Configure VPC Flow Logs
This page describes how to configure VPC Flow Logs. It assumes you are familiar with the concepts described in VPC Flow Logs and About VPC Flow Logs records.
Before you begin
VPC Flow Logs lets you configure flow logs for Virtual Private Cloud (VPC) subnets, VLAN attachments for Cloud Interconnect (Preview), and Cloud VPN tunnels (Preview).
Before configuring VPC Flow Logs, complete the following tasks:
If you want to configure VPC Flow Logs for a subnet, do the following:
Enable the Compute Engine API in your Google Cloud project.
Make sure that you have one of the following roles on the project:
- Compute Admin role (
roles/compute.admin
) - Compute Network Admin role (
roles/compute.networkAdmin
)
- Compute Admin role (
If you want to configure VPC Flow Logs for a VLAN attachment or a Cloud VPN tunnel, do the following:
Enable the Network Management API in your Google Cloud project.
Make sure that you have the following role on the project: Network Management Admin role (
roles/networkmanagement.admin
)
Enable VPC Flow Logs
You enable VPC Flow Logs per subnet, VLAN attachment, or Cloud VPN tunnel. When you enable VPC Flow Logs for a subnet, you enable logging for all VMs in the subnet.
You can modify the amount of information written to logging. For details on the parameters you can control, see Log sampling and processing. To customize metadata fields, use the Google Cloud CLI or API.
Enable VPC Flow Logs for a subnet
You can enable VPC Flow Logs when you create a subnet or for an existing subnet.
Enable VPC Flow Logs when you create a subnet
Console
In the Google Cloud console, go to the VPC networks page.
Click the network where you want to add a subnet.
Click Add subnet.
For Flow logs, select On.
Optional: Adjust the Aggregation interval and any of the following settings in the Advanced settings section:
- Whether to configure log filtering. By default, Keep only logs that match a filter is deselected.
- Whether to include metadata in the final log entries. By default, Metadata annotations includes all fields.
- The Secondary sampling rate.
50%
means that half of entries generated by the primary flow log sampling process are kept. The primary flow log sampling rate isn't configurable. For more information, see Log sampling and processing.
Populate other fields as appropriate.
Click Add.
gcloud
-
In the Google Cloud console, activate Cloud Shell.
At the bottom of the Google Cloud console, a Cloud Shell session starts and displays a command-line prompt. Cloud Shell is a shell environment with the Google Cloud CLI already installed and with values already set for your current project. It can take a few seconds for the session to initialize.
Run the following command:
gcloud compute networks subnets create SUBNET_NAME \ --enable-flow-logs \ [--logging-aggregation-interval=AGGREGATION_INTERVAL] \ [--logging-flow-sampling=SAMPLE_RATE] \ [--logging-filter-expr=FILTER_EXPRESSION] \ [--logging-metadata=LOGGING_METADATA] \ [--logging-metadata-fields=METADATA_FIELDS] \ [other flags as needed]
Replace the following:
AGGREGATION_INTERVAL
: the aggregation interval for flow logs in that subnet. The interval can be set to any of the following: 5-sec (default), 30-sec, 1-min, 5-min, 10-min, or 15-min.SAMPLE_RATE
: the secondary flow sampling rate. Secondary flow sampling can be set from0.0
(no sampling) to1.0
(all logs). Default is0.5
. For more information, see Log sampling and processing.FILTER_EXPRESSION
: an expression that defines which logs you want to keep. The expression has a limit of 2,048 characters. For details, see Log filtering.LOGGING_METADATA
: the metadata annotations that you want to include in the logs:- Use
include-all
to include all metadata annotations. - Use
exclude-all
to exclude all metadata annotations (default). - Use
custom
to include a custom list of metadata fields that you specify inMETADATA_FIELDS
.
- Use
METADATA_FIELDS
: a comma-separated list of metadata fields you want to include in the logs. For example,src_instance,dst_instance
. Can be set only ifLOGGING_METADATA
is set tocustom
.
API
Enable VPC Flow Logs when you create a new subnet.
POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION/subnetworks { "logConfig": { "aggregationInterval": "AGGREGATION_INTERVAL", "flowSampling": SAMPLING_RATE, "filterExpr": EXPRESSION, "metadata": METADATA_SETTING, "metadataFields": METADATA_FIELDS, "enable": true }, "ipCidrRange": "IP_RANGE", "network": "NETWORK_URL", "name": "SUBNET_NAME" }
Replace the following:
PROJECT_ID
: the ID of the project where the subnet will be created.REGION
: the region where the subnet will be created.AGGREGATION_INTERVAL
: the aggregation interval for flow logs in the subnet. The interval can be set to any of the following:INTERVAL_5_SEC
,INTERVAL_30_SEC
,INTERVAL_1_MIN
,INTERVAL_5_MIN
,INTERVAL_10_MIN
, orINTERVAL_15_MIN
.SAMPLING_RATE
: the flow sampling rate. Flow sampling can be set from0.0
(no sampling) to1.0
(all logs). Default is.0.5
.EXPRESSION
: the filter expression you use to filter which logs are actually written. The expression has a limit of 2,048 characters. For details, see Log filtering.METADATA_SETTING
: the metadata annotations that you want to include in the logs:- Use
INCLUDE_ALL_METADATA
to include all metadata annotations. - Use
EXCLUDE_ALL_METADATA
to exclude all metadata annotations (default). - Use
custom
to include a custom list of metadata fields that you specify inMETADATA_FIELDS
.
- Use
METADATA_FIELDS
: the metadata fields you want to capture when you have setmetadata: CUSTOM_METADATA
. This is a comma-separated list of metadata fields, such assrc_instance, src_vpc.project_id
.IP_RANGE
: the primary internal IP address range of the subnet.NETWORK_URL
: the Virtual Private Cloud network URL where the subnet will be created.SUBNET_NAME
: a name for the subnet.
For more information, refer to the
subnetworks.insert
method.
Terraform
You can use a Terraform module to create a custom mode VPC network and subnets.
The following example creates three subnets as follows:
subnet-01
has VPC Flow Logs disabled. When you create a subnet, VPC Flow Logs are disabled unless you explicitly enable them.subnet-02
has VPC Flow Logs enabled with the default flow log settings.subnet-03
has VPC Flow Logs enabled with some custom settings.
To learn how to apply or remove a Terraform configuration, see Basic Terraform commands.
Enable VPC Flow Logs for an existing subnet
Console
In the Google Cloud console, go to the VPC networks page.
Click the subnet that you want to update.
Click Edit.
For Flow logs, select On.
Optional: Adjust the Aggregation interval and any of the following settings in the Advanced settings section:
- Whether to configure log filtering. By default, Keep only logs that match a filter is deselected.
- Whether to include metadata in the final log entries. By default, Metadata annotations includes all fields.
- The Secondary sampling rate.
50%
means that half of entries generated by the primary flow log sampling process are kept. The primary flow log sampling rate isn't configurable. For more information, see Log sampling and processing.
Click Save.
gcloud
-
In the Google Cloud console, activate Cloud Shell.
At the bottom of the Google Cloud console, a Cloud Shell session starts and displays a command-line prompt. Cloud Shell is a shell environment with the Google Cloud CLI already installed and with values already set for your current project. It can take a few seconds for the session to initialize.
Run the following command:
gcloud compute networks subnets update SUBNET_NAME \ --enable-flow-logs \ [--logging-aggregation-interval=AGGREGATION_INTERVAL] \ [--logging-flow-sampling=SAMPLE_RATE] \ [--logging-filter-expr=FILTER_EXPRESSION] \ [--logging-metadata=LOGGING_METADATA] \ [--logging-metadata-fields=METADATA_FIELDS] \ [other flags as needed]
Replace the following:
AGGREGATION_INTERVAL
: the aggregation interval for flow logs in that subnet. The interval can be set to any of the following: 5-sec (default), 30-sec, 1-min, 5-min, 10-min, or 15-min.SAMPLE_RATE
: the secondary flow sampling rate. Secondary flow sampling can be set from0.0
(no sampling) to1.0
(all logs). Default is0.5
. For more information, see Log sampling and processing.FILTER_EXPRESSION
: an expression that defines which logs you want to keep. The expression has a limit of 2,048 characters. For details, see Log filtering.LOGGING_METADATA
: the metadata annotations that you want to include in the logs:- Use
include-all
to include all metadata annotations. - Use
exclude-all
to exclude all metadata annotations (default). - Use
custom
to include a custom list of metadata fields that you specify inMETADATA_FIELDS
.
- Use
METADATA_FIELDS
: a comma-separated list of metadata fields you want to include in the logs. For example,src_instance,dst_instance
. Can be set only ifLOGGING_METADATA
is set tocustom
.
API
Enable VPC Flow Logs for an existing subnet.
PATCH https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION/subnetworks/SUBNET_NAME { "logConfig": { "enable": true ...other logging fields. }, "fingerprint": "SUBNETWORK_FINGERPRINT" }
Replace the following:
PROJECT_ID
: the ID of the project where the subnet is located.REGION
: the region where the subnet is located.SUBNET_NAME
: the name of the existing subnet.SUBNET_FINGERPRINT
: the fingerprint ID for the existing subnet, which is provided when you describe a subnet.- For the other logging fields, see Enabling VPC Flow Logging when you create a subnet.
For more information, refer to the
subnetworks.patch
method.
Enable VPC Flow Logs for a VLAN attachment
Console
In the Google Cloud console, go to the Interconnect page.
In the VLAN attachments tab, select one or more VLAN attachments and then click
Manage flow logs in the selection bar at the top of the list.In
Manage flow logs, click Add new configuration.Enter a Name for the new VPC Flow Logs configuration.
Optional: Adjust the Aggregation interval and any of the settings in the Advanced settings section:
- Whether to configure log filtering. By default, Keep only logs that match a filter is deselected.
- Whether to include metadata in the final log entries. By default, Metadata annotations includes all fields.
- The Secondary sampling rate.
100%
means that all entries generated by the primary flow log sampling process are kept. The primary flow log sampling rate isn't configurable. For more information, see Log sampling and processing.
Click Save.
API
To create a VPC Flow Logs configuration for a VLAN attachment,
use the projects.locations.vpcFlowLogsConfigs.create
method.
POST https://networkmanagement.googleapis.com/v1beta1/projects/PROJECT_ID/locations/global/vpcFlowLogsConfigs { "name": "CONFIG_NAME" "interconnectAttachment": "VLAN_ATTACHMENT" "description": "DESCRIPTION" "state": "STATE" "aggregationInterval": "AGGREGATION_INTERVAL", "flowSampling": "SAMPLE_RATE", "filterExpr": "FILTER_EXPRESSION", "metadata": "LOGGING_METADATA", "metadataFields": "METADATA_FIELDS" }
Replace the following:
-
PROJECT_ID
: the ID of the Google Cloud project where you want to create the VPC Flow Logs configuration. Must be in the same project as the VLAN attachment. -
CONFIG_NAME
: a name for the VPC Flow Logs configuration. -
VLAN_ATTACHMENT
: the VLAN attachment that you want to log, in the formatprojects/PROJECT_ID/regions/REGION/interconnectAttachments/NAME
:PROJECT_ID
: the ID of the Google Cloud project the VLAN attachment belongs to.REGION
: the region of the VLAN attachment.NAME
: the name of the VLAN attachment.
-
DESCRIPTION
: optional description of the VPC Flow Logs configuration. -
STATE
: the state of the VPC Flow Logs configuration. This parameter must be set toENABLED
. If you want to pause flow logs collection, you can change the state toDISABLED
after creating the configuration as described in Update configuration parameters for VLAN attachments and Cloud VPN tunnels. -
AGGREGATION_INTERVAL
: the aggregation interval for flow logs generated by this configuration. The interval can be set to any of the following:INTERVAL_5_SEC
(default),INTERVAL_30_SEC
,INTERVAL_1_MIN
,INTERVAL_5_MIN
,INTERVAL_10_MIN
, orINTERVAL_15_MIN
. -
SAMPLE_RATE
: the secondary flow sampling rate. Secondary flow sampling can be set from greater than0.0
to1.0
(all logs). Default is1.0
. For more information, see Log sampling and processing. -
FILTER_EXPRESSION
: an expression that defines which logs you want to keep. The expression has a limit of 2,048 characters. For details, see Log filtering. -
LOGGING_METADATA
: the metadata annotations that you want to include in the logs:- Use
include-all
to include all metadata annotations (default). - Use
exclude-all
to exclude all metadata annotations. - Use
custom
to include a custom list of metadata fields that you specify inMETADATA_FIELDS
.
- Use
-
METADATA_FIELDS
: a comma-separated list of metadata fields you want to include in the logs. For example,src_instance,dst_instance
. Can be set only ifLOGGING_METADATA
is set tocustom
.
You can add more than one VPC Flow Logs configuration for a single VLAN attachment. Each VPC Flow Logs configuration generates a separate set of flow logs.
Enable VPC Flow Logs for a Cloud VPN tunnel
Console
In the Google Cloud console, go to the VPN page.
In the Cloud VPN tunnels tab, select one or more Cloud VPN tunnels and then click
Manage flow logs in the selection bar at the top of the list.In
Manage flow logs, click Add new configuration.Enter a Name for the new VPC Flow Logs configuration.
Optional: Adjust the Aggregation interval and any of the settings in the Advanced settings section:
- Whether to configure log filtering. By default, Keep only logs that match a filter is deselected.
- Whether to include metadata in the final log entries. By default, Metadata annotations includes all fields.
- The Secondary sampling rate.
100%
means that all entries generated by the primary flow log sampling process are kept. The primary flow log sampling rate isn't configurable. For more information, see Log sampling and processing.
Click Save.
API
To create a VPC Flow Logs configuration for a
Cloud VPN tunnel, use the
projects.locations.vpcFlowLogsConfigs.create
method.
POST https://networkmanagement.googleapis.com/v1beta1/projects/PROJECT_ID/locations/global/vpcFlowLogsConfigs { "name": "CONFIG_NAME" "vpnTunnel": "VPN_TUNNEL" "description": "DESCRIPTION" "state": "STATE" "aggregationInterval": "AGGREGATION_INTERVAL", "flowSampling": "SAMPLE_RATE", "filterExpr": "FILTER_EXPRESSION", "metadata": "LOGGING_METADATA", "metadataFields": "METADATA_FIELDS" }
Replace the following:
-
PROJECT_ID
: the ID of the Google Cloud project where you want to create the VPC Flow Logs configuration. Must be in the same project as the Cloud VPN tunnel. -
CONFIG_NAME
: a name for the VPC Flow Logs configuration. -
VPN_TUNNEL
: the Cloud VPN tunnel that you want to log, in the formatprojects/PROJECT_ID/regions/REGION/vpnTunnels/NAME
:PROJECT_ID
: the ID of the Google Cloud project project the Cloud VPN tunnel belongs to.REGION
: the region of the Cloud VPN tunnel.NAME
: the name of the Cloud VPN tunnel.
-
DESCRIPTION
: optional description of the VPC Flow Logs configuration. -
STATE
: the state of the VPC Flow Logs configuration. This parameter must be set toENABLED
. If you want to pause flow logs collection, you can change the state toDISABLED
after creating the configuration as described in Update configuration parameters for VLAN attachments and Cloud VPN tunnels. -
AGGREGATION_INTERVAL
: the aggregation interval for flow logs generated by this configuration. The interval can be set to any of the following:INTERVAL_5_SEC
(default),INTERVAL_30_SEC
,INTERVAL_1_MIN
,INTERVAL_5_MIN
,INTERVAL_10_MIN
, orINTERVAL_15_MIN
. -
SAMPLE_RATE
: the secondary flow sampling rate. Secondary flow sampling can be set from greater than0.0
to1.0
(all logs). Default is1.0
. For more information, see Log sampling and processing. -
FILTER_EXPRESSION
: an expression that defines which logs you want to keep. The expression has a limit of 2,048 characters. For details, see Log filtering. -
LOGGING_METADATA
: the metadata annotations that you want to include in the logs:- Use
include-all
to include all metadata annotations (default). - Use
exclude-all
to exclude all metadata annotations. - Use
custom
to include a custom list of metadata fields that you specify inMETADATA_FIELDS
.
- Use
-
METADATA_FIELDS
: a comma-separated list of metadata fields you want to include in the logs. For example,src_instance,dst_instance
. Can be set only ifLOGGING_METADATA
is set tocustom
.
You can add more than one VPC Flow Logs configuration for a single Cloud VPN tunnel. Each VPC Flow Logs configuration generates a separate set of flow logs.
View VPC Flow Logs configuration status
You can view the following:
- Which subnets have VPC Flow Logs enabled
- Which VLAN attachments and Cloud VPN tunnels have VPC Flow Logs enabled (Preview)
View which subnets in a network have VPC Flow Logs enabled
You can check which subnets in a VPC network have VPC Flow Logs enabled. To view all subnets in a Google Cloud project that have VPC Flow Logs enabled, see View VPC Flow Logs configurations.
Console
In the Google Cloud console, go to the VPC networks page.
Click the VPC network where you want to view the subnets.
Click the Subnets tab and view the Flow logs column to see if logging is on or off.
gcloud
-
In the Google Cloud console, activate Cloud Shell.
At the bottom of the Google Cloud console, a Cloud Shell session starts and displays a command-line prompt. Cloud Shell is a shell environment with the Google Cloud CLI already installed and with values already set for your current project. It can take a few seconds for the session to initialize.
Run the following command:
gcloud compute networks subnets list \ --project PROJECT_ID \ --network="NETWORK" \ --format="csv(name,region,logConfig.enable)"
Replace the following:
PROJECT_ID
: the ID of the project you are querying.NETWORK
: the name of the network containing the subnets.
View which attachments and tunnels in a project have VPC Flow Logs enabled
You can check which VLAN attachments and Cloud VPN tunnels in a Google Cloud project have VPC Flow Logs enabled. To view all VPC Flow Logs configurations for VLAN attachments and Cloud VPN tunnels in a Google Cloud project, see View VPC Flow Logs configurations.
Console
In the Google Cloud console, do the following.
To view which VLAN attachments have VPC Flow Logs enabled:
Go to the Interconnect page.
Click the VLAN attachments tab and view the Flow logs column to see if logging is on or off.
To view which Cloud VPN tunnels have VPC Flow Logs enabled:
Go to the VPN page.
Click the Cloud VPN tunnels tab and view the Flow logs column to see if logging is on or off.
View VPC Flow Logs configurations
When you configure VPC Flow Logs for a subnet, VLAN attachment, or a Cloud VPN tunnel, Google Cloud creates a VPC Flow Logs configuration for your subnet, VLAN attachment, or VPN tunnel using the configuration values that you have set. A single VLAN attachment or Cloud VPN tunnel can have one or more VPC Flow Logs configurations. A subnet that has VPC Flow Logs enabled can have only one VPC Flow Logs configuration.
You can view which VLAN attachments and Cloud VPN tunnels have flow logs turned on or off by checking the status of their VPC Flow Logs configurations. If the status of a VPC Flow Logs configuration is on, it means that flow logs for the VLAN attachment or Cloud VPN tunnel that uses this configuration are turned on. VPC Flow Logs configurations for subnets can't be turned off, only deleted.
Console
In the Google Cloud console, go to the VPC Flow Logs page.
Click the Subnets, VLAN attachments, or VPN tunnels tab.
- Subnets lists subnets that have an active VPC Flow Logs configuration.
- VLAN attachments lists VLAN attachments for Cloud Interconnect that have active or paused VPC Flow Logs configurations.
- VPN tunnels lists Cloud VPN tunnels that have active or paused VPC Flow Logs configurations.
API
To view VPC Flow Logs configurations, use the projects.locations.vpcFlowLogsConfigs.list and projects.locations.vpcFlowLogsConfigs.get methods.
View all VPC Flow Logs configurations.
GET https://networkmanagement.googleapis.com/v1beta1/projects/PROJECT_ID/locations/global/vpcFlowLogsConfigs
View a single VPC Flow Logs configuration.
GET https://networkmanagement.googleapis.com/v1beta1/projects/PROJECT_ID/locations/global/vpcFlowLogsConfigs/CONFIG_NAME
Replace the following:
PROJECT_ID
: the ID of the Google Cloud project that contains the VPC Flow Logs configuration or configurations that you want to view.CONFIG_NAME
: the name of the VPC Flow Logs configuration.
Update VPC Flow Logs configuration
You can modify log sampling parameters. For information about the parameters that you can control, see Log sampling and processing. To customize metadata fields, use the gcloud CLI or API.
Update configuration parameters for subnets
Console
In the Google Cloud console, go to the VPC networks page.
Under Subnets in current project, click the subnet that you want to update.
Click Edit.
Optional: Adjust any of the following settings:
- The Aggregation interval. By default, the aggregation interval is set to 5 sec.
- Whether to configure log filtering. By default, Keep only logs that match a filter is deselected.
- Whether to include metadata in the final log entries. By default, Metadata annotations includes all fields.
- The Secondary sampling rate.
50%
means that half of entries generated by the primary flow log sampling process are kept. The primary flow log sampling rate isn't configurable. For more information, see Log sampling and processing.
Click Save.
Alternatively, you can update your VPC Flow Logs configuration parameters by using the VPC networks page.
Manage flow logs menu under Subnets in current project on thegcloud
-
In the Google Cloud console, activate Cloud Shell.
At the bottom of the Google Cloud console, a Cloud Shell session starts and displays a command-line prompt. Cloud Shell is a shell environment with the Google Cloud CLI already installed and with values already set for your current project. It can take a few seconds for the session to initialize.
Run the following command:
gcloud compute networks subnets update SUBNET_NAME \ [--logging-aggregation-interval=AGGREGATION_INTERVAL] \ [--logging-flow-sampling=SAMPLE_RATE] \ [--logging-filter-expr=FILTER_EXPRESSION] \ [--logging-metadata=LOGGING_METADATA] \ [--logging-metadata-fields=METADATA_FIELDS] \
Replace the following:
AGGREGATION_INTERVAL
: the aggregation interval for flow logs in that subnet. The interval can be set to any of the following: 5-sec (default), 30-sec, 1-min, 5-min, 10-min, or 15-min.SAMPLE_RATE
: the secondary flow sampling rate. Secondary flow sampling can be set from0.0
(no sampling) to1.0
(all logs). Default is0.5
. For more information, see Log sampling and processing.FILTER_EXPRESSION
: an expression that defines what logs you want to keep. The expression has a limit of 2,048 characters. For details, see Log filtering.LOGGING_METADATA
: the metadata annotations that you want to include in the logs:- Use
include-all
to include all metadata annotations. - Use
exclude-all
to exclude all metadata annotations (default). - Use
custom
to include a custom list of metadata fields that you specify inMETADATA_FIELDS
.
- Use
METADATA_FIELDS
: a comma-separated list of metadata fields you want to include in the logs. For example,src_instance,dst_instance
. Can be set only ifLOGGING_METADATA
is set tocustom
.
API
Modify the log sampling fields to update VPC Flow Logs behaviors.
PATCH https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION/subnetworks/SUBNET_NAME { "logConfig": { ...fields to modify }, "fingerprint": "SUBNETWORK_FINGERPRINT" }
Replace the following:
PROJECT_ID
: the ID of the project where the subnet is located.REGION
: the region where the subnet is located.SUBNET_NAME
: the name of the existing subnet.SUBNET_FINGERPRINT
: the fingerprint ID for the existing subnet, which is provided when you describe a subnet.- For the fields that you can modify, see Enabling VPC Flow Logging when you create a subnet.
For more information, refer to the
subnetworks.patch
method.
Update configuration parameters for VLAN attachments and Cloud VPN tunnels
Console
In the Google Cloud console, go to the VPC Flow Logs page.
Select the VLAN attachments or VPN tunnels tab:
- To update VPC Flow Logs parameters for VLAN attachments, select VLAN attachments.
- To update VPC Flow Logs parameters for Cloud VPN tunnels, select VPN tunnels.
Select one or more VPC Flow Logs configurations that you want to update and click Edit.
Optional: Adjust any of the following:
- The Aggregation interval. By default, the aggregation interval is set to 5 sec.
- Whether to set the Status of the VPC Flow Logs configuration to on or off. The On status means that the selected VPC Flow Logs configuration is active and generates flow logs.
- Whether to configure log filtering. By default, Keep only logs that match a filter is deselected.
- Whether to include metadata in the final log entries. By default, Metadata annotations includes all fields.
- The Secondary sampling rate.
100%
means that all entries generated by the primary flow log sampling process are kept. The primary flow log sampling rate isn't configurable. For more information, see Log sampling and processing.
Click Save.
Alternatively, you can update your VPC Flow Logs configuration parameters by using the Interconnect page and in the VPN tunnels tab on the VPN page.
Manage flow logs menu in the VLAN attachments tab on theAPI
To modify VPC Flow Logs configuration parameters, use the
projects.locations.vpcFlowLogsConfigs.patch
method.
Update a VPC Flow Logs configuration for a VLAN attachment.
PATCH https://networkmanagement.googleapis.com/v1beta1/projects/PROJECT_ID/locations/global/vpcFlowLogsConfigs/CONFIG_NAME { "interconnectAttachment": "VLAN_ATTACHMENT" ...fields to modify }
Update a VPC Flow Logs configuration for a Cloud VPN tunnel.
PATCH https://networkmanagement.googleapis.com/v1beta1/projects/PROJECT_ID/locations/global/vpcFlowLogsConfigs/CONFIG_NAME { "vpnTunnel": "VPN_TUNNEL" ...fields to modify }
Replace the following:
PROJECT_ID
: the ID of the Google Cloud project that contains the VPC Flow Logs configuration.CONFIG_NAME
: the name of the VPC Flow Logs configuration that you want to update.VLAN_ATTACHMENT
orVPN_TUNNEL
:- To update a VPC Flow Logs configuration for
a VLAN attachment, specify the
VLAN_ATTACHMENT
in the formatprojects/PROJECT_ID/regions/REGION/interconnectAttachments/NAME
. - To update a VPC Flow Logs configuration for a
Cloud VPN tunnel, specify the
VPN_TUNNEL
in the formatprojects/PROJECT_ID/regions/REGION/vpnTunnels/NAME
. - Replace the following:
PROJECT_ID
: the ID of the Google Cloud project the VLAN attachment or Cloud VPN tunnel belongs to.REGION
: the region of the VLAN attachment or Cloud VPN tunnel.NAME
: the name of the VLAN attachment or Cloud VPN tunnel.
- To update a VPC Flow Logs configuration for
a VLAN attachment, specify the
For information about the fields that you can modify, see Enable VPC Flow Logs for a VLAN attachment (Preview) or Enable VPC Flow Logs for a VPN tunnel (Preview).
Stop logs collection
You can disable VPC Flow Logs for a subnet, which stops logs collection and deletes its VPC Flow Logs configuration.
You can pause logs collection for a VLAN attachment or Cloud VPN tunnel by turning off all of its active VPC Flow Logs configurations. You can't pause logs collection for a subnet.
If you no longer need a VPC Flow Logs configuration, you can delete the configuration. Logs collection is stopped and the configuration is deleted.
Disable VPC Flow Logs for a subnet
Console
In the Google Cloud console, go to the VPC networks page.
Click the subnet that you want to update.
Click Edit.
For Flow logs, select Off.
Click Save.
gcloud
-
In the Google Cloud console, activate Cloud Shell.
At the bottom of the Google Cloud console, a Cloud Shell session starts and displays a command-line prompt. Cloud Shell is a shell environment with the Google Cloud CLI already installed and with values already set for your current project. It can take a few seconds for the session to initialize.
Run the following command:
gcloud compute networks subnets update SUBNET_NAME \ --no-enable-flow-logs
API
Disable VPC Flow Logs on a subnet to stop collecting log records.
PATCH https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION/subnetworks/SUBNET_NAME { "logConfig": { "enable": false }, "fingerprint": "SUBNETWORK_FINGERPRINT" }
Replace the following:
PROJECT_ID
: the ID of the project where the subnet is located.REGION
: the region where the subnet is located.SUBNET_NAME
: the name of the existing subnet.SUBNET_FINGERPRINT
: the fingerprint ID for the existing subnet, which is provided when you describe a subnet.
For more information, refer to the
subnetworks.patch
method.
Turn off a VPC Flow Logs configuration
Console
In the Google Cloud console, go to the VPC Flow Logs page.
Select the VLAN attachments or VPN tunnels tab:
- To turn off a VPC Flow Logs configuration for a VLAN attachment, select VLAN attachments.
- To turn off a VPC Flow Logs configuration for a Cloud VPN tunnel, select VPN tunnels.
Select one or more VPC Flow Logs configurations that you want to turn off and change the configuration status to Turn off or Turn all off. The Turn all off option in the Change configuration status menu appears only if your selection includes both active and inactive VPC Flow Logs configurations.
Delete a VPC Flow Logs configuration
Console
In the Google Cloud console, go to the VPC Flow Logs page.
Select the Subnets, VLAN attachments, or VPN tunnels tab:
- To delete a VPC Flow Logs configuration for a subnet, select Subnets.
- To delete a VPC Flow Logs configuration for a VLAN attachment, select VLAN attachments.
- To delete a VPC Flow Logs configuration for a Cloud VPN tunnel, select VPN tunnels.
Select one or more VPC Flow Logs configurations that you want to delete and click Delete.
API
To delete a VPC Flow Logs configuration for a
VLAN attachment or a
Cloud VPN tunnel, use the
projects.locations.vpcFlowLogsConfigs.delete
method.
DELETE https://networkmanagement.googleapis.com/v1beta1/projects/PROJECT_ID/locations/global/vpcFlowLogsConfigs/CONFIG_NAME
Replace the following:
PROJECT_ID
: the ID of the Google Cloud project that contains the VPC Flow Logs configuration that you want to delete.CONFIG_NAME
: the name of the VPC Flow Logs configuration.
Troubleshooting
Flow logs for subnets appear to be disabled even though you enabled them
When you're configuring a proxy-only subnet for internal Application Load Balancers and you're using the
gcloud compute networks subnets
command to enable VPC Flow Logs, the command appears to succeed, but flow logs aren't actually enabled. The--enable-flow-logs
flag doesn't take effect when you also include the--purpose=INTERNAL_HTTPS_LOAD_BALANCER
flag.When you use the Google Cloud console or the API to enable flow logs, you see the error message: "Invalid value for field 'resource.enableFlowLogs': 'true'. Invalid field set in subnetwork with purpose INTERNAL_HTTPS_LOAD_BALANCER."
Because proxy-only subnets have no VMs, VPC Flow Logs isn't supported. This is intended behavior.