Announcing VCN Flow Logs for Oracle Cloud Infrastructure

Paul Cainkar
Principal Solution Architect

We’re pleased to announce the Limited Availability (LA) release of VCN Flow Logs for Oracle Cloud Infrastructure. With it, you can view connection information for traffic within your virtual cloud network (VCN).

Note: To use this feature, your cloud tenancy must be added to the LA program, which you can request. After you’re added to the program, you’ll receive an e-mail within in 3-5 days with usage instructions.


VCN Flow Logs keeps detailed records of every flow that passes through your VCN and presents this data for analysis in the Oracle Cloud Infrastructure Logging service. The data includes information about the source and destination of the traffic, along with the quantity of traffic and the "permit" or "deny" action taken, based on your network security rules. You can use this information for network monitoring, troubleshooting, and compliance. Through integration with the Logging service, you can view, search, and retrieve log files.

<version> <srcaddr> <dstaddr> <srcport> <dstport> <protocol> <packets> <bytes> <start_time> <end_time> <action> <status>

2 73 89 11 102 349 1557424462 1557424510 ALLOW OK

2 82 64 13 112 441 1557424462 1557424486 REJECT OK

Use Cases

Use VCN Flow Logs in the following use cases:

Troubleshooting and Monitoring

You can use flows logs for troubleshooting and monitoring. Flow logs show attempts to connect to your database from your on-premises environment, as illustrated in the following figure. Logs also show whether security rules allow or deny the traffic. You can use this information to make quick, informed decisions about managing your network resources.

Figure that shows a connection attempt to a database from an on-premises environment. The low log shows a rejected attempt, because security rules don't allow connections on TCP port 80.

Regulatory and Compliance

You can now achieve regulatory, compliance, and other governance requirements previously only achievable through third-party network virtual appliances or host-based agents. Through the visibility afforded by VCN Flow Logs and flexible data-retention policies provided by the Logging service, you can meet requirements in financial, healthcare, and other regulated industries.

Getting Started with VCN Flow Logs

VCN Flow Logs provides a flexible framework for using, managing, and viewing flow logs. Through the Logging service, you can enable, view, and manage your flow log configuration. During the LA release, you can view flow logs in the Oracle Cloud Infrastructure Console and export them to Object Storage. We’ll announce more data export options and integrations later this year.

Enable Flow Logs

  1. In the navigation menu in the Console, go to Logging and click Log Management.

  2. Create a log group to contain your flow logs.

    On the Log Groups tab, click Create Log Group. Enter a name and a description, and then click Create.

    Screenshot that shows the described steps in the Console.

  3. Enable VCN flow logging on your subnet.

    On the Logs tab, click Enable Log. Select the Flow Logs service, and select your subnet as the resource. Enter a name for the log, and click Enable Log.

    Screenshot that shows the described steps in the Console.

That's it! Within 15 minutes, your logs should become available.

View Logs

You can access flow logs from Logging or Object Storage.

Logging Console Viewer

You can view and search VCN flow logs directly within the Logging service’s console-based viewer. This view provides an easy-to-use indexed repository of your recent logs. To access the Logging viewer, navigate to Logging and then Log Search in the Console.

Screenshot of the Log Search page in the Console.

Object Storage

VCN flow logs are also available via Object Storage. You can retrieve the files from the Logging service’s Object Storage bucket on your account and keep logs in this location as long as you want.

Screenshot showing a list of flow log objects in a bucket.

Partnerships and Integrations

As part of the Splunk Technical Alliance Partnership, we have published integrations to allow customers to use VCN Flow Logs in their log management solution. We previously published solutions for retrieving log files from Logging and transferring them to Splunk.

Another blog post, planned for early February, will present a streaming-based solution using our new Events and Functions services.


VCN Flow Logs provides visibility into communications within your network. If you want to be added to the LA program, you can request access. We encourage you to share any product feedback that you have in the comments.

Join the discussion

Comments ( 4 )
  • Atul Kumar Friday, February 7, 2020
    Thanks for finally releasing this. Sent a mail and looking forward for this feature in my tenancy.

  • Kevin Clarke Monday, May 11, 2020
    Any plans for a similar ingestion capability like the one for Splunk, but for ELK?
  • Paul Cainkar Tuesday, May 12, 2020
    Hi Kevin,

    Good news, we do have a solution for this which we can share with you. Please ask your account team reach out to Flow Logs and we will assist them.
  • suresh kachwa Wednesday, May 20, 2020

    Is there any cost involved to get your tenancy added for LA program?
Please enter your name.Please provide a valid email address.Please enter a comment.CAPTCHA challenge response provided was incorrect. Please try again.