Configure Flow Logs
Last updated
Was this helpful?
Last updated
Was this helpful?
The information and assistance available in this category make it easier for you to work with flow logs using the Data Center Designer (DCD). For the time being, you have the option of doing either of the following.
You can create flow logs for your network interfaces as well as the public interfaces of the Network Load Balancer and Network Address Translation (NAT) Gateway. Flow logs can publish data to your buckets in the IONOS S3 Object Storage.
After you have created and configured your bucket in the IONOS S3 Object Storage, you can create flow logs for your network interfaces.
Before you create a flow log, make sure that you meet the following prerequisites:
You are logged on to the DCD.
You are the contract owner or an administrator.
You have permission to edit the required data center.
You have the create and manage Flow logs privilege.
You are the owner or have write access to permissions of an IONOS S3 Object Storage bucket.
You have an IONOS S3 Object Storage instance with a bucket that exists for your flow logs. To create an IONOS S3 Object Storage bucket, see IONOS S3 Object Storage.
Select the appropriate tab for the instance or interface for which you want to activate flow logs in the workspace.
In the Inspector pane, open the Network tab.
Open the properties of the Network Interface Controller (NIC).
Activate flow logs
Open the Flow Log drop-down and fill in the following fields:
For Name, enter a name for the flow log rule. The name will also be the first part of the objects’ name prefix.
For Direction, choose Ingress to create flow logs for incoming traffic, Egress for outgoing traffic, or Bidirectional to create flow logs for all traffic.
For Action, choose Rejected to capture only traffic blocked by the firewall, Accepted to capture only traffic allowed by the firewall, or Any for all traffic.
For Target S3 bucket, enter a valid existing IONOS S3 Object Storage bucket name and an optional object name prefix where flow log records should be written.
Select Add flow log to complete the configuration of the flow log. It becomes applied once you provision your changes.
Characters / (slash) and %2F are not supported as object prefix characters.
You cannot edit/modify changes to the fields of a flow log rule after activating it.
There is a limit of one flow log created per NIC, NAT Gateway, and Network Load Balancer (NLB).
Result: An activated flow log rule is visualized by a green light on the NIC properties. The green light indicates that the configuration has been validated and is valid for provisioning.
A summary of the flow logs rule can be seen by opening the drop-down of the flow log and selecting the name of the flow log rule.
At this point, you may make further changes to your data center (optional).
When ready, select Provision changes. After provisioning is complete, the network interface's flow logs are activated.
Flow logs can be provisioned on both new and previously provisioned instances.
Prerequisites
Before you delete a flow log, make sure that you meet the following prerequisites:
You are logged on to the DCD.
You are the contract owner or an administrator.
You have permissions to edit the required data center.
You have the Create and manage Flow logs privilege.
You are the owner or have write access to permissions of an IONOS S3 Object Storage bucket.
Procedure
Select the relevant VM of the interface for which you want to delete the flow logs in the Workspace.
In the Inspector pane, open the Network tab.
Open the properties of the NIC.
Open the Flow Log drop-down.
Select the trash bin icon to delete the flow log.
6. In the confirmation message, select OK
7. Select Provision changes. After provisioning is complete, the network interface's flow logs are deleted and no longer captured.
Deleting a flow log does not delete the existing log streams from your bucket. Existing flow log data must be deleted using the respective service's console. In addition, deleting a flow log that publishes to IONOS S3 Object Storage does not remove the bucket policies and log file access control lists (ACLs).
