---
name: vpc-fl-ordering
title: Creating a flow log collector
description: You can order and provision a flow log collector for a specific Virtual Private Cloud (VPC), subnet, instance, or interface. Before you begin, make sure that you review the use cases that are listed in About flow logs and satisfy the following prerequisites.
last-updated: 2026-04-16
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/vpc?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# Creating a flow log collector
{: #ordering-flow-log-collector}
{: help}
{: support}

You can order and provision a flow log collector for a specific Virtual Private Cloud (VPC), subnet, instance, or interface. Before you begin, make sure that you review the use cases that are listed in [About flow logs](https://cloud.ibm.com/docs/vpc?topic=vpc-flow-logs&format=markdown) and satisfy the following prerequisites.

When you are provisioning a flow log collector, keep in mind that [the finest granularity wins](https://cloud.ibm.com/docs/vpc?topic=vpc-flow-logs&format=markdown#flow-logs-granularity-wins).
{: tip}

## Prerequisites in the console
{: #fl-before-you-begin-ui}
{: ui}

Before you create a flow log collector, make sure that you meet the following prerequisites:

1. Make sure that at least one VPC, a subnet, and a virtual server instance exist. For instructions, see [Creating a VPC and subnet](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-a-vpc-using-the-ibm-cloud-console&format=markdown#creating-a-vpc-and-subnet) and [Creating a virtual server instance](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-a-vpc-using-the-ibm-cloud-console&format=markdown#creating-a-vsi).
1. Make sure that an IBM Cloud® Object Storage instance with a bucket exists for your flow logs. To create an Object Storage bucket, see the [IBM Cloud Object Storage](https://cloud.ibm.com/objectstorage/create){: external} ordering page.

   The Object Storage bucket must be a single-region bucket in the same region as the target resource. Additionally, it is recommended that you secure the bucket through IAM access groups and audit logging.
   {: important}

1. Authorize resources of type **Flow Logs for VPC** to use the Object Storage instance created in Step 2. {: #iam-authorization}

   To do so, use the following steps:

   * In the IBM Cloud console, click **Manage > Access (IAM)**, then select **Authorizations** from the navigation pane.
   * Click **Create** and complete the following information:

      For Source service:
      * Select **VPC Infrastructure Services**.
      * Select **Resources based on selected attributes**.
      * For Resource type, select **Flow Logs for VPC**.
      * For Source service instance, select **All instances**.

      For Target service:
      * Select **Cloud Object Storage**.
      * Select **Resources based on selected attributes**.
      * For Service instance, select **string equals > All instances**.

      For finer granularity, you can specify whether you want the target to include **Specific resources**. If you chose specific resources as the target, you can add attributes to further scope the access. The type of attributes depends on the target service that you selected. For example, you can [assign access to a specific bucket](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-iam-bucket-permissions&interface=ui&format=markdown) rather than a single instance.
      {: note}

      For Service access, select the **Writer** role to assign access to the source service that accesses the target service.

   * Click **Authorize**.

   For more information, see [Using authorizations to grant access between services](https://cloud.ibm.com/docs/iam?topic=iam-serviceauth&interface=ui&format=markdown).
   {: note}

## Prerequisites from the CLI
{: #fl-before-you-begin-cli}
{: cli}

Before you create a flow log collector, make sure that you meet the following prerequisites:

1. Make sure that at least one VPC, a subnet, and a virtual server instance exist. For instructions, see [Creating a VPC and subnet](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-a-vpc-using-the-ibm-cloud-console&format=markdown#creating-a-vpc-and-subnet) and [Creating a virtual server instance](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-a-vpc-using-the-ibm-cloud-console&format=markdown#creating-a-vsi).
1. Make sure that an IBM Cloud® Object Storage instance with a bucket exists for your flow logs. To create an Object Storage bucket, see the [IBM Cloud Object Storage](https://cloud.ibm.com/objectstorage/create) ordering page.

   The Object Storage bucket must be a single-region bucket in the same region as the target resource. Additionally, it is recommended that you secure the bucket through IAM access groups and audit logging.
   {: important}

1. Authorize resources of type **Flow Logs for VPC** to use the Object Storage instance created in Step 2.

   To do so, enter the following command:

   ```sh
   ibmcloud iam authorization-policy-create is cloud-object-storage Writer --source-resource-type flow-log-collector --target-service-instance-id $COS_INSTANCE_GUID

   ibmcloud iam authorization-policy-create is cloud-object-storage Reader --source-resource-type image --target-service-instance-id $COS_INSTANCE_GUID
   ```
   {: codeblock}

   You can obtain the `COS_INSTANCE_GUID` from the Service credentials section for the Object Storage instance as shown.

   ![Object Storage Service credentials](images/flow-logs-service-credentials.png){: caption="Object Storage Service credentials" caption-side="bottom"}

   For more information, see [Using authorizations to grant access between services](https://cloud.ibm.com/docs/iam?topic=iam-serviceauth&interface=ui&format=markdown#create-auth).
   {: note}

## Prerequisites with the API
{: #fl-before-you-begin-api}
{: api}

Before you create a flow log collector, make sure that you meet the following prerequisites:

1. Make sure that at least one VPC, a subnet, and a virtual server instance exist. For instructions, see [Creating a VPC and subnet](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-a-vpc-using-the-ibm-cloud-console&format=markdown#creating-a-vpc-and-subnet) and [Creating a virtual server instance](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-a-vpc-using-the-ibm-cloud-console&format=markdown#creating-a-vsi).
1. Make sure that an IBM Cloud® Object Storage instance with a bucket exists for your flow logs. To create an Object Storage bucket, see the [IBM Cloud Object Storage](https://cloud.ibm.com/objectstorage/create){: external} ordering page.

   The Object Storage bucket must be a single-region bucket in the same region as the target resource. Additionally, it is recommended that you secure the bucket through IAM access groups and audit logging.
   {: important}

1. Authorize resources of type **Flow Logs for VPC** to use the Object Storage instance created in Step 2.

   To do so, use the following steps:

   * In the IBM Cloud console, click **Manage > Access (IAM)**, then select **Authorizations** from the navigation pane.
   * Click **Create** and complete the following information:

      For Source service:

      * Select **VPC Infrastructure Services**.
      * Select **Resources based on selected attributes**.
      * For Resource type, select **Flow Logs for VPC**.
      * For Source service instance, select **All instances**.

      For Target service:
      * Select **Cloud Object Storage**.
      * Select **Resources based on selected attributes**.
      * For Service instance, select **string equals > All instances**.

      For Service access, select the **Writer** role to assign access to the source service that accesses the target service.

   * Click **Authorize**.

   For more information, see [Using authorizations to grant access between services](https://cloud.ibm.com/docs/iam?topic=iam-serviceauth&interface=ui&format=markdown#create-auth).
   {: note}

## Creating a flow log collector in the console
{: #fl-ordering-ui}
{: ui}

To create a flow log collector by using the IBM Cloud console, follow these steps:

1. Go to the [IBM Cloud console](https://cloud.ibm.com/login){: external} and log in to your account.

1. Select the **Navigation menu** ![Menu icon](../icons/icon_hamburger.svg), then click **Infrastructure** ![VPC icon](../../icons/vpc.svg) > **Network** > **Flow Logs**.

   The Flow logs for VPC dashboard appears.

1. Click **Create** to go to the flow logs provisioning page.
1. Enter values for the following fields:

   * **Name** - Type a unique name for your flow log collector.
   * **Resource group** - Select a resource group for your flow log collector. You can use the default group for this flow log, or choose from the list (if defined). For more information, see [Best practices for organizing resources in a resource group](https://cloud.ibm.com/docs/account?topic=account-account_setup&format=markdown).
   * **Tags** - Optionally, add tags to organize, track usage costs, or manage access to your resources.
   * **Access management tags** - Optionally, add access management tags to resources to help organize access control relationships. The only supported format for access management tags is `key:value`. For more information, see [Controlling access to resources by using tags](https://cloud.ibm.com/docs/account?topic=account-access-tags-tutorial&format=markdown).

1. For **Collector details**, choose a target service for the flow log. Depending on your selection, additional fields might be required.

   * **Virtual private cloud** - Select a VPC. All network traffic within the selected VPC is logged.
   * **Subnet** -  Select a VPC and a subnet within the selected VPC. All traffic within the selected subnet is logged.
   * **Instance** - Select a VPC and a virtual server instance that exists within the selected VPC. All traffic for the virtual server instance is logged.
   * **Interface** - Select a VPC, a virtual server instance within the selected VPC, and a specific network interface for the selected virtual server instance. All traffic for the selected network interface is logged.
   * **Unattached virtual network interface** - Specify the ID of an unattached virtual network interface. This is useful to create a dedicated and isolated logging path that can be attached to a log collection service when ready.

1. Specify where the logs are stored. Flow logs are written to an Object Storage bucket, which must be created as a single-region bucket in the same region as the target resource.

   * **Cloud Object Storage instances** - The Object Storage instance that the wanted bucket resides in.
   * **Location** - This input is unavailable because it is directly tied to the region the target resource resides in.
   * **Bucket** - The wanted IBM Cloud® Object Storage bucket that the flow log collector service writes to.

## Creating a flow log collector from the CLI
{: #fl-ordering-cli}
{: cli}

Before you begin, [set up your CLI environment](https://cloud.ibm.com/docs/vpc?topic=vpc-set-up-environment&interface=cli&format=markdown).

To create a flow log collector by using the CLI, run the following command:

```sh
  ibmcloud is flow-log-create \
    --bucket STORAGE_BUCKET_NAME \
    --target TARGET_ID [--name NAME] \
    --active ACTIVE \
    [--resource-group-id RESOURCE_GROUP_ID | --resource-group-name RESOURCE_GROUP_NAME] \
    [--json]
```
{: codeblock}

Where:

`--bucket`
:   Name of the Object Storage bucket.
`--target`
:   Target for the flow log.
`--name`
:   New name for the flow log.
`--active`
:   Indicates whether this collector is active.
`--resource-group-id`
:   ID of the resource group. This option is mutually exclusive with **--resource-group-name**.
`--resource-group-name`
:   Name of the resource group. This option is mutually exclusive with **--resource-group-id**.
`--json`
:   Formats the output in JSON.



## Creating a flow log collector with the API
{: #fl-ordering-api}
{: api}

To create a flow log collector by using the API, follow these steps:

1. Set up your [API environment](https://cloud.ibm.com/docs/vpc?topic=vpc-set-up-environment&format=markdown#api-prerequisites-setup) with the right variables.
1. Store the following values in variables to be used in the API command:

   * `ResourceGroupId` - First, get your resource group and then populate the variable:

    ```sh
    export ResourceGroupId=<your_resourcegroup_id>
    ```
    {: pre}

   * `VpcId` - Find by using the **list vpc** command (with the preceding variables) and then populate the variable based on the provided ID:

    ```sh
    export VpcId=<your_VPC_id>
    ```
    {: pre}

   * `COSbucket` - The name of the Object Storage bucket.

    ```sh
    export COSbucket=<your_COS_bucket_name>
    ```
    {: pre}

1. When all variables are initiated, provision a flow log collector for the specific VPC:

   ```sh
   curl -X POST
     -sH "Authorization:${iam_token}"
     "$vpc_api_endpoint/v1/flow_log_collectors?version=$api_version&generation=2" \
     -d  '{ \
          "name": "flow-logs-1", \
          "resource_group": { "id": "'$ResourceGroupId'"  }, \
          "storage_bucket": { "name": "'$COSbucket'" }, \
          "target": { "id": "'$VpcId'" } \
          }' | jq
   ```
   {: pre}

   The example uses `jq` as a parser, a third-party tool licensed under the [MIT license](https://stedolan.github.io/jq/download/). `jq` might not come preinstalled on all VPC images available when you create an instance. You might need to install `jq` before use or use another parser of your choice.
   {: note}

1. To provision a collector that targets a subnet, virtual server instance, or VNIC, you must provide a subnet ID, virtual server instance ID, or VNIC ID as a collector target. For example, the following request creates a collector that targets a virtual server instance ID:

   ```sh
   export VsiId=<your_vsi_id>
   ```
   {: pre}

   ```sh
   curl -X POST \
     -sH "Authorization:${iam_token}" \
     "$vpc_api_endpoint/v1/flow_log_collectors?version=$api_version&generation=2" \
     -d '{ \
      	 "name": "flow-logs-1", \
         "resource_group": { "id": "'$ResourceGroupId'"  }, \
         "storage_bucket": { "name": "'$COSbucket'" }, \
         "target": { "id": "'$VsiId'" } \
         }' | jq
   ```
   {: codeblock}

## Next steps
{: #fl-next-steps}

* [Viewing flow log objects](https://cloud.ibm.com/docs/vpc?topic=vpc-fl-analyze&format=markdown)
* Working with flow logs
   * [Managing access for flow logs](https://cloud.ibm.com/docs/vpc?topic=vpc-fl-iam&format=markdown)
   * [Listing flow log collectors](https://cloud.ibm.com/docs/vpc?topic=vpc-listing-all-flow-log-collectors&format=markdown)
   * [Suspending and resuming a flow log collector](https://cloud.ibm.com/docs/vpc?topic=vpc-managing-flow-log-collectors_activate&format=markdown)
   * [Deleting a flow log collector](https://cloud.ibm.com/docs/vpc?topic=vpc-deleting-a-flow-log-collector&format=markdown)