Details for VCN Flow Logs

Type of record. Possible values:

• ACCEPT: This record's traffic was accepted by the security lists.
• REJECT: This record's traffic was rejected by the security lists.

IP address of the destination, either in IPv4 dot, or IPv6 colon notation.

Note: When IPv6 traffic is encountered in a customer's virtual cloud network, a flow log entry with IPV6 address values is generated, in place of the current location of IPV4 values. The source and destination addresses could be either IPv4 or IPv6, based on the configuration and traffic present in the customer’s VCN. This data is only available in regions where IPv6 support is available, and configured by the customer.

10.0.99.4

8222:91f5:88bb:2bf0:94a:e71b:65d3:4bd7

IP address of the source, either in IPv4 dot, or IPv6 colon notation.

See the note in the data.destinationAddress description.

123.0.0.1

1fde:9f1c:2433:4038:68fc:e0b:73f3:3b3b

Start time of the capture window in Unix epoch seconds.

UNIX epoch time uses a fixed point in the past to reference the current time. Every second of the current time can be expressed as a number, such as 1576090259 (which is Wednesday, December 11, 2019 6:50:59 PM GMT).

Each flow log record records a one-minute interval (0 to 59 seconds) of data flow, using epoch start and end times to indicate the time that data appears during the 60-second interval for that record. Let's consider the epoch time entries that would appear for data flow during a fixed interval of 140 seconds. At five seconds past a particular minute, you open a connection to the host and begin to continuously send data over that connection for the next 140 seconds (< three minutes, three records).

Epoch start and end times would appear in the log according to the following:

• The first record would show an epoch start time at the five seconds past the minute mark and an epoch end time at the end of that minute (54 seconds later).
• The next record would show an epoch start time at the zero-seconds mark, and epoch end time at the end of that minute (59 seconds later). This assumes you sent the data continuously. If the transmission had been intermittent, the epoch times would reflect the first and last second data flow that occurred during that 60-second interval (the absolute time).
• The final record would show an epoch start time at the zero-seconds mark, and an epoch end time for 20 seconds later (since the total flow life was only 140 seconds, or 20 seconds into the third one-minute logging interval recorded by each record).

Status of data capture window. Possible values:

• OK: Normal packet log.

• NODATA: No traffic was recorded during the capture window, in which case, only the following data fields are set: endTime, startTime, status, and version. The remaining data fields are set to null: action, bytesOut, destinationAddress, destinationPort, flowid, packets, protocol, protocolName, sourceAddress, an sourcePort.
• SKIPDATA: Some traffic was not logged during the capture window because of system errors or capacity issues, in which case, only data fields endTime, startTime, status, and version are set, and the remaining data fields are set to null. The flow log can contain other records for accepted or rejected traffic in the capture window.