教程:使用 Azure 门户记录出入虚拟机的网络流量Tutorial: Log network traffic to and from a virtual machine using the Azure portal

可以通过网络安全组 (NSG) 筛选虚拟机 (VM) 的入站和出站流量。A network security group (NSG) enables you to filter inbound traffic to, and outbound traffic from, a virtual machine (VM). 可以使用网络观察程序的 NSG 流日志功能记录流经 NSG 的网络流量。You can log network traffic that flows through an NSG with Network Watcher's NSG flow log capability. 本教程介绍如何执行下列操作:In this tutorial, you learn how to:

  • 通过网络安全组创建 VMCreate a VM with a network security group
  • 启用网络观察程序并注册 Microsoft.Insights 提供程序Enable Network Watcher and register the Microsoft.Insights provider
  • 使用网络观察程序的 NSG 流日志功能启用 NSG 的流量日志Enable a traffic flow log for an NSG, using Network Watcher's NSG flow log capability
  • 下载记录的数据Download logged data
  • 查看记录的数据View logged data

如果没有 Azure 订阅,可在开始前创建一个试用帐户If you don't have an Azure subscription, create a trial account before you begin.

创建 VMCreate a VM

  1. 选择 Azure 门户左上角的“+ 创建资源”。Select + Create a resource found on the upper, left corner of the Azure portal.

  2. 选择“计算”,然后选择“Windows Server 2016 Datacenter”或某一版本的“Ubuntu Server”。Select Compute, and then select Windows Server 2016 Datacenter or a version of Ubuntu Server.

  3. 输入或选择以下信息,保留剩下的默认设置,然后选择“确定”:Enter, or select, the following information, accept the defaults for the remaining settings, and then select OK:

    设置Setting Value
    NameName myVmmyVm
    用户名User name 输入所选用户名。Enter a user name of your choosing.
    密码Password 输入所选密码。Enter a password of your choosing. 密码必须至少 12 个字符长,且符合定义的复杂性要求The password must be at least 12 characters long and meet the defined complexity requirements.
    订阅Subscription 选择订阅。Select your subscription.
    资源组Resource group 选择“新建”,并输入 myResourceGroupSelect Create new and enter myResourceGroup.
    位置Location 选择“美国东部”Select East US
  4. 选择 VM 的大小,然后选择“选择”。Select a size for the VM and then select Select.

  5. 保留“设置”下的所有默认设置,然后选择“确定”。Under Settings, accept all the defaults, and select OK.

  6. 在“摘要”中的“创建”下,选择“创建”以启动 VM 部署。Under Create of the Summary, select Create to start VM deployment. 部署 VM 需要几分钟时间。The VM takes a few minutes to deploy. 在继续余下的步骤之前,请等待 VM 完成部署。Wait for the VM to finish deploying before continuing with the remaining steps.

创建 VM 需要几分钟时间。The VM takes a few minutes to create. 在创建完 VM 之前,请勿继续执行剩余的步骤。Don't continue with remaining steps until the VM has finished creating. 门户在创建 VM 的同时,还会创建名为 myVm-nsg 的网络安全组并将其关联到 VM 的网络接口。While the portal creates the VM, it also creates a network security group with the name myVm-nsg, and associates it to the network interface for the VM.

启用网络观察程序Enable Network Watcher

如果已在“美国东部”区域中启用网络观察程序,请跳到注册 Insights 提供程序If you already have a network watcher enabled in the East US region, skip to Register Insights provider.

  1. 在门户中,选择“所有服务”。In the portal, select All services. 在“筛选器”框中,输入“网络观察程序”。In the Filter box, enter Network Watcher. 结果中出现“网络观察程序”后,将其选中。When Network Watcher appears in the results, select it.

  2. 选择“区域”,以便将其展开,然后选择“美国东部”右侧的“...”,如下图所示:Select Regions, to expand it, and then select ... to the right of East US, as shown in the following picture:

    启用网络观察程序

  3. 选择“启用网络观察程序”。Select Enable Network Watcher.

注册 Insights 提供程序Register Insights provider

NSG 流日志记录要求使用 Microsoft.Insights 提供程序。NSG flow logging requires the Microsoft.Insights provider. 若要注册该提供程序,请完成以下步骤:To register the provider, complete the following steps:

  1. 在门户左上角选择“所有服务”。In the top, left corner of portal, select All services. 在“筛选器”框中,键入“订阅”。In the Filter box, type Subscriptions. 当“订阅”出现在搜索结果中时,请将其选中。When Subscriptions appear in the search results, select it.

  2. 从订阅列表中选择要为其启用提供程序的订阅。From the list of subscriptions, select the subscription you want to enable the provider for.

  3. 在“设置”下,选择“资源提供程序”。Select Resource providers, under SETTINGS.

  4. 确认 microsoft.insights 提供程序的“状态”为“已注册”,如下图所示。Confirm that the STATUS for the microsoft.insights provider is Registered, as shown in the picture that follows. 如果状态为“未注册”,则请选择提供程序右侧的“注册”。If the status is Unregistered, then select Register, to the right of the provider.

    注册提供程序

启用 NSG 流日志Enable NSG flow log

  1. NSG 流日志数据写入 Azure 存储帐户。NSG flow log data is written to an Azure Storage account. 若要创建 Azure 存储帐户,请在门户左上角选择“+ 创建资源”。To create an Azure Storage account, select + Create a resource at the top, left corner of the portal.

  2. 选择“存储”,然后选择“存储帐户 - Blob、文件、表、队列”。Select Storage, then select Storage account - blob, file, table, queue.

  3. 输入或选择以下信息,接受剩下的默认设置,然后选择“创建”。Enter, or select the following information, accept the remaining defaults, and then select Create.

    设置Setting Value
    NameName 长度为 3-24 个字符,只能包含小写字母和数字,且必须在所有 Azure 存储帐户中唯一。3-24 characters in length, can only contain lowercase letters and numbers, and must be unique across all Azure Storage accounts.
    位置Location 选择“中国北部”Select China North
    资源组Resource group 选择“使用现有资源组”,然后选择“myResourceGroup”Select Use existing, and then select myResourceGroup

    创建存储帐户可能需要大约一分钟的时间。The storage account may take around minute to create. 在创建好存储帐户之前,请勿继续执行剩余的步骤。Don't continue with remaining steps until the storage account is created. 如果使用现有的存储帐户而不是创建一个,请确保在存储帐户的“设置”下针对“防火墙和虚拟网络”选择了“所有网络”(默认设置)。If you use an existing storage account instead of creating one, ensure you select a storage account that has All networks (default) selected for Firewalls and virtual networks, under the SETTINGS for the storage account.

  4. 在门户左上角选择“所有服务”。In the top, left corner of portal, select All services. 在“筛选器”框中,键入“网络观察程序”。In the Filter box, type Network Watcher. 搜索结果中出现“网络观察程序”后,将其选中。When Network Watcher appears in the search results, select it.

  5. 在“日志”下选择“NSG 流日志”,如下图所示:Under LOGS, select NSG flow logs, as shown in the following picture:

    NSG

  6. 从 NSG 列表中选择名为 myVm-nsg 的 NSG。From the list of NSGs, select the NSG named myVm-nsg.

  7. 在“流日志设置”下选择“启用”。Under Flow logs settings, select On.

  8. 选择流日志记录版本。Select the flow logging version. 版本 2 包含流会话统计信息(字节和数据包)Version 2 contains flow-session statistics (Bytes and Packets)

    选择流日志版本

  9. 选择在步骤 3 中创建的存储帐户。Select the storage account that you created in step 3.

  10. 将“保留期(天)”设置为 5,然后选择“保存”。Set Retention (days) to 5, and then select Save.

下载流日志Download flow log

  1. 在门户的网络观察程序的“日志”下选择“NSG 流日志”。From Network Watcher, in the portal, select NSG flow logs under LOGS.

  2. 选择“可从配置的存储帐户下载流日志”,如下图所示:Select You can download flow logs from configured storage accounts, as shown in the following picture:

    下载流日志

  3. 选择在启用 NSG 流日志的步骤 2 中配置的存储帐户。Select the storage account that you configured in step 2 of Enable NSG flow log.

  4. 在“Blob 服务”下选择“Blob”,然后选择“insights-logs-networksecuritygroupflowevent”容器。Under Blob service, select Blobs, and then select the insights-logs-networksecuritygroupflowevent container.

  5. 在容器中,导航浏览文件夹层次结构,直至找到 PT1H.json 文件,如下图所示。In the container, navigate the folder hierarchy until you get to a PT1H.json file, as shown in the picture that follows. 日志文件写入遵循以下命名约定的文件夹层次结构: https://{storageAccountName}.blob.core.chinacloudapi.cn/insights-logs-networksecuritygroupflowevent/resourceId=/SUBSCRIPTIONS/{subscriptionID}/RESOURCEGROUPS/{resourceGroupName}/PROVIDERS/MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/{nsgName}/y={year}/m={month}/d={day}/h={hour}/m=00/macAddress={macAddress}/PT1H.jsonLog files are written to a folder hierarchy that follows the following naming convention: https://{storageAccountName}.blob.core.chinacloudapi.cn/insights-logs-networksecuritygroupflowevent/resourceId=/SUBSCRIPTIONS/{subscriptionID}/RESOURCEGROUPS/{resourceGroupName}/PROVIDERS/MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/{nsgName}/y={year}/m={month}/d={day}/h={hour}/m=00/macAddress={macAddress}/PT1H.json

    流日志

  6. 选择 PT1H.json 文件右侧的“...”,然后选择“下载”。Select ... to the right of the PT1H.json file and select Download.

查看流日志View flow log

下面的 json 是一个示例,说明了为每个流记录数据时在 PT1H.json 文件中会看到的内容:The following json is an example of what you'll see in the PT1H.json file for each flow that data is logged for:

版本 1 流日志事件Version 1 flow log event

{
    "time": "2018-05-01T15:00:02.1713710Z",
    "systemId": "<Id>",
    "category": "NetworkSecurityGroupFlowEvent",
    "resourceId": "/SUBSCRIPTIONS/<Id>/RESOURCEGROUPS/MYRESOURCEGROUP/PROVIDERS/MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/MYVM-NSG",
    "operationName": "NetworkSecurityGroupFlowEvents",
    "properties": {
        "Version": 1,
        "flows": [
            {
                "rule": "UserRule_default-allow-rdp",
                "flows": [
                    {
                        "mac": "000D3A170C69",
                        "flowTuples": [
                            "1525186745,192.168.1.4,10.0.0.4,55960,3389,T,I,A"
                        ]
                    }
                ]
            }
        ]
    }
}

版本 2 流日志事件Version 2 flow log event

{
    "time": "2018-11-13T12:00:35.3899262Z",
    "systemId": "a0fca5ce-022c-47b1-9735-89943b42f2fa",
    "category": "NetworkSecurityGroupFlowEvent",
    "resourceId": "/SUBSCRIPTIONS/00000000-0000-0000-0000-000000000000/RESOURCEGROUPS/FABRIKAMRG/PROVIDERS/MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/FABRIAKMVM1-NSG",
    "operationName": "NetworkSecurityGroupFlowEvents",
    "properties": {
        "Version": 2,
        "flows": [
            {
                "rule": "DefaultRule_DenyAllInBound",
                "flows": [
                    {
                        "mac": "000D3AF87856",
                        "flowTuples": [
                            "1542110402,94.102.49.190,10.5.16.4,28746,443,U,I,D,B,,,,",
                            "1542110424,176.119.4.10,10.5.16.4,56509,59336,T,I,D,B,,,,",
                            "1542110432,167.99.86.8,10.5.16.4,48495,8088,T,I,D,B,,,,"
                        ]
                    }
                ]
            },
            {
                "rule": "DefaultRule_AllowInternetOutBound",
                "flows": [
                    {
                        "mac": "000D3AF87856",
                        "flowTuples": [
                            "1542110377,10.5.16.4,13.67.143.118,59831,443,T,O,A,B,,,,",
                            "1542110379,10.5.16.4,13.67.143.117,59932,443,T,O,A,E,1,66,1,66",
                            "1542110379,10.5.16.4,13.67.143.115,44931,443,T,O,A,C,30,16978,24,14008",
                            "1542110406,10.5.16.4,40.71.12.225,59929,443,T,O,A,E,15,8489,12,7054"
                        ]
                    }
                ]
            }
        ]
    }
}

在前面的输出中,mac 的值是在创建 VM 时创建的网络接口的 MAC 地址。The value for mac in the previous output is the MAC address of the network interface that was created when the VM was created. flowTuples 的逗号分隔信息如下所示:The comma-separated information for flowTuples, is as follows:

示例数据Example data 数据代表的内容What data represents 说明Explanation
15421103771542110377 时间戳Time stamp 表示流发生时间的时间戳,采用 UNIX EPOCH 格式。The time stamp of when the flow occurred, in UNIX EPOCH format. 在前面的示例中,转换后的日期为 2018 年 5 月 1 日下午 2:59:05 (GMT)。In the previous example, the date converts to May 1, 2018 at 2:59:05 PM GMT.
10.0.0.410.0.0.4 源 IP 地址Source IP address 充当流源的源 IP 地址。The source IP address that the flow originated from. 10.0.0.4 是在创建 VM 一文中创建的 VM 的专用 IP 地址。10.0.0.4 is the private IP address of the VM you created in Create a VM.
13.67.143.11813.67.143.118 目标 IP 地址Destination IP address 充当流目标的目标 IP 地址。The destination IP address that the flow was destined to.
4493144931 Source PortSource port 充当流源的源端口。The source port that the flow originated from.
443443 Destination PortDestination port 充当流目标的目标端口。The destination port that the flow was destined to. 由于流目标为端口 443,因此由日志文件中名为 UserRule_default-allow-rdp 的规则处理流。Since the traffic was destined to port 443, the rule named UserRule_default-allow-rdp, in the log file processed the flow.
TT 协议Protocol 流的协议是 TCP (T) 还是 UDP (U)。Whether the protocol of the flow was TCP (T) or UDP (U).
OO 方向Direction 流是入站 (I) 还是出站 (O)。Whether the traffic was inbound (I) or outbound (O).
AA 操作Action 是允许 (A) 流还是拒绝 (D) 流。Whether the traffic was allowed (A) or denied (D).
CC 流状态仅限版本 2Flow State Version 2 Only 捕获流的状态。Captures the state of the flow. 可能的状态包括 B:创建流时开始。Possible states are B: Begin, when a flow is created. 未提供统计信息。Statistics aren't provided. C:继续执行正在进行的流。C: Continuing for an ongoing flow. 以 5 分钟的时间间隔提供统计信息。Statistics are provided at 5-minute intervals. E:在流终止时结束。E: End, when a flow is terminated. 已提供统计信息。Statistics are provided.
3030 发送的数据包数 - 源到目标仅限版本 2Packets sent - Source to destination Version 2 Only 自上次更新以来,从源发送到目标的 TCP 或 UDP 数据包的总数。The total number of TCP or UDP packets sent from source to destination since last update.
1697816978 发送的字节数 - 源到目标仅限版本 2Bytes sent - Source to destination Version 2 Only 自上次更新以来,从源发送到目标的 TCP 或 UDP 数据包字节的总数。The total number of TCP or UDP packet bytes sent from source to destination since last update. 数据包字节包括数据包标头和有效负载。Packet bytes include the packet header and payload.
2424 发送的数据包数 - 目标到源仅限版本 2Packets sent - Destination to source Version 2 Only 自上次更新以来,从目标发送到源的 TCP 或 UDP 数据包的总数。The total number of TCP or UDP packets sent from destination to source since last update.
1400814008 发送的字节数 - 目标到源仅限版本 2Bytes sent - Destination to source Version 2 Only 自上次更新以来,从目标发送到源的 TCP 和 UDP 数据包字节的总数。The total number of TCP and UDP packet bytes sent from destination to source since last update. 数据包字节包括数据包标头和有效负载。Packet bytes include packet header and payload.

后续步骤Next steps

本教程介绍了如何为 NSG 启用 NSG 流日志记录,In this tutorial, you learned how to enable NSG flow logging for an NSG. 以及如何下载和查看文件中记录的数据。You also learned how to download and view data logged in a file. json 文件中的原始数据可能难以解释。The raw data in the json file can be difficult to interpret.