OCI Logging - VCN flow logsを用いてNetworkアクセス状況を分析したときのメモ

# この記事で記載すること

OCIの外部と内部、OCI内部間の通信ログの取得方法と取得したログの分析方法についてメモを記載する。

# OCI Logging / VCN flow logsの利活用イメージ

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/38031/13dc73ae-69cb-31e5-37f1-820d5c63295c.png)
※ 本記事では、上記のOCI StreamingのところをLog Analyticsに置き換えて、VCN flow logsで取得したログ分析する

# OCI Logging / VCN flow logsに関連する基本操作

## VCN flow logsの有効化

１． Loggingサービスメニューを選択
OCI Consoleメニュー > Observability & Management > Logging > Logsを選択
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/38031/79aa7343-521e-7596-d36f-c59024c28c0b.png)
２． service logの有効化
「Enable service log」ボタンをクリック
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/38031/1e891850-6179-73d4-f1d6-75b28e2807c1.png)
３． パラメータを登録→Service Logの有効化

| 分類 | 項目 | 値 |
|:-|:-|:-|
| Resource | Service  | ログ取得対象VCN  |
| Resource | Resource  | ログ取得対象Subnet  |
| Configure Log  | Log Category  |  Flow Logs |
| Log Location|  Log  Group |   任意（保存したLog Group）|
| Log  Retention|  Log Retention |  任意 |

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/38031/3e84d5d2-4379-596c-3447-c49894fc977d.png)
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/38031/859d8541-d116-193c-c339-0a5ba78ef15f.png)

# Logの分析

## Logging / searching loggingを利用したログの分析

１．searching loggingサービスの起動
OCI Consoleメニュー > Observability & Management > Logging > Searchを選択

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/38031/416af49c-78bd-00e0-8620-8888e5187273.png)

２．searchするログの選択
Search > Select logs to search

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/38031/4346092c-ec19-64f1-b341-739bd0ec7ac8.png)

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/38031/311ad8db-a3a4-6368-f4a1-1f6986ac69ad.png)

３．Custom Fileterの設定

例①：REJECTしたデータのsearch

Custom filtersに以下を入力
`data.action = 'REJECT'`

例②：特定のサーバへの接続のsearch
`data.destinationAddress='10.7.1.15'`

例③：DBサーバへのOracle Net接続のsearch
`data.destinationAddress='10.7.1.120'`
`data.destinationPort=1521`

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/38031/bc974aef-62b1-1f8e-500c-0d7935a639de.png)


４．設定したsearchの保存
Save Search > New Saved Searchの登録

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/38031/088e59fb-cd83-b993-36a7-1c3f6f4ad05b.png)

## Logging Analyticsを利用したLogの分析

Logging Analyticsを使ってLoggingで取得したLogを以下のステップで分析準備
１．Loggingを使ってLogを収集（前述）
２．Logging Anaytlicsの準備
３．Service Connector Hubの準備
４．Loggin AnalyticsでLogを分析

■ VCN flow logs + Service Connector + Logging Analyticsのフローイメージ

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/38031/386cbb48-3e77-b49a-7031-bd7abeb306f2.png)

■ Service Connector Hubを用いたフロー全体像（21/6/14時点）

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/38031/a4dca92d-fc3f-a134-0496-57a232f7ffda.png)


###２．Logging Anaytlicsの準備

#### Logging Analytics（LA）の有効化

LAコンソールの起動
OCI Consoleメニュー > Observability & Management > Logging Analyticsを選択

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/38031/9bfe06a4-2938-b2de-187b-41843c47a531.png)

LAの有効化
Start Using Logging Analyticsをクリック

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/38031/71202c55-1ebd-1590-8a43-a7948163f063.png)

Set Up Ingestionをクリック

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/38031/ecb8b3d8-54f9-4180-a52a-3b7dafa6ffe0.png)

ここではDefaultのままでNextをクリック

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/38031/aac66159-5f9c-5e3b-8606-d19eb57f8756.png)

Set Up Ingestionをクリック

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/38031/6789c077-b45c-d08d-f4ba-210e798d98e7.png)

option: Go to OCI Audit Analytics Dashboardをクリック
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/38031/d92576f4-2ffb-63ac-f400-a17dd9febfbf.png)

#### log groupの作成

LAのAdministorationコンソールの起動
OCI Consoleメニュー > Observability & Management > Logging Analytics > Administrationを選択

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/38031/5d4298c1-294f-42f9-9243-dfdcf432250c.png)

左ペインにあるLog Groupsをクリック

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/38031/3b28fb5e-f363-2467-b575-0e08c5869584.png)

Create Log Groupをクリック

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/38031/c7daed90-175b-c00a-f334-0de88b765889.png)

「flow_logs」をLog Group名としてLog Groupを作成

###３．Service Connector Hubの準備

１．Service Connecter Hubサービスの起動
OCI Consoleメニュー > Observability & Management > Logging > Service Connectorsを選択
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/38031/85d1e15d-55ba-db82-a15d-507536de464f.png)

２．Log AnnalyticsがLoggingで収集したデータを利活用するための準備
Create Service Connector > パラメータをセットしてcreateをクリック
主なパラメータ

| 項目 | 値 | 補足 |
|:-|:-|:-|
| - | Connector Name  | (任意：ここではVCN_FLOW_LOG2LA)  |
| Source  | Logging  |   |
| Configure source connection | Log Group / Logs  | 事前設定済みの値を選択  |
| Log Filter Task  | （Filter条件）  |  (option)  |
| Configure Function Task  |   |   (option) |

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/38031/44b85656-8ddd-2f59-6b2d-7a843dc980ac.png)

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/38031/a2ee3de1-ba86-197d-36d9-546e8160459d.png)

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/38031/b3b15430-8579-db60-0c24-5515912d3e03.png)

CreateをクリックしてPolicyを自動生成

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/38031/41efb42d-a5ff-bbcb-c925-1c3d708ce26c.png)

Createをクリック

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/38031/cb365fc8-522b-8b42-bb67-3cdea5d7fb0f.png)

以下のような画面が表示される

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/38031/dfd8002b-e11b-3d43-db9b-4f4b6aac5309.png)


###４．Loggin AnalyticsでLogを分析

#### LA Dashboardの起動

LA / Dashboardsを選択

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/38031/61934ae0-4d86-ffd0-8bdf-4446ce083be0.png)

VCN Flow Logsをクリック

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/38031/e24dd4eb-6d5e-a6a7-0383-3eb8b2c2cfa1.png)

VCN Flow Logsダッシュボードが表示される

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/38031/ce82ef46-0fd1-bd44-5541-614dd9ce5ebe.png)


#### 分析トライアル

##### 例：DBサーバへのアクセスもとの特定

Total Packets In by Destination Portの1521(DB Port)をクリック

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/38031/87137e9a-ca4f-6ec7-181a-e02b535760e2.png)

DBアクセスの詳細を確認

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/38031/68dc3941-bdff-5ff9-8696-b40ecca83521.png)

DBアクセスを一覧表示
Tableの表示 > Source IPの追加

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/38031/18a1d6ea-d6ed-0dda-ec8e-5e04dbb0c81c.png)

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/38031/99d209a6-71b5-02e9-926c-384a4a8d8ce2.png)

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/38031/4116cb73-16ad-771c-63a7-cb5fefb05738.png)

##### 例：Tree Mapをもとにアクセス元とアクセス頻度の確認 → アクセス頻度が高いアクセス元の深堀分析

赤枠のところをクリック

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/38031/66f28d2d-3e5a-2084-c736-98fd5fea5565.png)

クリック後の遷移画面（Log Explorerが表示）

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/38031/db71996a-1d5f-e935-b5f7-cbcfa4e5c8f7.png)

Destination Portごとの通信頻度の確認
→ 443ポートへのアクセスが大半を占めている

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/38031/1fb0efae-a8c8-8fe6-76a4-1e7990520998.png)

Destionリストの一覧を表示

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/38031/a078b0e0-e821-52f1-f146-cf1975ba6450.png)

##### 例：REJECTされた通信をリスト表示する

Log Explorerを選択

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/38031/1af119f2-2d09-7b00-a651-0fff4726ead2.png)

検索条件をクリア
「×」をクリック → 「Run」をクリック

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/38031/6b878588-079d-6728-ce41-0f80d22a0c8e.png)

Actionをフィールドに追加

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/38031/cee556ce-33ae-13c6-7a47-54a132bd1a50.png)

REJECTをクリック（Search条件に追加）

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/38031/36167f03-7117-eea1-72ee-8fc2c9252b2f.png)

REJECT一覧が表示される

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/38031/4a08db1c-f786-5d2a-45ab-97691868a564.png)


※ 検索条件の設定に以下と入力することでも可能

```
'Log Source' = 'OCI VCN Flow Unified Schema Logs' and Action = REJECT 
```


# 参考情報

## Documentation
### Logging
- [Overview](https://docs.oracle.com/en-us/iaas/Content/Logging/Concepts/loggingoverview.htm)
- [Details for VCN Flow Logs](https://docs.oracle.com/en-us/iaas/Content/Logging/Reference/details_for_vcn_flow_logs.htm)
- [VCN Flow Logs Example](https://docs.oracle.com/en-us/iaas/Content/Logging/Task/managinglogs.htm#using_the_cli_loggroups__section_esb_bzh_ymb)
- [Searching Logs](https://docs.oracle.com/en-us/iaas/Content/Logging/Concepts/searchinglogs.htm)

### Service Connector Hub

- [Service Connector Hub Overview](https://docs.oracle.com/en-us/iaas/Content/service-connector-hub/overview.htm)
- [Scenario: Analyze Logs](https://docs.oracle.com/en-us/iaas/Content/service-connector-hub/analyzelogs.htm)

### Logging Analytics
- [Logging Analytics](https://docs.oracle.com/en-us/iaas/logging-analytics/index.html)
- [Perform Logging Analytics Specific Configuration Tasks](https://docs.oracle.com/en-us/iaas/logging-analytics/doc/perform-logging-analytics-specific-configuration-tasks.html#GUID-D1758CFB-861F-420D-B12F-34D1CC5E3E0E)
- [Oracle Cloud Infrastructure Logging Analytics Quick Start Guide](https://docs.oracle.com/en/cloud/paas/logging-analytics/logqs/#before_you_begin)

## API Refernce

- [Logging](https://oracle-cloud-infrastructure-python-sdk.readthedocs.io/en/latest/api/logging.html)
- [Log Analytics](https://oracle-cloud-infrastructure-python-sdk.readthedocs.io/en/latest/api/log_analytics.html)


## Workshop

- [LiveLabs : The Essentials of Cloud Observability](https://swigmaster.github.io/index.html?lab=introduction)

## Blogs

- [公式 : OCI Logging概要](https://oracle-japan.github.io/ocidocs/services/developers/logging-overview/)
- [公式 : Announcing VCN flow logs general availability for Oracle Cloud Infrastructure](https://blogs.oracle.com/cloud-infrastructure/announcing-virtual-cloud-network-flow-logs-general-availability-for-oracle-cloud-infrastructure)
- [公式 : How to Ingest OCI VCN Flow Logs into OCI Logging Analytics](https://blogs.oracle.com/managementcloud/how-to-ingest-oci-vcn-flow-logs-into-oci-logging-analytics)
- [公式 : Announcing integration of Service Connector Hub with Logging Analytics](https://blogs.oracle.com/cloud-infrastructure/announcing-integration-of-service-connector-hub-with-logging-analytics)
- [[OCI Logging] Oracle cloud の Flow log の新機能を検証する](https://qiita.com/nemo-kaz/items/554bc0bc7ce2a61a97c7)

## Webiner

- [Demo: Logging and Logging Analytics services](https://www.youtube.com/watch?v=Ln8cgJR3TfA)
- [Ingest, Analyze, and Manage Your Logs with OCI Logging by Mohamed Sleem](https://www.youtube.com/watch?v=ED2AbHESD5k)