> For the complete documentation index, see [llms.txt](https://docs.ionos.com/cloud/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ionos.com/cloud/~/revisions/bM7yG7XCmGE9IxWqMpBu/compute/networks/how-tos/flow-logs/configure-flow-logs.md).
# Configure Flow Logs
The information and assistance available in this category make it easier for you to work with flow logs using the [Data Center Designer](https://docs.ionos.com/support/general-information/glossary-of-terms#data-center-designer) (DCD). For the time being, you have the option of doing either of the following.
## Create a flow log
You can create flow logs for your network interfaces as well as the public interfaces of the Network Load Balancer and Network Address Translation ([NAT](https://docs.ionos.com/support/general-information/glossary-of-terms#nat-gateway)) Gateway. Flow logs can publish data to your buckets in the [IONOS S3 Object Storage](https://docs.ionos.com/cloud/managed-services/s3-object-storage).
After you have created and configured your bucket in the IONOS S3 Object Storage, you can create flow logs for your network interfaces.
### Prerequisites
Before you create a flow log, make sure that you meet the following prerequisites:
* You are logged on to the [DCD](https://docs.ionos.com/cloud/getting-started/basic-tutorials/log-in-dcd).
* You are the [contract owner or an administrator](https://docs.ionos.com/cloud/getting-started/basic-tutorials/manage-user-access#user-access-control).
* You have [permission](https://docs.ionos.com/cloud/getting-started/basic-tutorials/manage-user-access#user-access-control) to edit the required data center.
* You have the [create and manage Flow logs](https://docs.ionos.com/cloud/getting-started/basic-tutorials/manage-user-access#assigning-privileges-to-groups) privilege.
* You are the owner or have write access to permissions of an [IONOS S3 Object Storage bucket](https://docs.ionos.com/cloud/managed-services/s3-object-storage/how-tos/setup-access#enabling-object-storage-access).
* You have an IONOS S3 Object Storage instance with a bucket that exists for your flow logs. To create an IONOS S3 Object Storage bucket, see [IONOS S3 Object Storage](https://docs.ionos.com/cloud/managed-services/s3-object-storage).
### Procedure
Select the appropriate tab for the instance or interface for which you want to activate flow logs in the workspace.
{% tabs %}
{% tab title="Server & Cubes" %}
1. In the Inspector pane, open the **Network** tab.
2. Open the properties of the Network Interface Controller (NIC).
**Activate flow logs**
Open the **Flow Log** drop-down and fill in the following fields:
1. For **Name**, enter a name for the flow log rule. The name will also be the first part of the objects’ name prefix.
2. For **Direction**, choose **Ingress** to create flow logs for incoming traffic, **Egress** for outgoing traffic, or **Bidirectional** to create flow logs for all traffic.
3. For **Action**, choose **Rejected** to capture only traffic blocked by the firewall, **Accepted** to capture only traffic allowed by the firewall, or **Any** for all traffic.
4. For **Target S3 bucket**, enter a valid existing IONOS S3 Object Storage bucket name and an optional object name prefix where flow log records should be written.
5. Select **Add flow** **log** to complete the configuration of the flow log. It becomes applied once you provision your changes.
{% hint style="info" %}
* Characters **/** (slash) and **%2F** are not supported as object prefix characters.
* You cannot edit/modify changes to the fields of a flow log rule after activating it.
* There is a limit of one flow log created per NIC, NAT Gateway, and Network Load Balancer (NLB).
{% endhint %}
**Result:** An activated flow log rule is visualized by a **green light** on the NIC properties. The green light indicates that the configuration has been validated and is valid for provisioning.
A summary of the flow logs rule can be seen by opening the drop-down of the flow log and selecting the name of the flow log rule.
At this point, you may make further changes to your data center (optional).
When ready, select **Provision changes**. After provisioning is complete, the network interface's flow logs are activated.
{% hint style="info" %}
Flow logs can be provisioned on both new and previously provisioned instances.
{% endhint %}
### Delete a flow log
**Prerequisites**
Before you delete a flow log, make sure that you meet the following prerequisites:
* You are logged on to the [DCD](https://docs.ionos.com/cloud/getting-started/basic-tutorials/log-in-dcd).
* You are the [contract owner or an administrator.](https://docs.ionos.com/cloud/getting-started/basic-tutorials/manage-user-access#user-access-control)
* You have [permissions](https://docs.ionos.com/cloud/getting-started/basic-tutorials/manage-user-access#user-access-control) to edit the required data center.
* You have the [Create and manage Flow logs](https://docs.ionos.com/cloud/getting-started/basic-tutorials/manage-user-access#assigning-privileges-to-groups) privilege.
* You are the owner or have write access to permissions of an [IONOS S3 Object Storage bucket](https://docs.ionos.com/cloud/managed-services/s3-object-storage/get-started/setup-access#enable-object-storage-access).
**Procedure**
1. Select the relevant VM of the interface for which you want to delete the flow logs in the Workspace.
2. In the Inspector pane, open the **Network** tab.
3. Open the properties of the NIC.
4. Open the **Flow Log** drop-down.
5. Select the trash bin icon to delete the flow log.
6\. In the confirmation message, select **OK**
7\. Select **Provision changes**. After provisioning is complete, the network interface's flow logs are deleted and no longer captured.
{% hint style="info" %}
Deleting a flow log does not delete the existing log streams from your bucket. Existing flow log data must be deleted using the respective service's console. In addition, deleting a flow log that publishes to IONOS S3 Object Storage does not remove the bucket policies and log file access control lists (ACLs).
{% endhint %}
{% endtab %}
{% tab title="NAT Gateway & Network Load Balancer" %}
1. In the Inspector pane, open the **Settings** tab.
To activate flow logs, open the **Flow Log** drop-down and fill in the following fields:
1. For **Name**, enter a name for the flow log rule. The name will also be the first part of the objects’ name prefix.
2. For **Direction**, choose **Ingress** to create flow logs for incoming traffic, **Egress** for outgoing traffic, or **Bidirectional** to create flow logs for all traffic.
3. For **Action**, choose **Rejected** to capture only traffic blocked by the firewall, **Accepted** to capture only traffic allowed by the firewall, or **Any** for all traffic.
4. For **Target S3 bucket**, enter a valid existing IONOS S3 Object Storage bucket name and an optional object name prefix where flow log records should be written.
5. Select **Add flow** **log** to complete the configuration of the flow log. It becomes applied once you provision your changes.
{% endtab %}
{% endtabs %}
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.ionos.com/cloud/~/revisions/bM7yG7XCmGE9IxWqMpBu/compute/networks/how-tos/flow-logs/configure-flow-logs.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.