Understanding NSG flow logs
Flow logs are a feature of Azure Network Watcher that records all IP flows moving in and out of an NSG. To filter network traffic to and from Azure resources within a VNet subnet, we can implement NSGs (see Figure 11.28). Rules can then be configured in an NSG to allow or deny traffic by source/destination IP address, source/destination port, and protocol (known as the five-tuple). We can associate an NSG at the subnet level or the VM NIC level (see Figure 11.28).
Figure 11.28 – The NSG at the subnet and VM NIC levels
When enabled, NSG flow logs will record IP flows through the NSG, outside the path of the network traffic, so there is no latency impact. The logs are written in JSON format and can be stored in an Azure Blob Storage container. We can specify the retention period at configuration time, as shown in the following screenshot (see Figure 11.29). We can also collect the logs in a Log Analytics workspace (if Traffic...
