})
Amazon Virtual Private Cloud (VPC) Flow Logs log the IP network traffic of your VPC, allowing you to troubleshoot traffic and security issues. The Amazon VPC Flow Logs App leverages this data to provide real-time visibility and analysis of your environment. It consists of predefined searches and Dashboards.
For more information on Amazon VPC Flow Logs, see [here](https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/flow-logs.html).
## Collecting Amazon VPC Flow Logs
This section has instructions for collecting VPC Flow Logs using a CloudFormation template.
VPC Flow Logs can be published to Amazon CloudWatch Logs and Amazon S3. You can use either of these methods to collect Amazon VPC Flow Logs:
* [Collect Amazon VPC Flow Logs using an Amazon S3 source](#collecting-amazon-vpc-flow-logs-using-an-amazon-s3-source)
* [Collect Amazon VPC Flow Logs using a CloudFormation template](#collecting-amazon-vpc-flow-logs-from-cloudwatch-using-cloudformation)
Each method has advantages. Using an Amazon S3 source is more reliable, while using a CloudWatch Logs source with the CloudFormation template allows you to optimize your logs. With the CloudWatch Logs source and CloudFormation template, you can customize logs by adding more information and filtering out unwanted data. The Security Groups dashboard utilizes customized logs that are generated from the Lambda function and created with the CloudFormation template from logs sent to CloudWatch Logs.
### Collecting Amazon VPC Flow Logs from CloudWatch using CloudFormation
This section has instructions for collecting VPC Flow Logs using a CloudFormation template. The diagram below illustrates the collection process for Amazon VPC Flow Logs. VPC is enabled to send logs to Amazon CloudWatch. A Lambda function subscribes to a CloudWatch Log Group to obtain the flow logs, and then sends the data on to a Sumo Logic HTTP Source on a hosted collector. The AWS resources are created by a Sumo-provided CloudFormation template.
})
#### Step 1: Enable Amazon VPC Flow Logs
You can enable Amazon Virtual Private Cloud (VPC) Flow Logs from the Amazon Web Services (AWS) Management Console, the AWS Command Line Interface (CLI), or by making calls to the Elastic Compute Cloud (EC2) API.
To enable Amazon Virtual Private Cloud (VPC) Flow Logs from the AWS console:
1. Go to **VPC management**, and go to the VPC list.
2. Select the VPC.
3. Click **Actions** > **Create Flow Log**.
4. On the **Create Flow Log** page, select a **Role** to use Flow logs.
1. If you haven't set up IAM permissions, click **Set Up Permissions**.
2. From the new tab, **VPC Flow Logs is requesting permissions to use resources in your account**:
3. From the IAM Role, select **Create a new IAM Role.**
4. Add a Role Name that describes your logs, for example, VPC-Flow-Logs.
5. Click **Allow**.
5. Back in **Create Flow Log**, enter the new role you created in **Role.**
6. In **Destination Log Group** enter a descriptive name such as **VPCFlowLogs**.
7. Click **Create Flow Log**. It can take up to an hour for the log group to show up in CloudWatch Logs.
#### Step 2: Configure hosted collector and HTTP source
1. Configure a [Hosted Collector ](/docs/send-data/hosted-collectors/configure-hosted-collector)in Sumo Logic.
2. Configure an [HTTP Source](/docs/send-data/hosted-collectors/http-source/logs-metrics) in Sumo Logic. When configuring the source:
3. Under **Advanced Options for Logs**, for **Timestamp Format**, click **Specify a format**.
4. **Format**. Enter: `epoch`
5. **Timestamp locator**. Enter:
```
\s(\d{10,13})\s\d{10,13}
```
6. Click **Save**.
#### Step 3: Create AWS functions and resources
Follow the steps on [Amazon CloudWatch Logs](/docs/send-data/collect-from-other-data-sources/amazon-cloudwatch-logs), starting with the [Download the CloudFormation template](/docs/send-data/collect-from-other-data-sources/amazon-cloudwatch-logs/collect-with-cloudformation-template/#step-2-download-the-cloudformation-template) step and ending with the [Dealing with alarms](/docs/send-data/collect-from-other-data-sources/amazon-cloudwatch-logs/collect-with-cloudformation-template/#dealing-with-alarms) step. As you perform the procedure note the additional instructions below, regarding log format and optional environment variables.
#### Configure LogFormat correctly (Required)
When you [Create a stack on the AWS CloudFormation console](/docs/send-data/collect-from-other-data-sources/amazon-cloudwatch-logs/collect-with-cloudformation-template/#step-4-create-a-stack-on-the-aws-cloudformation-console), in step 5, make sure you select either VPC-JSON or VPC-RAW in the LogFormat field in the Specify Details window.
#### Environment variables for VPC flow log collection (Optional)
When you [Configure environment variables for Lambda functions](/docs/send-data/collect-from-other-data-sources/amazon-cloudwatch-logs/collect-with-cloudformation-template#configure-environment-variables-for-lambda-functions-optional), in addition to the variables listed, you can optionally also define the following environment variables.
If you define the environment variables below, do it for both of the Lambda functions created by the CloudFormation template.
})
#### Filtering the Overview dashboard
You can filter the Overview dashboard by any combination of `DestinationIP`, `SourceIP`, `action`, `dest_port`, `interfaceid`, `protocol`, and `src_port`.
### Accepts
**Amazon VPC Flow Logs - Accepts** dashboard provides information about accepted connections, including the geolocation of source addresses for accepted connections, the top 10 accepts by Interface ID and protocol, and the top 10 destination addresses.
**Use case:** Use this dashboard to track requests that are permitted by Security Groups and Network ACLs.One can compare bytes and packets received per minute with yesterday and last week. Similarly one can also track abnormal activity and volume spikes.
})
#### Filtering the Accepts dashboard
In the filters pane, you can can configure these parameters for the [outlier](/docs/search/search-query-language/search-operators/outlier) analysis performed by the "Accepts by Minute - Outlier" panel: Consecutive, Threshold, Window, and Timeslice.
You can also filter Accepts dashboard by any combination of `DestinationIP`, `SourceIP`, `dest_port`, `interfaceid`, `protocol`, and `src_port`.
### Rejects
**Amazon VPC Flow Logs - Rejects** dashboard provides information about rejected connections, including the geolocation of source addresses for rejected connections, the top 10 rejects by Interface ID and protocol, and the top 10 destination addresses.
**Use case**: Use this dashboard to track requests that are not permitted by Security Groups and Network ACLs.One can compare bytes and packets rejected per minute with yesterday and last week. One can monitor top source IP's and ports from where the requests are rejected.
})
#### Filtering the Rejects dashboard
In the filters pane, you can can configure these parameters for the [outlier](/docs/search/search-query-language/search-operators/outlier) analysis performed by the "Rejects by Minute - Outlier" panel: Consecutive, Threshold, Window, and Timeslice.
You can also filter the Rejects dashboard by any combination of `DestinationIP`, `SourceIP`, `dest_port`, `interfaceid`, `protocol`, and `src_port`.
### Traffic
**Amazon VPC Flow Logs - Traffic** dashboard provides traffic details, including the counts of unique traffic sources and destinations, the total accepted and rejected traffic, the top 10 source and destination ports, and analyzes of bytes and packets transmitted.
**Use case description**: Use this dashboard for comparing the permissive and non permissive traffic based on ports, protocols and network interfaces. Also one can monitor abnormal behavior, current and future trends based on total packets and bytes flowing across the network. One can filter by Action to filter out data for permissive and non permissive traffic. Similarly one can filter by `interfaceid`, `src_ip`, `dest_ip`, `src_port`, `dest_port` to further filter out the traffic for analysis.
})
#### Filtering the Traffic dashboard
In the filters pane, you can can configure these parameters for the [outlier](/docs/search/search-query-language/search-operators/outlier) analysis performed by several panels: Consecutive, Threshold, Window, and Timelice.
You can also filter the Traffic dashboard by any combination of `DestinationIP`, `SourceIP`, `action`, `dest_port`, `interfaceid`, `protocol`, and `src_port`.
### Security Groups
**Amazon VPC Flow Logs - Security Groups** dashboard provides information about security groups, subnet and vpc along with flow direction inbound/outbound including the top vpc,subnet by bytes flow, top 5 security groups by packets, number of unique vpc,subnet and security group and destination port distribution by security group.
Key facts about this dashboard:
* This dashboard is populated only if you chose VPC-JSON option for LogFormat when you deployed the CloudFormation template.
* If your network interface has multiple IPv4 addresses and traffic is sent to a secondary private IPv4 address, the flow log displays the primary private IPv4 address in the destination IP address field.
* The Direction field has three values:
* internal. The SourceIP and DestinationIP both are from same subnet,
* inbound. The DestinationIP matches the ENI's private IP address.
* outbound. iThe SourceIP matches the ENI’s private IP address.
**Use case:** Use this dashboard for monitoring the traffic direction. Also use this dashboard for identifying over permissive and restrictive security groups.One can also use this to identify unused security groups and inbound rules by comparing the traffic associated with the security group to the security group rules in EC2 console.
})
#### Filtering the Security Groups dashboard
In the filters pane, you can can configure these parameters for the [outlier](/docs/search/search-query-language/search-operators/outlier) analysis performed by several panels: Consecutive, Threshold, Window, and Timeslice.
You can also filter the Security Groups dashboard by any combination of `DestinationIP`, `SourceIP`, `action`, `dest_port`, `interfaceid`, `protocol`, `security_grp_id`, `src_port`, `subnet_id`, and `vpc_id`.
### Outliers
**Amazon VPC Flow Logs - Outliers** dashboard provides panels which show any outliers around Bytes, Packets and Accepted/Rejected traffic. In addition to this there is a separate section “Security Group” which has panels for outliers with respect to inbound and outbound traffic. This dashboard is populated only if you chose VPC-JSON option for LogFormat when you deployed the CloudFormation template.
})
#### Filtering the Outlier dashboard
In the filters panel, you can configure these parameters for the outlier analysis performed by several panels: Consecutive, Threshold, Window, and Timeslice.