Replacing NSG flow logs, these Network Watcher logs are switched on at the VNet and capture traffic per flow rather than per packet, storing it in a storage account for Traffic Analytics to use.
Also called VNet flow logs.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains Virtual network flow logs in context, with comparison tables and the common traps.
Terms in this definition
- NSG flow logs
Records over time of traffic that NSGs allowed or denied. New ones have been blocked since 30 June 2025, VNet flow logs replace them, and they retire entirely on 30 September 2027.
- Network Watcher
Collection of Azure network troubleshooting tools: next hop, IP flow verify, packet capture, Connection Monitor and flow logs, among others.
- VNet
A private network belonging to a single subscription and region and covering all of that region's availability zones. A VM can only use a VNet located in the same region.
- Flow
The unit of work inside a Lakeflow pipeline that takes data from a source, transforms it and lands it in a destination like a streaming table. Streaming flows either append or update, and
CREATE FLOWlets you declare a flow apart from the table it feeds. - Storage account
The top-level resource in Azure Storage, giving a unique namespace for table, queue, file and blob data. Location, performance and kind are set when it is created and cannot change.
- Traffic Analytics
Using NSG or VNet flow logs, this Network Watcher feature reveals traffic patterns and top talkers. Rule evaluation is outside its scope.
Related terms
- NTANetAnalytics
Table in Log Analytics that receives Traffic Analytics output for virtual network flow logs, superseding AzureNetworkAnalytics_CL. Its field names carry no type suffix, for example FlowType.