Differences between network flow logs and VNET flow logs

Question

Thank you for your interest in the post.

I am interested in the VNET flow log, which is a service that is still in preview status.

Is the VNET flow log superior to the network flow log?

Does collecting VNET flow logs mean that I don't need to collect network flow logs?

Or, if I collect VNET flow logs, do I still need to augment them with network flow log collection to collect specific logs?

This is very important to avoid duplicate log collection when it comes to cost.

In general, users don't want to have holes in their security logs.

Thank you. Have a great day :)

Answer 1

Hi,

You can just use VNET flow logs which covers all the logs from NSG flow logs + it has few additional log collection. But VNET flow logs are currently in preview and hence I would suggest you to wait till it get GA and then disable NSG flow logs and start using VNET flow logs.

Reference: https://learn.microsoft.com/en-us/azure/network-watcher/vnet-flow-logs-overview

Regards,

Karthik Srinivas