Docs

Torch Log Service

VPC log collection

Collect VPC logs

This topic introduces VPC log features and collection methods.

Features overview

VPC flow logs aggregate network card traffic data as needed, delivering it to TLS for storage and query and analysis. You can use flow log analysis to monitor network traffic, troubleshoot network issues, and optimize network architecture. The related configuration is as follows:

Configuration	Description
Log type	VPC Flow Log.
Log storage location	When enabling the flow log feature in the VPC console, you can choose an existing log project or create a new project and log topic. After the log topic is successfully created, this dedicated log topic can not be modified or deleted in the TLS console. For details, see Manage VPC log resources. Log project: Custom name Log topic: Custom name
Log storage period	The default setting is permanent storage. The log storage period can not be modified.
Log shards	One shard is preset. Auto split is enabled by default. When write traffic increases, TLS automatically splits shards to meet data writing needs.
Index settings	You can enable indexing when creating stream logs or configure indexing as needed after the log topic is created.
Log fields	For a detailed list of log fields, see VPC log fields.

Collect VPC logs

For pricing details and usage limitations, see Flow log overview.

For steps to create flow logs and deliver logs to TLS, see Creating a flow log.

VPC log fields

The fields recorded in flow logs stored in TLS and their specific meaning are as follows:

Field	Description
version	Version of VPC flow logs.
account-id	ID of the primary account.
networkinterface-id	ID of the network interface.
srcaddr	Source address.
dstaddr	Destination address.
srcport	Source address port.
dstport	Destination address port.
protocol	IANA protocol number. For example, the protocol number of TCP is 6, and the protocol number of UDP is 17.
packets	Number of data packets.
bytes	Size of data packets.
start	Start time of the traffic data sampling period in Unix time format.
end	End time of the traffic data sampling period, measured in Unix time format.
action	Traffic policy. ACCEPT: Traffic has been accepted. This refers to the traffic allowed by security groups or network ACLs. REJECT: The traffic has been rejected. This refers to traffic not allowed by security groups or network ACLs.
log-status	Flow log recording status. OK: Successfully recorded in flow logs. NODATA: No inbound or outbound network traffic was collected. In this case, the packets and bytes fields are both -1. SKIPDATA: Some flow log records were skipped during the collection window. This may be caused by internal capacity limits or internal errors.

Last updated: 2026.08.13 10:27:27