GCP Networking Logs & Tools

VPC Flow Logs

What it is / 왜 쓰나

• Sampled flow-metadata from the VM’s perspective (VM NIC 기준 샘플링). No packet payload.

  모니터링, 트래픽 분석, 보안/포렌식, 비용 최적화에 유용.

• Andromeda 기반, perf penalty 없음 (활성화해도 지연/성능 영향 없음).

Key behaviors

• Perspective: Logs are taken after ingress firewall evaluation → ingress-denied packets generally not logged. Egress-denied traffic may appear (VM 관점 샘플링).
• Protocols: TCP/UDP/ICMP/ESP/GRE flows.
• Scope: Enable per-subnet; covers all VMs in that subnet. (VMs can have multiple NICs.)

Fields (대표)

• 5-tuple (src/dst IP:port, protocol), start/end time, bytes/packets, VM info (tags), VPC/subnet, geo.
• 샘플링 비율, aggregation interval 등은 서브넷 설정에서 조정 가능.

Enable

• Subnet create/edit → Flow logs: On (sample & aggregation 옵션 조정).

Query in Logs Explorer

logName="projects/[PROJECT_ID]/logs/compute.googleapis.com%2Fvpc_flows"

Log Analytics (BigQuery)

• Log Analytics로 버킷 업그레이드 후 BigQuery SQL로 ad-hoc 분석 (사전 ETL 거의 불필요).

  → 빠른 탐색 + 대시보드/알람 연계. (권장)

Firewall Rules Logging

Why