Skip to content

Latest commit

 

History

History
77 lines (52 loc) · 3.46 KB

network-watcher-nsg-flow-logging-cli.md

File metadata and controls

77 lines (52 loc) · 3.46 KB
title description services documentationcenter author manager editor ms.assetid ms.service ms.devlang ms.topic ms.tgt_pltfrm ms.workload ms.date ms.author
Manage Network Security Group Flow logs with Azure Network Watcher - Azure CLI | Microsoft Docs
This page explains how to manage Network Security Group Flow logs in Azure Network Watcher with Azure CLI
network-watcher
na
jimdial
timlt
2dfc3112-8294-4357-b2f8-f81840da67d3
network-watcher
na
article
na
infrastructure-services
02/22/2017
jdial

Configuring Network Security Group Flow logs with Azure CLI

[!div class="op_single_selector"]

Network Security Group flow logs are a feature of Network Watcher that allows you to view information about ingress and egress IP traffic through a Network Security Group. These flow logs are written in json format and show outbound and inbound flows on a per rule basis, the NIC the flow applies to, 5-tuple information about the flow (Source/Destination IP, Source/Destination Port, Protocol), and if the traffic was allowed or denied.

This article uses our next generation CLI for the resource management deployment model, Azure CLI 2.0, which is available for Windows, Mac and Linux.

To perform the steps in this article, you need to install the Azure Command-Line Interface for Mac, Linux, and Windows (Azure CLI).

Register Insights provider

In order for flow logging to work successfully, the Microsoft.Insights provider must be registered. If you are not sure if the Microsoft.Insights provider is registered, run the following script.

az provider register --namespace Microsoft.Insights

Enable Network Security Group Flow logs

The command to enable flow logs is shown in the following example:

az network watcher flow-log configure --resource-group resourceGroupName --enabled true --nsg nsgName --storage-account storageAccountName

Disable Network Security Group Flow logs

Use the following example to disable flow logs:

az network watcher flow-log configure --resource-group resourceGroupName --enabled false --nsg nsgName

Download a Flow log

The storage location of a flow log is defined at creation. A convenient tool to access these flow logs saved to a storage account is Microsoft Azure Storage Explorer, which can be downloaded here: http://storageexplorer.com/

If a storage account is specified, packet capture files are saved to a storage account at the following location:

https://{storageAccountName}.blob.core.windows.net/insights-logs-networksecuritygroupflowevent/resourceId%3D/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/microsoft.network/networksecuritygroups/{nsgName}/{year}/{month}/{day}/PT1H.json

For information about the structure of the log visit Network Security Group Flow log Overview

Next Steps

Learn how to Visualize your NSG flow logs with PowerBI

Learn how to Visualize your NSG flow logs with open source tools