I want the logs for my NLB, but the protocol I'm using is TCP, so is there any way by which I can export the logs of that NLB to S3 using the TCP protocol only?

0

I want the logs for my NLB, but the protocol I'm using is TCP, so is there any way by which I can export the logs of that NLB to S3 using the TCP protocol only?

已提問 6 個月前檢視次數 392 次
1 個回答
0

Hi,

The only logs you can get from the NLB is if it configured as TLS listener.

Access logs are created only if the load balancer has a TLS listener and they contain information only about TLS requests.

https://docs.aws.amazon.com/elasticloadbalancing/latest/network/load-balancer-access-logs.html

Another option is to use VPC Flow Logs:

VPC Flow Logs You can use VPC Flow Logs to capture detailed information about the traffic going to and from your Network Load Balancer. For more information, see VPC flow logs in the Amazon VPC User Guide.

Create a flow log for each network interface for your load balancer. There is one network interface per load balancer subnet. To identify the network interfaces for a Network Load Balancer, look for the name of the load balancer in the description field of the network interface.

There are two entries for each connection through your Network Load Balancer, one for the frontend connection between the client and the load balancer and the other for the backend connection between the load balancer and the target. If the target group's client IP preservation attribute is enabled, the connection appears to the instance as a connection from the client. Otherwise, the connection's source IP is the load balancer's private IP address. If the security group of the instance doesn't allow connections from the client but the network ACLs for the load balancer subnet allow them, the logs for the network interface for the load balancer show "ACCEPT OK" for the frontend and backend connections, while the logs for the network interface for the instance show "REJECT OK" for the connection.

If a Network Load Balancer has associated security groups, your flow logs contain entries for traffic that is allowed or rejected by the security groups. For Network Load Balancers with TLS listeners, your flow logs entries reflect only the rejected entries.

profile picture
專家
已回答 6 個月前
profile picture
專家
已審閱 6 個月前
  • We want the target response time of each request coming on the NLB, and that can't be found in VPC flow logs.

您尚未登入。 登入 去張貼答案。

一個好的回答可以清楚地回答問題並提供建設性的意見回饋,同時有助於提問者的專業成長。

回答問題指南