Suspending and resuming a flow log collector

You can suspend and resume a flow log collector by using the UI, the CLI, or the API.

After you create a flow log collector, its default state is Active.

Suspending and resuming a flow log collector in the UI

To suspend an Active flow log collector, click the Actions menu and select Suspend.

Suspending the flow log stops the flow log from writing to the IBM Cloud® Object Storage bucket.

To resume a suspended flow log, select Resume from the Actions menu .

Suspending and resuming a flow log collector from the CLI

Before you begin, set up your CLI environment.

To suspend or resume a flow log collector by using the CLI, you must pass a true or false value to the --active flag on the flow-log-update command.

ibmcloud is flow-log-update FLOW_LOG --active (true|false) [--json]

Where:

FLOW_LOG is the ID of the flow log instance.
--active is the intended active status after the update. Set to true to resume or false to suspend.
--json formats the output in JSON.

Suspending and resuming a flow log collector with the API

To suspend and resume flow log collectors by using the API, follow these steps:

Set up your API environment with the right variables.
Store your FlowLogID01 in a variable to be used in the API command:
```
export FlowLogID01="<your_flow_log_id>"
```

Choose either to suspend or resume a flow log:

To suspend a flow logs collector:

curl -s -X PATCH \
"$vpc_api_endpoint/v1/flow_log_collectors/$FlowLogID01?version=$api_version&generation=2" \
-H "Authorization: $iam_token" \
-d '{ "active": false }' | jq

To resume a flow log collector's operation:

curl -s -X PATCH \
"$vpc_api_endpoint/v1/flow_log_collectors/$FlowLogID01?version=$api_version&generation=2" \
-H "Authorization: $iam_token" \
-d '{ "active": true }' | jq