Azure Flow Logs

Enable Azure Flow Logs support in Configuration Center > Monitoring Center > Flow Logs > Microsoft Azure. The system downloads logs periodically, converts them to IPFIX format, and sends them to your specified local collector port. This table shows the mapping between Azure Flow Logs fields and IPFIX fields. Any fields not listed here are not mapped.

Field	Maps to, in IPFIX	Collector Configuration
Source IP	IPFIX_SourceIPv4Address IPFIX_SourceIPv6Address	Collected by default
Destination IP	IPFIX_DestinationIPv4Address IPFIX_DestinationIPv6Address	Collected by default
Source Port	IPFIX_SourceTransportPort	Collected by default
Destination Port	IPFIX_DestinationTransportPort	Collected by default
Protocol	IPFIX_protocolIdentifier	Collected by default
Packets	IPFIX_packetTotalCount	Collected by default
Bytes	IPFIX_octetTotalCount	Collected by default
Timestamp	No mapping, replaced by computed values for IPFIX_flowStartMilliseconds IPFIX_flowEndMilliseconds	Collected by default
Traffic Decision	IPFIX_firewallEvent	Not supported
Traffic Flow	IPFIX_flowDirection	Collected by default
Flow State	No mapping, used for generating values for IPFIX_flowStartMilliseconds IPFIX_flowEndMilliseconds	Collected by default
Virtual Network Name	No mapping, replaced by a generated value for IPFIX_ingressInterface	Collected by default
Subscription ID	No mapping, replaced by a generated value for IPFIX_exporterIPv4Address	Collected by default
Resource Group Name	No mapping, replaced by a generated value for IPFIX_exporterIPv4Address	Collected by default