• ログイン無料アカウント

Set up cloud flow log monitoring

BETA FEATURE

This feature is currently in open beta and still in development, but we encourage you to try it out!

Set up your cloud flow logs to send them to New Relic.

Prerequisites

New Relic prerequisites

AWS prerequisites

Required fields from cloud flow logs

重要

The default format for flow logs doesn't include all of the required fields that are required for ktranslate to work properly. You must ensure that the below fields are added or the data you'll receive in New Relic One will be incomplete.

Flow Record Field

Description

version

The VPC Flow Logs version.

srcaddr

The source address for incoming traffic, or the IPv4 or IPv6 address of the network interface for outgoing traffic. For a network interface, the IPv4 address is always its private IPv4 address.

dstaddr

The destination address for outgoing traffic, or the IPv4 or IPv6 address of the network interface for incoming traffic. For a network interface, the IPv4 address is always its private IPv4 address.

srcport

The source port of the traffic.

dstport

The destination port of the traffic.

protocol

The IANA protocol number of the traffic.

packets

The number of packets transferred during the flow.

bytes

The number of bytes transferred during the flow.

vpc-id

The ID of the VPC that contains the network interface for which the traffic is recorded.

flow-direction

The direction of the flow with respect to the interface where traffic is captured. The possible values are ingress and egress.

Set up cloud flow logs monitoring in New Relic

To send your cloud flow logs to New Relic, follow these steps:

  1. Create a private ECR registry and upload the ktranslate image
  2. Create a Lambda function from the ECR image
  3. Validate your settings

Find and use your metrics

All cloud flow logs exported from the ktranslate Lambda function use the KFlow namespace, via the New Relic Event API. Currently, these are the fields populated from this integration:

Attribute

Type

Description

application

String

The class of program generating the traffic in this flow record. This is derived from the lowest numeric value from l4_dst_port and l4_src_port. Common examples include http, ssh, and ftp.

dest_vpc

String

The name of the VPC the traffic in this flow record is targeting, if known.

device_name

String

The name of the VPC this flow record was exported from.

dst_addr

String

The target IPv4 address for this flow record.

dst_as

Numeric

The target Autonomous System Number for this flow record.

dst_as_name

String

The target Autonomous System Name for this flow record.

dst_endpoint

String

The target IP:Port tuple for this flow record. This is a combination of dst_addr and l4_dst_port.

dst_geo

String

The target country for this flow record, if known.

flow_direction

String

The direction of flow for this record, from the point of view of the interface where the traffic was captured. Valid options are ingress | egress.

in_bytes

Numeric

The number of bytes transferred for ingress flow records.

in_pkts

Numeric

The number of packets transferred for ingress flow records.

l4_dst_port

Numeric

The target port for this flow record.

l4_src_port

Numeric

The source port for this flow record.

out_bytes

Numeric

The number of bytes transferred for egress flow records.

out_pkts

Numeric

The number of packets transferred for egress flow records.

protocol

String

The display name of the protocol used in this flow record, derived from the numeric IANA protocol number

provider

String

This attribute is used to uniquely identify various sources of data from ktranslate. VPC flow logs will always have the value of kentik-vpc.

sample_rate

Numeric

The rate at which ktranslate samples from the various files in the S3 bucket for flow exports. (Default: 1000) This can be configured with the KENTIK_SAMPLE_RATE environment variable.

source_vpc

String

The name of the VPC the traffic in this flow record originated from, if known.

src_addr

String

The source IPv4 address for this flow record.

src_as

Numeric

The source Autonomous System Number for this flow record.

src_as_name

String

The source Autonomous System Name for this flow record.

src_endpoint

String

The source IP:Port tuple for this flow record. This is a combination of src_addr and l4_src_port.

src_geo

String

The source country for this flow record, if known.

start_time

Numeric

The time, in Unix seconds, when the first packet of the flow was received within the aggregation interval. This might be up to 60 seconds after the packet was transmitted or received on the network interface.

timestamp

Numeric

The time, in Unix seconds, when this flow record was received by the New Relic Event API.

Environment variables for AWS Lambda functions

When you're configuring your AWS Lambda function, you need to set up the following environment variables:

Key

Value

Required

KENTIK_MODE

nr1.vpc.lambda

NEW_RELIC_API_KEY

The New Relic license key for your account

NR_ACCOUNT_ID

Your New Relic account ID

NR_REGION

The New Relic datacenter region for your account. The possible values are US and EU, and by default it's set to US.

KENTIK_SAMPLE_RATE

The rate of randomized sampling ktranslate applies to the flow export objects in S3. By default, it's set to 1000. Setting this to 1 disables all sampling and ktranslate ships all flow records to New Relic.

ヒント

For S3 objects with less than 100 flow records, ktranslate will revert to a sample rate of 1 and process every record. For S3 objects with more than 100 flow records, ktranslate will use the configured value of KENTIK_SAMPLE_RATE, which has a default of 1000. Meaning that every record in the object has a 1:1000 change of being sampled.

Copyright © 2022 New Relic Inc.