Records over time of traffic that NSGs allowed or denied. New ones have been blocked since 30 June 2025, VNet flow logs replace them, and they retire entirely on 30 September 2027.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains NSG flow logs in context, with comparison tables and the common traps.
Terms in this definition
- OVER
Gives a T-SQL window function its window: PARTITION BY, ORDER BY and, if wanted, a ROWS or RANGE frame. Rankings and running totals can then be worked out while every row is kept.
- Virtual network flow logs
Replacing NSG flow logs, these Network Watcher logs are switched on at the VNet and capture traffic per flow rather than per packet, storing it in a storage account for Traffic Analytics to use.
- Retire
Strips corporate data, managed apps and MDM profiles from a device while keeping personal data, which is the key difference from a Wipe in Intune.
Related terms
- Flow log version 2
Adds flow state plus bytes and packets in each direction to NSG flow logs. Begin (B) entries have no counts, whereas continuing (C) and end (E) entries cover traffic since the last tuple, so totals are the sum of all C and E entries.
- NSG diagnostic logging
Turned on via a diagnostic setting attached to the NSG, it emits two categories, NetworkSecurityGroupRuleCounter and NetworkSecurityGroupEvent. NSG flow logs are a different feature.