What Is It?
Flow Logs captures network traffic metadata passing through NICs, Managed NAT Gateways, Managed Network Load Balancers, or Managed Application Load Balancers and writes records to IONOS Cloud Object Storage buckets. Logs can be filtered by direction (ingress, egress, or bidirectional) and by firewall action (accepted, rejected, or any), enabling targeted monitoring of specific traffic patterns for security analysis, troubleshooting, and compliance.
Quick Facts
| Aspect | Details |
|---|---|
| Type | Network traffic monitoring and logging service |
| Supported Resources | Server NICs, Cube NICs, Managed NAT Gateway, Managed Network Load Balancer, Managed Application Load Balancer |
| Storage | IONOS Cloud Object Storage buckets |
| Direction Filters | Ingress, Egress, Bidirectional |
| Action Filters | Accepted, Rejected, Any |
| Limit | One flow log per NIC/NAT Gateway/NLB/ALB |
| Management | DCD UI |
What You Can Do
Traffic Capture by Resource
Attach flow logs to NICs on Servers or Cubes, Managed NAT Gateways, Managed Network Load Balancers, or Managed Application Load Balancers. Each resource supports one active flow log.
Directional Filtering
Filter traffic by direction to focus monitoring on specific flows. Choose Ingress for inbound traffic, Egress for outbound traffic, or Bidirectional for both.
Firewall Action Filtering
Monitor traffic based on firewall decisions. Select Rejected to log only blocked traffic, Accepted to log only allowed traffic, or Any to capture all traffic regardless of firewall action.
Object Storage Integration
Flow log records are automatically written to specified IONOS Cloud Object Storage buckets. Define custom prefixes using the flow log name to organize logs by resource or purpose.
Security Analysis
Analyze rejected traffic patterns to identify attack attempts, unauthorized access, or misconfigured firewall rules. Review accepted traffic to validate expected communication patterns.
Troubleshooting
Diagnose connectivity issues by examining flow records for dropped packets, unexpected blocks, or routing problems. Direction and action filters help isolate specific problem areas.
Compliance Monitoring
Maintain audit trails of network traffic for compliance requirements. Logs stored in Object Storage can be retained according to policy requirements.
Best For
| Scenario | Why It Fits |
|---|---|
| Security monitoring | Capture rejected traffic to identify attacks or unauthorized access attempts |
| Firewall rule validation | Verify that firewall rules allow and block expected traffic |
| Network troubleshooting | Diagnose connectivity issues with detailed flow records |
| Compliance auditing | Maintain network traffic audit trails in Object Storage |
| Traffic pattern analysis | Understand application communication patterns and bandwidth usage |
| NAT Gateway monitoring | Track outbound connections from private resources |
| Load balancer diagnostics | Analyze traffic distribution across backend targets |
Key Considerations
Billing & Costs
- Main billing: No separate flow log charge
- Additional costs: Object Storage bucket storage costs for log data
- Volume considerations: Log volume depends on traffic patterns and filter settings
Limitations
- Only one flow log per NIC, Managed NAT Gateway, Managed Network Load Balancer, or Managed Application Load Balancer
- Flow log fields cannot be edited after creation (must delete and recreate to change settings)
- Object name prefix cannot contain forward slashes (/) or %2F characters
- Requires an existing user-owned IONOS Cloud Object Storage bucket before creating a flow log (contract-owned buckets are not supported as a flow log destination)
- Object Storage must be enabled for contract (admin/owner only)
- Deleting flow log stops new records but existing objects remain in bucket (manual cleanup required)
- User must have "Create Flow logs" permission (contract admin, owner, or granted privilege)
Management Options
- Data Center Designer (DCD)
- Configuration through NIC, NAT Gateway, NLB, or ALB settings
- Log retrieval via Object Storage console, API, or S3-compatible tools