval-5-min,interval-10-min, or interval-15-min.
  • FILTER_EXPRESSION: an expression that defines which logs you want to keep. The expression has a limit of 2,048 characters. For more information, see Log filtering and Examples of log filters.
  • SAMPLING_RATE: the secondary flow sampling rate. This parameter can be set from greater than 0.0 to 1.0 (all logs, default). For more information, see Log sampling and processing.
  • LOGGING_METADATA: the metadata annotations that you want to include in the logs:
    • Use include-all-metadata to include all metadata annotations (default).
    • Use exclude-all-metadata to exclude all metadata annotations.
    • Use custom-metadata to include a custom list of metadata fields. To specify the metadata fields, use the --metadata-fields flag:
      • --metadata-fields=METADATA_FIELDS: replace METADATA_FIELDS with a comma-separated list of metadata fields that you want to include in the logs. For example, src_instance,dst_instance. Can be set only if metadata is set to custom-metadata.

API

To enable VPC Flow Logs for a subnet, use the projects.locations.vpcFlowLogsConfigs.create method.

You enable VPC Flow Logs by creating a VPC Flow Logs configuration. You can create the configuration with all of its parameters set to their default values, or you can customize the default values.

To create a default VPC Flow Logs configuration, include the following parameters in your API request:

POST https://networkmanagement.googleapis.com/v1/projects/PROJECT_ID/locations/global/vpcFlowLogsConfigs?vpc_flow_logs_config_id=CONFIG_NAME
{
  "subnet": "SUBNET"
}

To create a custom VPC Flow Logs configuration, specify each parameter that you want to customize.

For example, to customize the aggregation interval, filtering, secondary sampling rate, and metadata parameters when creating a VPC Flow Logs configuration, include the following parameters in your API request:

POST https://networkmanagement.googleapis.com/v1/projects/PROJECT_ID/locations/global/vpcFlowLogsConfigs?vpc_flow_logs_config_id=CONFIG_NAME
{
  "subnet": "SUBNET",
  "aggregationInterval": "AGGREGATION_INTERVAL",
  "filterExpr": "FILTER_EXPRESSION",
  "flowSampling": SAMPLING_RATE,
  "metadata": "LOGGING_METADATA"
}

Replace the following:

• PROJECT_ID: the Google Cloud project ID of the subnet.
• CONFIG_NAME: a name for the configuration.
• SUBNET: the subnet that you want to log. Must be specified in the following format: projects/PROJECT_ID/regions/REGION/subnetworks/NAME, where:
  • PROJECT_ID is the project ID of the subnet.
  • REGION is the region of the subnet.
  • NAME is the name of the subnet.

• AGGREGATION_INTERVAL: the aggregation interval for flow logs generated by this configuration. This parameter can be set to INTERVAL_5_SEC (default), INTERVAL_30_SEC, INTERVAL_1_MIN, INTERVAL_5_MIN, INTERVAL_10_MIN, or INTERVAL_15_MIN.
• FILTER_EXPRESSION: an expression that defines which logs you want to keep. The expression has a limit of 2,048 characters. For more information, see Log filtering.
• SAMPLING_RATE: the secondary flow sampling rate. This parameter can be set from greater than 0.0 to 1.0 (all logs, default). For more information, see Log sampling and processing.
• LOGGING_METADATA: the metadata annotations that you want to include in the logs:
  • Use INCLUDE_ALL_METADATA to include all metadata annotations (default).
  • Use EXCLUDE_ALL_METADATA to exclude all metadata annotations.
  • Use CUSTOM_METADATA to include a custom list of metadata fields. To specify the metadata fields, use the metadataFields parameter:
    • metadataFields: METADATA_FIELDS: replace METADATA_FIELDS with a comma-separated list of metadata fields that you want to include in the logs. For example, src_instance,dst_instance. Can be set only if metadata is set to CUSTOM_METADATA.

Console

1. In the Google Cloud console, go to the VPC networks page.

   Go to VPC networks

2. Click the network where you want to add a subnet.

3. Click Add subnet.

4. For Flow logs, select On.

5. Optional: Adjust the Aggregation interval and any of the following settings in the Advanced settings section:

   • Whether to configure log filtering. By default, Keep only logs that match a filter is deselected.
   • Whether to include metadata in the final log entries. By default, Metadata annotations includes all fields.
   • The Secondary sampling rate. 50% means that half of entries generated by the primary flow log sampling process are kept. The primary flow log sampling rate isn't configurable. For more information, see Log sampling and processing.

6. Populate other fields as appropriate.

7. Click Add.

gcloud

Run the following command:

gcloud compute networks subnets create SUBNET_NAME \
    --enable-flow-logs \
    [--logging-aggregation-interval=AGGREGATION_INTERVAL] \
    [--logging-flow-sampling=SAMPLING_RATE] \
    [--logging-filter-expr=FILTER_EXPRESSION] \
    [--logging-metadata=LOGGING_METADATA] \
    [--logging-metadata-fields=METADATA_FIELDS] \
    [other flags as needed]

Replace the following:

• AGGREGATION_INTERVAL: the aggregation interval for flow logs in that subnet. The interval can be set to any of the following: 5-sec (default), 30-sec, 1-min, 5-min, 10-min, or 15-min.
• SAMPLING_RATE: the secondary flow sampling rate. Secondary flow sampling can be set from 0.0 (no sampling) to 1.0 (all logs). Default is 0.5. For more information, see Log sampling and processing.
• FILTER_EXPRESSION: an expression that defines which logs you want to keep. The expression has a limit of 2,048 characters. For more information, see Log filtering and Examples of log filters.

• LOGGING_METADATA: the metadata annotations that you want to include in the logs:

  • Use include-all to include all metadata annotations.
  • Use exclude-all to exclude all metadata annotations (default).
  • Use custom to include a custom list of metadata fields that you specify in METADATA_FIELDS.

• METADATA_FIELDS: a comma-separated list of metadata fields you want to include in the logs. For example, src_instance,dst_instance. Can be set only if LOGGING_METADATA is set to custom.

API

Enable VPC Flow Logs when you create a new subnet.

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION/subnetworks
{
  "logConfig": {
    "aggregationInterval": "AGGREGATION_INTERVAL",
    "flowSampling": SAMPLING_RATE,
    "filterExpr": EXPRESSION,
    "metadata": METADATA_SETTING,
    "metadataFields": METADATA_FIELDS,
    "enable": true
  },
  "ipCidrRange": "IP_RANGE",
  "network": "NETWORK_URL",
  "name": "SUBNET_NAME"
}

Replace the following:

• PROJECT_ID: the ID of the project where the subnet will be created.
• REGION: the region where the subnet will be created.
• AGGREGATION_INTERVAL: the aggregation interval for flow logs in the subnet. The interval can be set to any of the following: INTERVAL_5_SEC, INTERVAL_30_SEC, INTERVAL_1_MIN, INTERVAL_5_MIN, INTERVAL_10_MIN, or INTERVAL_15_MIN.
• SAMPLING_RATE: the flow sampling rate. Flow sampling can be set from 0.0 (no sampling) to 1.0 (all logs). Default is .0.5.
• EXPRESSION: the filter expression you use to filter which logs are actually written. The expression has a limit of 2,048 characters. For details, see Log filtering.

• METADATA_SETTING: the metadata annotations that you want to include in the logs:

  • Use INCLUDE_ALL_METADATA to include all metadata annotations.
  • Use EXCLUDE_ALL_METADATA to exclude all metadata annotations (default).
  • Use CUSTOM_METADATA to include a custom list of metadata fields that you specify in METADATA_FIELDS.

• METADATA_FIELDS: the metadata fields you want to capture when you have set metadata: CUSTOM_METADATA. This is a comma-separated list of metadata fields, such as src_instance, src_vpc.project_id.

• IP_RANGE: the primary internal IP address range of the subnet.

• NETWORK_URL: the Virtual Private Cloud network URL where the subnet will be created.

• SUBNET_NAME: a name for the subnet.

For more information, see the subnetworks.insert method.

Terraform

You can use a Terraform module to create a custom mode VPC network and subnets.

The following example creates three subnets as follows:

• subnet-01 has VPC Flow Logs disabled. When you create a subnet, VPC Flow Logs are disabled unless you explicitly enable them.
• subnet-02 has VPC Flow Logs enabled with the default flow log settings.
• subnet-03 has VPC Flow Logs enabled with some custom settings.

module "test-vpc-module" {
  source       = "terraform-google-modules/network/google"
  version      = "~> 16.0"
  project_id   = var.project_id # Replace this with your project ID in quotes
  network_name = "my-custom-mode-network"
  mtu          = 1460

  subnets = [
    {
      subnet_name   = "subnet-01"
      subnet_ip     = "10.10.10.0/24"
      subnet_region = "us-west1"
    },
    {
      subnet_name           = "subnet-02"
      subnet_ip             = "10.10.20.0/24"
      subnet_region         = "us-west1"
      subnet_private_access = "true"
      subnet_flow_logs      = "true"
    },
    {
      subnet_name               = "subnet-03"
      subnet_ip                 = "10.10.30.0/24"
      subnet_region             = "us-west1"
      subnet_flow_logs          = "true"
      subnet_flow_logs_interval = "INTERVAL_10_MIN"
      subnet_flow_logs_sampling = 0.7
      subnet_flow_logs_metadata = "INCLUDE_ALL_METADATA"
      subnet_flow_logs_filter   = "false"
    }
  ]
}

To learn how to apply or remove a Terraform configuration, see Basic Terraform commands.

Console

1. In the Google Cloud console, go to the VPC networks page.

   Go to VPC networks

2. On the Subnets in current project tab, select one or more subnets and then click menuManage flow logs.

3. In menuManage flow logs, click Add new configuration.

4. Do one of the following:

   • If you selected one subnet, in the Configurations - Subnets (Compute Engine API) section, click Add a configuration.
   • If you selected multiple subnets, in the Configure VPC Flow Logs section, select Compute Engine API.

5. Optional: Adjust the Aggregation interval and any of the following settings in the Advanced settings section:

   • Whether to configure log filtering. By default, Keep only logs that match a filter is deselected.
   • Whether to include metadata in the final log entries. By default, Metadata annotations includes all fields.
   • The Secondary sampling rate. 50% means that half of entries generated by the primary flow log sampling process are kept. The primary flow log sampling rate isn't configurable. For more information, see Log sampling and processing.

6. Click Save.

gcloud

Run the following command:

gcloud compute networks subnets update SUBNET_NAME \
    --enable-flow-logs \
    [--logging-aggregation-interval=AGGREGATION_INTERVAL] \
    [--logging-flow-sampling=SAMPLING_RATE] \
    [--logging-filter-expr=FILTER_EXPRESSION] \
    [--logging-metadata=LOGGING_METADATA] \
    [--logging-metadata-fields=METADATA_FIELDS] \
    [other flags as needed]

Replace the following:

• AGGREGATION_INTERVAL: the aggregation interval for flow logs in that subnet. The interval can be set to any of the following: 5-sec (default), 30-sec, 1-min, 5-min, 10-min, or 15-min.
• SAMPLING_RATE: the secondary flow sampling rate. Secondary flow sampling can be set from 0.0 (no sampling) to 1.0 (all logs). Default is 0.5. For more information, see Log sampling and processing.
• FILTER_EXPRESSION: an expression that defines which logs you want to keep. The expression has a limit of 2,048 characters. For more information, see Log filtering and Examples of log filters.

• LOGGING_METADATA: the metadata annotations that you want to include in the logs:

  • Use include-all to include all metadata annotations.
  • Use exclude-all to exclude all metadata annotations (default).
  • Use custom to include a custom list of metadata fields that you specify in METADATA_FIELDS.

• METADATA_FIELDS: a comma-separated list of metadata fields you want to include in the logs. For example, src_instance,dst_instance. Can be set only if LOGGING_METADATA is set to custom.

API

Enable VPC Flow Logs for an existing subnet.

PATCH https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION/subnetworks/SUBNET_NAME
{
  "logConfig": {
    "enable": true
    ...other logging fields.
  },
  "fingerprint": "SUBNET_FINGERPRINT"
}

Replace the following:

• PROJECT_ID: the ID of the project where the subnet is located.
• REGION: the region where the subnet is located.
• SUBNET_NAME: the name of the existing subnet.
• SUBNET_FINGERPRINT: the fingerprint ID for the existing subnet, which is provided when you describe a subnet.