Change, enable, disable, or delete NSG flow logs

Important

Network security group (NSG) flow logs retire on September 30, 2027. Because the feature is retiring, it no longer supports new NSG flow logs creation. Migrate to virtual network flow logs, which address the limitations of NSG flow logs. After the retirement date, Azure no longer supports traffic analytics enabled for NSG flow logs, and deletes existing NSG flow log resources in your subscriptions. However, Azure doesn't delete existing NSG flow log records from Azure Storage, and they continue to follow their configured retention policies. For more information, see the official announcement.

Network security group flow logging is a feature of Azure Network Watcher that you can use to log information about IP traffic flowing through a network security group. For more information about network security group flow logging, see NSG flow logs overview.

In this article, you learn how to change, enable, disable, or delete an existing network security group flow log by using the Azure portal, PowerShell, and Azure CLI.

Prerequisites

Portal

• An Azure account with an active subscription. Create an account for free.

• Insights provider. For more information, see Register Insights provider.

• A network security group. If you need to create a network security group, see Create, change, or delete a network security group.

• An Azure storage account. If you need to create a storage account, see Create a storage account using the Azure portal.

PowerShell

• An Azure account with an active subscription. Create an account for free.

• Insights provider. For more information, see Register Insights provider.

• A network security group. If you need to create a network security group, see Create, change, or delete a network security group.

• An Azure storage account. If you need to create a storage account, see Create a storage account using PowerShell.

• Azure Cloud Shell or Azure PowerShell.

  The steps in this article run the Azure PowerShell cmdlets interactively in Azure Cloud Shell. To run the cmdlets in the Cloud Shell, select Open Cloud Shell at the upper-right corner of a code block. Select Copy to copy the code and then paste it into Cloud Shell to run it. You can also run the Cloud Shell from within the Azure portal.

  You can also install Azure PowerShell locally to run the cmdlets. This article requires the Azure PowerShell module. If you run PowerShell locally, sign in to Azure using the Connect-AzAccount cmdlet.

Azure CLI

• An Azure account with an active subscription. Create an account for free.

• Insights provider. For more information, see Register Insights provider.

• A network security group. If you need to create a network security group, see Create, change, or delete a network security group.

• An Azure storage account. If you need to create a storage account, see Create a storage account using the Azure CLI.

• Azure Cloud Shell or Azure CLI.

  The steps in this article run the Azure CLI commands interactively in Azure Cloud Shell. To run the commands in the Cloud Shell, select Open Cloud Shell at the upper-right corner of a code block. Select Copy to copy the code, and paste it into Cloud Shell to run it. You can also run the Cloud Shell from within the Azure portal.

  You can also install Azure CLI locally to run the commands. If you run Azure CLI locally, sign in to Azure using the az login command.

Register Insights provider

Portal

To log traffic flowing through a network security group, you must register the Microsoft.Insights provider. If you're not sure whether the Microsoft.Insights provider is registered, check its status in the Azure portal by following these steps:

1. In the search box at the top of the portal, enter subscriptions. Select Subscriptions from the search results.

   

2. Select the Azure subscription that you want to enable the provider for in Subscriptions.

3. Under Settings, select Resource providers.

4. Enter insight in the filter box.

5. Confirm the status of the provider displayed is Registered. If the status is NotRegistered, select the Microsoft.Insights provider, and then select Register.

   

PowerShell

To log traffic flowing through a network security group, you must register the Microsoft.Insights provider. If you're not sure if the Microsoft.Insights provider is registered, use the Register-AzResourceProvider cmdlet to register it.

# Register Microsoft.Insights provider.
Register-AzResourceProvider -ProviderNamespace 'Microsoft.Insights'

Azure CLI

To log traffic flowing through a network security group, you must register the Microsoft.Insights provider. If you're not sure whether the Microsoft.Insights provider is registered, use the az provider register command to register it.

# Register Microsoft.Insights provider.
az provider register --namespace 'Microsoft.Insights'

Enable or disable traffic analytics

Enable traffic analytics for a flow log to analyze the flow log data. Traffic analytics provides insights into the traffic patterns of your virtual network. You can enable or disable traffic analytics for a flow log at any time.

Note

In addition to enabling or disabling traffic analytics, you can also change other flow log settings.

Portal

To enable traffic analytics for a flow log, follow these steps:

1. In the search box at the top of the portal, enter network watcher. Select Network Watcher from the search results.

2. Under Logs, select Flow logs.

3. In Network Watcher | Flow logs, select the flow log that you want to enable traffic analytics for.

4. In Flow logs settings, under Traffic analytics, check the Enable traffic analytics checkbox.

   

5. Enter or select the following values:

   Setting	Value
   Subscription	Select the Azure subscription of your Log Analytics workspace.
   Log Analytics workspace	Select your Log Analytics workspace. By default, Azure portal creates DefaultWorkspace-{SubscriptionID}-{Region} Log Analytics workspace in defaultresourcegroup-{Region} resource group.
   Traffic logging interval	Select the processing interval that you prefer, available options are: Every 1 hour and Every 10 mins. The default processing interval is every one hour. For more information, see Traffic analytics.

   

6. Select Save to apply the changes.

To disable traffic analytics for a flow log, take the previous steps 1-3, then uncheck the Enable traffic analytics checkbox and select Save.

PowerShell

To enable traffic analytics on a flow log resource, use the Set-AzNetworkWatcherFlowLog cmdlet.

# Place the network security group properties into a variable.
$nsg = Get-AzNetworkSecurityGroup -Name 'myNSG' -ResourceGroupName 'myResourceGroup'

# Place the storage account properties into a variable.
$sa = Get-AzStorageAccount -Name 'myStorageAccount' -ResourceGroupName 'myResourceGroup'

# Place the workspace configuration into a variable.
$workspace = Get-AzOperationalInsightsWorkspace -Name 'myWorkspace' -ResourceGroupName 'myResourceGroup'

# Update the NSG flow log.
Set-AzNetworkWatcherFlowLog -Enabled $true -Name 'myFlowLog' -Location 'eastus' -TargetResourceId $nsg.Id -StorageId $sa.Id -EnableTrafficAnalytics -TrafficAnalyticsWorkspaceId $workspace.ResourceId -FormatVersion 2

To disable traffic analytics on the flow log resource and continue to generate and save flow logs to the storage account, use the Set-AzNetworkWatcherFlowLog cmdlet.

# Place the network security group properties into a variable.
$nsg = Get-AzNetworkSecurityGroup -Name 'myNSG' -ResourceGroupName 'myResourceGroup'

# Place the storage account configuration into a variable.
$sa = Get-AzStorageAccount -Name 'myStorageAccount' -ResourceGroupName 'myResourceGroup'

# Update the NSG flow log.
Set-AzNetworkWatcherFlowLog -Enabled $true -Name 'myFlowLog' -Location 'eastus' -TargetResourceId $nsg.Id -StorageId $sa.Id -FormatVersion 2

Azure CLI

To enable traffic analytics on a flow log resource, use the az network watcher flow-log update command.

# Update the NSG flow log.
az network watcher flow-log update --name 'myFlowLog' --nsg 'myNSG' --resource-group 'myResourceGroup' --storage-account 'myStorageAccount' --traffic-analytics true --workspace 'myWorkspace' --log-version '2'

To disable traffic analytics on the flow log resource and continue to generate and save flow logs to the storage account, use the az network watcher flow-log update command.

# Update the NSG flow log.
az network watcher flow-log update --name 'myFlowLog' --nsg 'myNSG' --resource-group 'myResourceGroup' --storage-account 'myStorageAccount' --traffic-analytics false --log-version '2'

List all flow logs

You can list all flow logs in a subscription or a group of subscriptions (Azure portal). You can also list all flow logs in a region.

Portal

1. In the search box at the top of the portal, enter network watcher. Select Network Watcher from the search results.

2. Under Logs, select Flow logs.

3. Select the Subscription equals filter to choose one or more of your subscriptions. You can apply other filters like Location equals to list all flow logs in a region.

   

PowerShell

Use the Get-AzNetworkWatcherFlowLog cmdlet to list all flow log resources in a particular region in your subscription.

# Get all flow logs in East US region.
Get-AzNetworkWatcherFlowLog -Location 'eastus' | format-table Name

Note

To use the -Location parameter with Get-AzNetworkWatcherFlowLog cmdlet, you need an additional Reader permission in the NetworkWatcherRG resource group.

Azure CLI

Use the az network watcher flow-log list command to list all flow log resources in a particular region in your subscription.

# Get all flow logs in East US region.
az network watcher flow-log list --location 'eastus' --out table

View details of a flow log resource

You can view the details of a flow log.

Portal

1. In the search box at the top of the portal, enter network watcher. Select Network Watcher from the search results.

2. Under Logs, select Flow logs.

3. In Network Watcher | Flow logs, select the flow log that you want to see.

4. In Flow logs settings, view the settings of the flow log resource.

   

5. Select Cancel to close the settings page without making changes.

PowerShell

Use the Get-AzNetworkWatcherFlowLog cmdlet to see details of a flow log resource.

# Get the details of a flow log.
Get-AzNetworkWatcherFlowLog -Name 'myFlowLog' -Location 'eastus'

Note

To use the -Location parameter with Get-AzNetworkWatcherFlowLog cmdlet, you need an additional Reader permission in the NetworkWatcherRG resource group.

Azure CLI

Use the az network watcher flow-log show command to see details of a flow log resource.

# Get the details of a flow log.
az network watcher flow-log show --name 'myFlowLog' --resource-group 'NetworkWatcherRG' --location 'eastus'

Download a flow log

You can download the flow log data from the storage account where you saved the flow logs.

Portal

1. In the search box at the top of the portal, enter storage accounts. Select Storage accounts from the search results.

2. Select the storage account you used to store the logs.

3. Under Data storage, select Containers.

4. Select the insights-logs-networksecuritygroupflowevent container.

5. In insights-logs-networksecuritygroupflowevent, navigate the folder hierarchy until you get to the PT1H.json file that you want to download. NSG flow log files follow the following path:

   https://{storageAccountName}.blob.core.windows.net/insights-logs-networksecuritygroupflowevent/resourceId=/SUBSCRIPTIONS/{subscriptionID}/RESOURCEGROUPS/{resourceGroupName}/PROVIDERS/MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/{NetworkSecurityGroupName}/y={year}/m={month}/d={day}/h={hour}/m=00/macAddress={macAddress}/PT1H.json
   

6. Select the ellipsis ... to the right of the PT1H.json file, and then select Download.

PowerShell

To download NSG flow logs from your storage account, use the Get-AzStorageBlobContent cmdlet. For more information, see Download a blob.

NSG flow log files saved to a storage account follow this path:

https://{storageAccountName}.blob.core.windows.net/insights-logs-networksecuritygroupflowevent/resourceId=/SUBSCRIPTIONS/{subscriptionID}/RESOURCEGROUPS/{resourceGroupName}/PROVIDERS/MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/{NetworkSecurityGroupName}/y={year}/m={month}/d={day}/h={hour}/m=00/macAddress={macAddress}/PT1H.json

Azure CLI

To download NSG flow logs from your storage account, use the az storage blob download command. For more information, see Download a blob.

NSG flow log files saved to a storage account follow this path:

https://{storageAccountName}.blob.core.windows.net/insights-logs-networksecuritygroupflowevent/resourceId=/SUBSCRIPTIONS/{subscriptionID}/RESOURCEGROUPS/{resourceGroupName}/PROVIDERS/MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/{NetworkSecurityGroupName}/y={year}/m={month}/d={day}/h={hour}/m=00/macAddress={macAddress}/PT1H.json

Note

As an alternative way to access and download flow logs from your storage account, you can use Azure Storage Explorer. For more information, see Get started with Storage Explorer and Download blobs using Storage Explorer.

For information about the structure of a flow log, see Log format of NSG flow logs.

Disable a flow log

You can temporarily disable a flow log without deleting it. Disabling a flow log stops flow logging for the associated network security group. However, the flow log resource remains with all its settings and associations. You can re-enable it at any time to resume flow logging for the configured network security group.

Portal

1. In the search box at the top of the portal, enter network watcher. Select Network Watcher from the search results.

2. Under Logs, select Flow logs.

3. In Network Watcher | Flow logs, select the checkbox of the flow log that you want to disable.

4. Select Disable.

   

PowerShell

Use the Set-AzNetworkWatcherFlowLog cmdlet to disable a flow log.

# Place the network security group properties into a variable.
$nsg = Get-AzNetworkSecurityGroup -Name 'myNSG' -ResourceGroupName 'myResourceGroup'

# Place the storage account properties into a variable.
$sa = Get-AzStorageAccount -Name 'myStorageAccount' -ResourceGroupName 'myResourceGroup'

# Update the NSG flow log.
Set-AzNetworkWatcherFlowLog -Enabled $false -Name 'myFlowLog' -Location 'eastus' -TargetResourceId $nsg.Id -StorageId $sa.Id

Azure CLI

Use the az network watcher flow-log update command to disable a flow log.

# Disable the flow log.
az network watcher flow-log update --name 'myFlowLog' --nsg 'myNSG' --resource-group 'myResourceGroup' --storage-account 'myStorageAccount' --enabled false

Note

If you enable traffic analytics for a flow log, you must disable it before you can disable the flow log. To disable traffic analytics, see Enable or disable traffic analytics.

Delete a flow log

You can permanently delete an NSG flow log. Deleting a flow log removes all its settings and associations. To start flow logging again for the same resource, you must create a new flow log.

Portal

1. In the search box at the top of the portal, enter network watcher. Select Network Watcher from the search results.

2. Under Logs, select Flow logs.

3. In Network Watcher | Flow logs, select the checkbox of the flow log that you want to delete.

4. Select Delete.

   

PowerShell

To delete a flow log resource, use the Remove-AzNetworkWatcherFlowLog cmdlet.

# Delete the flow log.
Remove-AzNetworkWatcherFlowLog -Name 'myFlowLog' -Location 'eastus'

Azure CLI

To delete a flow log resource, use the az network watcher flow-log delete command.

# Delete the flow log.
az network watcher flow-log delete --name 'myFlowLog' --location 'eastus' --no-wait 'true'

Note

Deleting a flow log doesn't delete the flow log data from the storage account. Flow log data stored in a storage account follows the configured retention policy or stays stored in the storage account until you manually delete it.

Related content

• Virtual network flow logs
• Migrate from network security group flow logs to virtual network flow logs
• Traffic analytics