Virtual Private Cloud (VPC) Flow Logs captures sampled telemetry of network flows sent from and received by virtual machines and Google Kubernetes Engine (GKE) nodes. The service is enabled at the subnet level, which automatically activates logging for all compute instances attached to that specific subnet. Each generated log entry captures connection attributes including source and destination IP addresses, ports, protocols, and transferred byte counts. Flow logs record traffic from multiple vantage points along a path, meaning a Cloud Interconnect VLAN attachment and a virtual machine subnet will each produce independent log entries for the same flow. This multi-point logging helps network teams identify asymmetric routing and pinpoint where packet loss or latency occurs across hybrid network boundaries.
Flow Analyzer is an analytics tool within Network Intelligence Center that translates raw VPC Flow Logs into aggregated visualizations and metrics. The tool correlates flow telemetry with underlying network topology to display traffic distribution between projects, regions, and external endpoints. By grouping raw flow records into high-level summaries, Flow Analyzer highlights unexpected traffic paths, abnormal bandwidth spikes, and performance anomalies across distributed workloads. Network operators use these visualizations to identify which workloads generate the highest traffic volumes and whether communication paths follow intended routing configurations.
Evaluating flow records helps network operators detect expensive egress paths that generate data transfer charges between regions or out to the internet. Flow Analyzer maps traffic journeys to specific geographic source and destination regions, revealing high-volume inter-region transfers and unoptimized transit routes. For example, traffic flowing from an instance in asia-east1 through a VLAN attachment in us-west1 incurs both intercontinental region-to-region transfer costs and North American interconnect charges. Identifying these multi-hop paths allows teams to reroute workloads through local egress points to lower operational costs. Suboptimal routing patterns that traverse unnecessary intermediate VPC networks can also be identified and corrected to reduce latency.
Detecting security threats requires analyzing flow logs for unauthorized connection attempts, abnormal port scans, and policy violations. Enabling Firewall Rules Logging alongside VPC Flow Logs provides an audit trail that combines permitted connection metrics with records of traffic blocked by security policies. Cross-project annotations are enabled by default, ensuring that flow records between separate VPC networks show identity metadata for both the source and destination instances. If cross-project annotations are disabled, log entries only display metadata for the reporting resource, which limits cross-project auditing. Combining detailed cross-project annotations with firewall denial logs allows teams to discover lateral movement attempts and potential data exfiltration between different projects.
Workload traffic analysis uses Flow Analyzer to identify top talkers and evaluate bandwidth distribution across Compute Engine instances and GKE nodes. VPC Flow Logs samples network flows—typically recording 50% or less of total flows to manage data volume—and exports directional byte counts and packet statistics. Flow Analyzer queries this data to display bidirectional communication between source and destination workloads. These aggregated queries allow operators to pinpoint individual instances that consume disproportionate bandwidth or create network bottlenecks. Evaluating these traffic patterns ensures that network capacity matches workload demands across all active subnets.
Evaluating hybrid network boundaries involves tracking traffic that crosses Cloud VPN tunnels and Cloud Interconnect VLAN attachments to reach on-premises data centers. When hybrid communication occurs, Google Cloud records flow metrics at both the originating instance subnet and the hybrid gateway itself. Each gateway log record includes directional metadata, such as source gateway or destination gateway fields, linked to specific project and VPC identifiers. This dual-sided visibility shows the exact path traffic takes as it exits or enters Google Cloud infrastructure. Operators evaluate these hybrid flow records to balance link utilization across redundant interconnect attachments and diagnose gateway congestion.
Multi-project traffic evaluation allows administrators to monitor flow metrics from multiple Google Cloud projects in a centralized dashboard. Administrators configure a metrics scope within a central scoping project to aggregate network telemetry across distinct application environments. In a Shared VPC architecture, network utilization and IP allocation metrics aggregate automatically at the host project level, while application-specific service metrics remain accessible within each individual service project. Default cross-project annotations enrich these scoped views by including source and destination resource names across VPC Network Peering and Network Connectivity Center links. This structure maintains centralized traffic oversight for network administrators while preserving administrative isolation for separate application teams.
Subnet-level configuration parameters determine how VPC Flow Logs samples and exports network traffic data. Administrators set an aggregation interval between 5 and 60 seconds, which defines how frequently the service aggregates and writes flow records. Selecting a longer aggregation interval reduces total log volume and ingestion costs but increases the time required for flow data to appear in monitoring tools. The sampling rate controls the fraction of total network flows captured, allowing operators to sample representative traffic rather than recording every individual flow. Adjusting these parameters allows teams to match telemetry precision with specific operational and budgetary requirements.
Metadata annotations enrich raw flow records with contextual resource attributes that simplify network troubleshooting and inventory mapping. VPC Flow Logs appends instance names, project identifiers, network tags, and container metadata directly to the captured source and destination IP records. These annotations allow network engineers to trace an IP address back to its specific Compute Engine virtual machine or GKE pod without manual lookups. Flow Analyzer reads these annotations to build visual dependency maps and link network flows to business applications. Having complete resource metadata accelerates root-cause analysis during incident triage by clarifying which application components own specific network streams.
Balancing telemetry granularity against Cloud Logging ingestion costs requires tailoring logging configurations to the needs of each environment. High sampling rates and short aggregation intervals provide detailed network visibility for mission-critical production workloads but generate higher logging charges. For lower-priority development environments, lower sampling rates help maintain representative traffic visibility while keeping ingestion expenses minimal. Administrators can also apply exclusion filters to drop high-volume, low-value records such as internal health checks and Google infrastructure communications. Applying these filtering and sampling strategies prevents budget overruns while preserving the telemetry required for security and capacity analysis.
VPC Flow Logs is the underlying telemetry feature that captures sampled packet metadata from subnet resources, whereas Flow Analyzer is the Network Intelligence Center visualization tool that aggregates and queries those flow records. VPC Flow Logs produces the raw data entries, and Flow Analyzer turns that data into charts, top-talker tables, and traffic path insights.
Multi-point flow logging generates separate log records at the virtual machine subnet and at the hybrid attachment, such as a Cloud Interconnect VLAN attachment or Cloud VPN gateway. Comparing these directional log records helps administrators verify whether traffic successfully reached the hybrid boundary and identify where packet drops or asymmetric routing occur.
Administrators should choose shorter aggregation intervals and higher sampling rates in production environments that require near-real-time security monitoring and precise forensic detail. Longer aggregation intervals and lower sampling rates should be selected in development environments or high-throughput networks to reduce Cloud Logging ingestion expenses while maintaining representative traffic visibility.
Professional Cloud Network Engineer
Prepare and test your skills
Prepare and test your skills
StudyCerts
StudyCerts