Create, change, enable, disable, or delete NSG flow logs

• An Azure account with an active subscription. Create an account for free.

• Insights provider. For more information, see Register Insights provider.

• A network security group. If you need to create a network security group, see Create, change, or delete a network security group.

• An Azure storage account. If you need to create a storage account, see Create a storage account using the Azure portal.

• An Azure account with an active subscription. Create an account for free.

• Insights provider. For more information, see Register Insights provider.

• A network security group. If you need to create a network security group, see Create, change, or delete a network security group.

• An Azure storage account. If you need to create a storage account, see Create a storage account using PowerShell.

• Azure Cloud Shell or Azure PowerShell.

  The steps in this article run the Azure PowerShell cmdlets interactively in Azure Cloud Shell. To run the cmdlets in the Cloud Shell, select Open Cloud Shell at the upper-right corner of a code block. Select Copy to copy the code and then paste it into Cloud Shell to run it. You can also run the Cloud Shell from within the Azure portal.

  You can also install Azure PowerShell locally to run the cmdlets. This article requires the Azure PowerShell module. If you run PowerShell locally, sign in to Azure using the Connect-AzAccount cmdlet.

• An Azure account with an active subscription. Create an account for free.

• Insights provider. For more information, see Register Insights provider.

• A network security group. If you need to create a network security group, see Create, change, or delete a network security group.

• An Azure storage account. If you need to create a storage account, see Create a storage account using the Azure CLI.

• Azure Cloud Shell or Azure CLI.

  The steps in this article run the Azure CLI commands interactively in Azure Cloud Shell. To run the commands in the Cloud Shell, select Open Cloud Shell at the upper-right corner of a code block. Select Copy to copy the code, and paste it into Cloud Shell to run it. You can also run the Cloud Shell from within the Azure portal.

  You can also install Azure CLI locally to run the commands. If you run Azure CLI locally, sign in to Azure using the az login command.

Microsoft.Insights provider must be registered to successfully log traffic flowing through a virtual network. If you aren't sure if the Microsoft.Insights provider is registered, check its status in the Azure portal by following these steps:

1. In the search box at the top of the portal, enter subscriptions. Select Subscriptions from the search results.

   

2. Select the Azure subscription that you want to enable the provider for in Subscriptions.

3. Under Settings, select Resource providers.

4. Enter insight in the filter box.

5. Confirm the status of the provider displayed is Registered. If the status is NotRegistered, select the Microsoft.Insights provider then select Register.

   

Microsoft.Insights provider must be registered to successfully log traffic in a virtual network. If you aren't sure if the Microsoft.Insights provider is registered, use Register-AzResourceProvider to register it:

# Register Microsoft.Insights provider.
Register-AzResourceProvider -ProviderNamespace 'Microsoft.Insights'

Microsoft.Insights provider must be registered to successfully log traffic in a virtual network. If you aren't sure if the Microsoft.Insights provider is registered, use az provider register to register it:

# Register Microsoft.Insights provider.
az provider register --namespace 'Microsoft.Insights'

1. In the search box at the top of the portal, enter network watcher. Select Network Watcher from the search results.

2. Under Logs, select Flow logs.

3. In Network Watcher | Flow logs, select + Create or Create flow log blue button.

   

4. On the Basics tab of Create a flow log, enter or select the following values:

   Setting	Value
   Project details
   Subscription	Select the Azure subscription of your network security group that you want to log.
   Flow log type	Select Network security group then select + Select target resource. Select the network security group that you want to flow log, then select Confirm selection.
   Flow Log Name	Enter a name for the flow log or leave the default name. Azure portal uses {ResourceName}-{ResourceGroupName}-flowlog as a default name for the flow log. myNSG-myResourceGroup-flowlog is the default name used in this article.
   Instance details
   Subscription	Select the Azure subscription of your storage account.
   Storage accounts	Select the storage account that you want to save the flow logs to. If you want to create a new storage account, select Create a new storage account.
   Retention (days)	Enter a retention time for the logs (this option is only available with Standard general-purpose v2 storage accounts). Enter 0 if you want to retain the flow logs data in the storage account forever (until you manually delete it from the storage account). For information about pricing, see Azure Storage pricing.

   

5. To enable traffic analytics, select Next: Analytics button, or select the Analytics tab. Enter or select the following values:

   Setting	Value
   Flow logs version	Select the version of the network security group flow log, available options are: Version 1 and Version 2. The default version is version 2. For more information, see Flow logging for network security groups.
   Enable traffic analytics	Select the checkbox to enable traffic analytics for your flow log.
   Traffic analytics processing interval	Select the processing interval that you prefer, available options are: Every 1 hour and Every 10 mins. The default processing interval is every one hour. For more information, see Traffic analytics.
   Subscription	Select the Azure subscription of your Log Analytics workspace.
   Log Analytics Workspace	Select your Log Analytics workspace. By default, Azure portal creates DefaultWorkspace-{SubscriptionID}-{Region} Log Analytics workspace in defaultresourcegroup-{Region} resource group.

   

   Note

   To create and select a Log Analytics workspace other than the default one, see Create a Log Analytics workspace

6. Select Review + create.

7. Review the settings, and then select Create.

Use New-AzNetworkWatcherFlowLog cmdlet to create a flow log. The flow log is created in the Network Watcher default resource group NetworkWatcherRG.

• Enable NSG flow logs without traffic analytics:

  # Place the network security group properties into a variable.
  $nsg = Get-AzNetworkSecurityGroup -Name 'myNSG' -ResourceGroupName 'myResourceGroup'
  
  # Place the storage account configuration into a variable.
  $sa = Get-AzStorageAccount -Name 'myStorageAccount' -ResourceGroupName 'myResourceGroup'
  
  # Create a version 1 NSG flow log.
  New-AzNetworkWatcherFlowLog -Name 'myFlowLog' -Location 'eastus' -TargetResourceId $nsg.Id -StorageId $sa.Id -Enabled $true
  

• Enable NSG flow logs with traffic analytics:

  # Place the network security group properties into a variable.
  $nsg = Get-AzNetworkSecurityGroup -Name 'myNSG' -ResourceGroupName 'myResourceGroup'
  
  # Place the storage account configuration into a variable.
  $sa = Get-AzStorageAccount -Name 'myStorageAccount' -ResourceGroupName 'myResourceGroup'
  
  # Create a traffic analytics workspace and place its configuration into a variable.
  $workspace = New-AzOperationalInsightsWorkspace -Name 'myWorkspace' -ResourceGroupName 'myResourceGroup' -Location 'eastus'
  
  # Create a version 1 NSG flow log.
  New-AzNetworkWatcherFlowLog -Name 'myFlowLog' -Location 'eastus' -TargetResourceId $nsg.Id -StorageId $sa.Id -Enabled $true -EnableTrafficAnalytics -TrafficAnalyticsWorkspaceId $workspace.ResourceId
  

Use az network watcher flow-log create command to create a virtual network flow log. The flow log is created in the Network Watcher default resource group NetworkWatcherRG.

• Enable NSG flow logs without traffic analytics:

  # Create a version 1 NSG flow log.
  az network watcher flow-log create --name 'myFlowLog' --nsg 'myNSG' --resource-group 'myResourceGroup' --storage-account 'myStorageAccount' --location 'eastus' 
  

  If the storage account is in a different resource group from the network security group, use the resource ID of the storage account instead of its name:

  # Create a version 1 NSG flow log (the storage account is in a different resource group from the network security group).
  az network watcher flow-log create --name 'myFlowLog' --nsg 'myNSG' --resource-group 'myResourceGroup' --storage-account '/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/StorageRG/providers/Microsoft.Storage/storageAccounts/myStorageAccount' --location 'eastus' 
  

• Enable NSG flow logs with traffic analytics:

  # Create a traffic analytics workspace.
  az monitor log-analytics workspace create --name 'myWorkspace' --resource-group 'myResourceGroup' --location 'eastus'
  
  # Create a version 1 NSG flow log and enable traffic analytics for it.
  az network watcher flow-log create --name 'myFlowLog' --nsg 'myNSG' --resource-group 'myResourceGroup' --storage-account 'myStorageAccount' --traffic-analytics true --workspace 'myWorkspace' --location 'eastus' 
  

  If the storage account is in a different resource group from the network security group, use the resource ID of the storage account instead of its name.

To enable traffic analytics for a flow log, follow these steps:

1. In the search box at the top of the portal, enter network watcher. Select Network Watcher from the search results.

2. Under Logs, select Flow logs.

3. In Network Watcher | Flow logs, select the flow log that you want to enable traffic analytics for.

4. In Flow logs settings, under Traffic analytics, check the Enable traffic analytics checkbox.

   

5. Enter or select the following values:

   Setting	Value
   Subscription	Select the Azure subscription of your Log Analytics workspace.
   Log Analytics workspace	Select your Log Analytics workspace. By default, Azure portal creates DefaultWorkspace-{SubscriptionID}-{Region} Log Analytics workspace in defaultresourcegroup-{Region} resource group.
   Traffic logging interval	Select the processing interval that you prefer, available options are: Every 1 hour and Every 10 mins. The default processing interval is every one hour. For more information, see Traffic analytics.

   

6. Select Save to apply the changes.

To disable traffic analytics for a flow log, take the previous steps 1-3, then uncheck the Enable traffic analytics checkbox and select Save.

To enable traffic analytics on a flow log resource, use Set-AzNetworkWatcherFlowLog cmdlet:

# Place the network security group properties into a variable.
$nsg = Get-AzNetworkSecurityGroup -Name 'myNSG' -ResourceGroupName 'myResourceGroup'

# Place the storage account properties into a variable.
$sa = Get-AzStorageAccount -Name 'myStorageAccount' -ResourceGroupName 'myResourceGroup'

# Place the workspace configuration into a variable.
$workspace = Get-AzOperationalInsightsWorkspace -Name 'myWorkspace' -ResourceGroupName 'myResourceGroup'

# Update the NSG flow log.
Set-AzNetworkWatcherFlowLog -Enabled $true -Name 'myFlowLog' -Location 'eastus' -TargetResourceId $nsg.Id -StorageId $sa.Id -EnableTrafficAnalytics -TrafficAnalyticsWorkspaceId $workspace.ResourceId -FormatVersion 2

To disable traffic analytics on the flow log resource and continue to generate and save flow logs to storage account, use Set-AzNetworkWatcherFlowLog cmdlet:

# Place the network security group properties into a variable.
$nsg = Get-AzNetworkSecurityGroup -Name 'myNSG' -ResourceGroupName 'myResourceGroup'

# Place the storage account configuration into a variable.
$sa = Get-AzStorageAccount -Name 'myStorageAccount' -ResourceGroupName 'myResourceGroup'

# Update the NSG flow log.
Set-AzNetworkWatcherFlowLog -Enabled $true -Name 'myFlowLog' -Location 'eastus' -TargetResourceId $nsg.Id -StorageId $sa.Id -FormatVersion 2

To enable traffic analytics on a flow log resource, use az network watcher flow-log update command:

# Update the NSG flow log.
az network watcher flow-log update --name 'myFlowLog' --nsg 'myNSG' --resource-group 'myResourceGroup' --storage-account 'myStorageAccount' --traffic-analytics true --workspace 'myWorkspace' --log-version '2'

To disable traffic analytics on the flow log resource and continue to generate and save flow logs to the storage account, use az network watcher flow-log update command:

# Update the NSG flow log.
az network watcher flow-log update --name 'myFlowLog' --nsg 'myNSG' --resource-group 'myResourceGroup' --storage-account 'myStorageAccount' --traffic-analytics false --log-version '2'

1. In the search box at the top of the portal, enter network watcher. Select Network Watcher from the search results.

2. Under Logs, select Flow logs.

3. Select Subscription equals filter to choose one or more of your subscriptions. You can apply other filters like Location equals to list all flow logs in a region.

   

Use Get-AzNetworkWatcherFlowLog cmdlet to list all flow log resources in a particular region in your subscription:

# Get all flow logs in East US region.
Get-AzNetworkWatcherFlowLog -Location 'eastus' | format-table Name

Use az network watcher flow-log list command to list all flow log resources in a particular region in your subscription:

# Get all flow logs in East US region.
az network watcher flow-log list --location 'eastus' --out table

1. In the search box at the top of the portal, enter network watcher. Select Network Watcher from the search results.

2. Under Logs, select Flow logs.

3. In Network Watcher | Flow logs, select the flow log that you want to see.

4. In Flow logs settings, you can view the settings of the flow log resource.

   

5. Select Cancel to close the settings page without making changes.

Use Get-AzNetworkWatcherFlowLog cmdlet to see details of a flow log resource:

# Get the details of a flow log.
Get-AzNetworkWatcherFlowLog -Name 'myFlowLog' -Location 'eastus'

Use az network watcher flow-log show command to see details of a flow log resource:

# Get the details of a flow log.
az network watcher flow-log show --name 'myFlowLog' --resource-group 'NetworkWatcherRG' --location 'eastus'

1. In the search box at the top of the portal, enter storage accounts. Select Storage accounts from the search results.

2. Select the storage account you used to store the logs.

3. Under Data storage, select Containers.

4. Select the insights-logs-networksecuritygroupflowevent container.

5. In insights-logs-networksecuritygroupflowevent, navigate the folder hierarchy until you get to the PT1H.json file that you want to download. NSG flow log files follow the following path:

   https://{storageAccountName}.blob.core.windows.net/insights-logs-networksecuritygroupflowevent/resourceId=/SUBSCRIPTIONS/{subscriptionID}/RESOURCEGROUPS/{resourceGroupName}/PROVIDERS/MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/{NetworkSecurityGroupName}/y={year}/m={month}/d={day}/h={hour}/m=00/macAddress={macAddress}/PT1H.json
   

6. Select the ellipsis ... to the right of the PT1H.json file, then select Download.

To download virtual network flow logs from your storage account, use Get-AzStorageBlobContent cmdlet. For more information, see Download a blob.

NSG flow log files saved to a storage account follow this path:

https://{storageAccountName}.blob.core.windows.net/insights-logs-networksecuritygroupflowevent/resourceId=/SUBSCRIPTIONS/{subscriptionID}/RESOURCEGROUPS/{resourceGroupName}/PROVIDERS/MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/{NetworkSecurityGroupName}/y={year}/m={month}/d={day}/h={hour}/m=00/macAddress={macAddress}/PT1H.json

To download virtual network flow logs from your storage account, use the az storage blob download command. For more information, see Download a blob.

NSG flow log files saved to a storage account follow this path:

https://{storageAccountName}.blob.core.windows.net/insights-logs-networksecuritygroupflowevent/resourceId=/SUBSCRIPTIONS/{subscriptionID}/RESOURCEGROUPS/{resourceGroupName}/PROVIDERS/MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/{NetworkSecurityGroupName}/y={year}/m={month}/d={day}/h={hour}/m=00/macAddress={macAddress}/PT1H.json

1. In the search box at the top of the portal, enter network watcher. Select Network Watcher from the search results.

2. Under Logs, select Flow logs.

3. In Network Watcher | Flow logs, select the checkbox of the flow log that you want to disable.

4. Select Disable.

   

Use Set-AzNetworkWatcherFlowLog cmdlet to disable a flow log:

# Place the network security group properties into a variable.
$nsg = Get-AzNetworkSecurityGroup -Name 'myNSG' -ResourceGroupName 'myResourceGroup'

# Place the storage account properties into a variable.
$sa = Get-AzStorageAccount -Name 'myStorageAccount' -ResourceGroupName 'myResourceGroup'

# Update the NSG flow log.
Set-AzNetworkWatcherFlowLog -Enabled $false -Name 'myFlowLog' -Location 'eastus' -TargetResourceId $nsg.Id -StorageId $sa.Id

Use az network watcher flow-log update command to disable a flow log:

# Disable the flow log.
az network watcher flow-log update --name 'myFlowLog' --nsg 'myNSG' --resource-group 'myResourceGroup' --storage-account 'myStorageAccount' --enabled false

1. In the search box at the top of the portal, enter network watcher. Select Network Watcher from the search results.

2. Under Logs, select Flow logs.

3. In Network Watcher | Flow logs, select the checkbox of the flow log that you want to delete.

4. Select Delete.

   

To delete a flow log resource, use Remove-AzNetworkWatcherFlowLog cmdlet:

# Delete the flow log.
Remove-AzNetworkWatcherFlowLog -Name 'myFlowLog' -Location 'eastus'

To delete a flow log resource, use az network watcher flow-log delete command:

# Delete the flow log.
az network watcher flow-log delete --name 'myFlowLog' --location 'eastus' --no-wait 'true'