Syllaro Academy

AWS Certified CloudOps Engineer - Associate

Analyzing Network Logs

VPC Flow Logs, ELB access logs, CloudFront logs, WAF logs, and Resolver query logs each watch a different hop of the same request. This lesson teaches you to read each one and to pick the right one before you start querying.

Intermediate 30 minutes 6 Learning Objectives
  1. Match a failing hop to the log source that can actually see it
  2. Read a VPC flow log record field by field, including the version 3 to 5 fields worth adding to a custom format
  3. Separate a security group denial from a network ACL denial using the ACCEPT and REJECT pattern in flow logs
  4. Explain what VPC Flow Logs never capture and why a missing record is not evidence of missing traffic
  5. Interpret the three ALB latency fields and the -1 values that replace them when a request fails
  6. Query flow logs with CloudWatch Logs Insights and Athena to find rejected traffic and top talkers