Virtual Network Flow logs for Azure SQL Managed Instance Virtual Network.,

Justin_MSCloud 45

After enabling the Virtual Network Flow logs for Azure SQL Managed Instance integrated Virtual Network., the flow logs are not getting captured in Storage account.

Sai Prasanna Sinde 2,680 Reputation points Microsoft Vendor

2024-11-15T09:16:13.9666667+00:00
Hi @Justin_MSCloud,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

We understand that even after enabling the Virtual Network Flow logs for Azure SQL Managed Instance integrated Virtual Network, the flow logs are not getting captured in Storage account and is causing issues.

Considerations for virtual network flow logs:

Storage account:

Location:

The storage account must be in the same region as the virtual network.

Subscription:

The storage account must be in the same subscription of the virtual network.

If the storage account is in a different subscription, the resource that you're logging (virtual network, subnet, or network interface) and the storage account must be associated with the same Microsoft Entra tenant. The account you use for each subscription must have the necessary permissions.

Performance tier:

The storage account must be standard. Premium storage accounts aren't supported.

Self-managed key rotation:

If you change or rotate the access keys to your storage account, virtual network flow logs stop working. To fix this problem, you must disable and then re-enable virtual network flow logs.

Reference: https://learn.microsoft.com/en-us/azure/network-watcher/vnet-flow-logs-overview#considerations-for-virtual-network-flow-logs

Flow Logs Configuration:

Please verify that you have correctly enabled the Virtual Network Flow logs on the specific Virtual Network you want to monitor.

Please check whether you have correctly configured Network Watcher to capture flow logs for the virtual network. Double-check the settings in the Azure Network Watcher for the virtual network and subnet where your SQL Managed Instance resides.

Reference: https://learn.microsoft.com/en-us/azure/network-watcher/vnet-flow-logs-portal#enable-a-flow-log

Microsoft.Insights provider must be registered to successfully log traffic flowing through a virtual network. If you aren't sure if the Microsoft.Insights provider is registered, check its status in the Azure portal by following the below document.

Reference: https://learn.microsoft.com/en-us/azure/network-watcher/vnet-flow-logs-portal#prerequisites

Please verify if virtual network flow logs are properly configured or not.

Reference: https://learn.microsoft.com/en-us/azure/network-watcher/vnet-flow-logs-portal#create-a-flow-log

Private Endpoint Traffic:

If you are trying to capture traffic to a private endpoint, note that traffic cannot be recorded at the private endpoint itself. Instead, you should capture traffic at the source VM.

The traffic is recorded with source IP address of the VM and destination IP address of the private endpoint. You can use PrivateEndpointResourceId field to identify traffic flowing to a private endpoint.

Verify the VNet Integration:

Please make sure that your Azure SQL Managed Instance is correctly integrated with the virtual network and that it is associated with a subnet. The subnet should be properly configured for monitoring.

Check the Log Retention Policy:

Logs are collected at one-minute intervals through the Azure platform.

Check the log retention settings in the Storage Account. If the retention is set too short or if it’s not configured correctly, older logs might not be visible.

NOTE: Retention time for the logs is only available with Standard general-purpose v2 storage accounts.

Check NSG Rules:

All traffic flows in your network are evaluated through the applicable network security group rules or Azure Virtual Network Manager security admin rules.

Please check if any of the NSG rules configured are blocking the traffic.

Reference: https://learn.microsoft.com/en-us/azure/network-watcher/vnet-flow-logs-overview#how-logging-works

Kindly let us know if the above helps or you need further assistance on this issue.

If this answers your query, please do click **Accept Answer** and 'Upvote' so that other community members facing the same issues can find the right answers. And, if you have any further query do let us know. We are pleased to assist you.

Regards,

Sai prasanna.
Justin_MSCloud 45 Reputation points

2024-11-15T15:27:31.4233333+00:00
Verify the VNet Integration:

Please make sure that your Azure SQL Managed Instance is correctly integrated with the virtual network and that it is associated with a subnet. The subnet should be properly configured for monitoring.

All the mentioned settings are properly set but still the flow logs are not captured.
Not sure if the Virtual Network flow logs are not supported for SQL Managed Instance VNet.
Sai Prasanna Sinde 2,680 Reputation points Microsoft Vendor

2024-11-18T05:29:57.49+00:00

Hi @Justin_MSCloud,

We appreciate your feedback and apologize for not providing a satisfactory answer to your query earlier.

Please attempt to deploy a virtual machine (VM) and verify whether the traffic is successfully passing through and check if the flow logs are being captured for the VM. If this process works for the VM but not for the SQL instance, then issue is with SQL Managed Instance.

Kindly let us after testing with a VM to confirm if the flow logs are being captured.

Thanks,

Sai.
Justin_MSCloud 45 Reputation points

2024-11-18T14:08:26.4566667+00:00

Yes VNet Flow logs are getting captured for VM's it only the Azure managed instances VNet that are not capture. Is the VNet flow logs for Azure SQL managed instance Vnet supported?
Sai Prasanna Sinde 2,680 Reputation points Microsoft Vendor

2024-11-20T03:41:40.96+00:00

Hi @Justin_MSCloud,

Thanks for getting back.

As the issue is only with Azure SQL managed instances, we will check with the product team to determine if this is expected behavior and will provide you with an update as soon as possible.

Regards,

Sai.

Accepted answer

Sai Prasanna Sinde 2,680 Reputation points Microsoft Vendor

2024-11-21T10:01:58.0433333+00:00

Hi @Justin_MSCloud,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

Thank you for your patience.

The product team has informed us that 'Flow log capture at "Azure SQL Managed Instance" is not supported. We can only capture flow logs at VMs/VMSS instances.'

Currently, we don’t have support of these below mentioned PAAS services that are integrated into vnet using Subnet delegation just like NSG flow logs.

https://learn.microsoft.com/en-us/azure/network-watcher/nsg-flow-logs-overview#incompatible-services

This information related to 'Vnet flow logs' will be updated in the public documentation soon.

If the above mentioned is unclear, please add a comment below so that we can assist you with the issue.

Please don’t forget to close the thread by clicking "Accept the answer" and 'Upvote' if the information provided helps you, as this can be beneficial to other community members facing the same issues.

Thanks,

Sai Prasanna.
Please sign in to rate this answer.
Justin_MSCloud 45 Reputation points

2024-11-21T17:07:01.7266667+00:00

Thank you for the update.
So is it only the VNet Flow logs is not supported for the SQL Managed Instance and NSG Flow logs is supported for the SQL Managed Instance.
Previously we enabled NSG Flow logs for the NSG that is associated to the SQL Managed Instance and logs were getting captured to the storage account.

Sai Prasanna Sinde 2,680 Reputation points Microsoft Vendor

2024-11-22T02:00:05.43+00:00

Hi @Justin_MSCloud,

Yes, your understanding is correct.

For VNet flow logs, 'Flow log capture at "Azure SQL Managed Instance" is not supported. We can only capture flow logs at VMs/VMSS instances.'

For NSG flow logs, the only Incompatible services are mentioned below:

Currently, these Azure services don't support NSG flow logs.

Azure Container Instances

Azure Logic Apps

Azure Functions

Azure DNS Private Resolver

App Service

Azure Database for MariaDB

Azure Database for MySQL

Azure Database for PostgreSQL

NSG's associated to Application gateway v2

App services deployed under an Azure App Service plan

Hope this clarifies!

If above is unclear and/or you are unsure about something, add a comment below.

Please don’t forget to close the thread by clicking "Accept the answer" if the information provided helps you, as this can be beneficial to other community members.

Thanks,

Sai Prasanna.

Justin_MSCloud 45 Reputation points

2024-11-22T20:24:54.9833333+00:00

Thank you for the update, Is there a list of services that is not supported for the VNet flow logs like the incompatible services list which is available for the NSG Flow logs.

Sai Prasanna Sinde 2,680 Reputation points Microsoft Vendor

2024-11-25T02:24:45.85+00:00

Hi @Justin_MSCloud,

Greetings!

We appreciate your patience.

As of now, we got an update from product team that for VNet flow logs, 'Flow log capture at "Azure SQL Managed Instance" is not supported. We can only capture flow logs at VMs/VMSS instances.'

We don’t have support of PAAS services that are integrated into vnet using Subnet delegation.

Additionally, the list of incompatible services mentioned earlier for NSG flow logs currently applies to VNet flow logs as well.

These details regarding 'Vnet flow logs' will soon be included in the public documentation.

Hope this clarifies!

If above is unclear and/or you are unsure about something, add a comment below.

Please don’t forget to close the thread by clicking "Accept the answer" if the information provided helps you, as this can be beneficial to other community members.

Thanks,

Sai Prasanna.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Virtual Network Flow logs for Azure SQL Managed Instance Virtual Network.,

0 additional answers

Your answer