How do I retrieve Amazon VPC flow logs to troubleshoot networking issues?

Resolution

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshoot AWS CLI errors. Also, make sure that you're using the most recent AWS CLI version.

Prerequisite: Use the AWSSupport-EnableVPCFlowlogs runbook to activate VPC flow logs.

Use CloudWatch Logs to retrieve Amazon VPC flow logs

If you store your logs in Amazon CloudWatch, use the CloudWatch Logs console to search your flow log records.

Use CloudWatch Logs Insights to query your logs. Then, use CloudWatch Logs Insights to analyze custom flow logs.

Use Amazon Athena to retrieve Amazon VPC flow logs

If you store your logs in Amazon Simple Storage Service (Amazon S3) buckets, then use Amazon Athena to analyze your logs. You can also use Athena to run a predefined query for your logs.

To analyze your logs with a point-and-click Amazon Athena integration, see Analyze VPC flow logs with point-and-click Amazon Athena integration on the AWS Blogs website.

Use AWS CLI to retrieve Amazon VPC flow logs

Use the following AWS CLI commands to retrieve your flow logs based on where you store them.

Amazon S3

If you send your logs to an Amazon S3 bucket that uses a default log file structure, then take the following actions:

• To list your flow logs, run the following command:

  aws s3 ls s3://example-bucket-name/AWSLogs/example-account-id/vpcflowlogs/example-region/

• To download a specific log file, run the following command:

  aws s3 cp s3://example-bucket-name>/AWSLogs/example-account-id/vpcflowlogs/example-region/YYYY/MM/DD/example-file-name 

• To download all logs from a specific day, run the following command:

  aws s3 sync s3://example-bucket-name/AWSLogs/example-account-id/vpcflowlogs/example-region/YYYY/MM/DD/ ./local-directory/

• To download and decompress your logs, run the following command:

  aws s3 cp s3://example-bucket-name/path/to/log.gz - | gunzip > output.txt

• To search your logs for a search term, run the following command:

  aws s3 cp s3://example-bucket-name/path/to/log.gz - | \  
  gunzip | \  
  grep "example-search-term"

  Note: In the preceding commands, replace example-bucket-name with the name of your Amazon S3 bucket. Replace example-account-id with your AWS account ID and example-region with the AWS Region where your log is located. Replace YYYY/MM/DD with the date. Replace example-file-name with your file name. Replace example-search-term with the term that you want to search for.

CloudWatch Logs

If you send your logs to CloudWatch, then take the following actions:

• To list log groups to find your VPC flow logs, run the following command:

  aws logs describe-log-groups --log-group-name-prefix "/aws/vpc/flowlogs"

• To list log streams in a specific log group, run the following command:

  aws logs describe-log-streams --log-group-name "/aws/vpc/flowlogs/example-log-group"

• To get log events from a specific stream, run the following command:

  aws logs get-log-events \  
      --log-group-name "/aws/vpc/flowlogs/example-log-group" \  
      --log-stream-name "example-log-stream"

• To get logs within a specific time range, run the following command:

  aws logs get-log-events \  
      --log-group-name "/aws/vpc/flowlogs/example-log-group" \  
      --log-stream-name "example-log-stream" \  
      --start-time example-timestamp \  
      --end-time example-timestamp

• To use CloudWatch Logs Insights to filter logs, run the following command:

  aws logs start-query \  
      --log-group-name "/aws/vpc/flowlogs/example-log-group" \  
      --start-time example-timestamp \  
      --end-time example-timestamp \  
      --query-string "fields @timestamp, srcAddr, dstAddr, action | filter action='REJECT'"

  Note: In the preceding commands, replace example-log-group with your log group, example-log-stream with your log stream, and example-timestamp with a timestamp in Unix format, measured in milliseconds.

Troubleshoot issues with VPC flow logs

If you have a connection timeout when you retrieve your flow logs, look for REJECT entries. Check if security groups or network access control lists (network ACLs) block necessary traffic. Verify that the source and destination IP addresses are correct.

If you have one-way communication issues, then compare inbound and outbound traffic flows for discrepancies. Verify that the connection allows request and response traffic, and then check for asymmetric routing issues.

Related information

Flow log records

Flow log record examples

How do I monitor traffic in my VPC with flow logs?

Logging IP traffic using VPC flow logs