Question

A network operations team enables VPC Flow Logs delivered to CloudWatch Logs to investigate intermittent connectivity issues reported by an application team. They notice that some flow records take up to 10 minutes to appear, which delays their real-time troubleshooting. The team wants to reduce the delay in seeing new flow records while keeping VPC Flow Logs as the source. What is the most effective action to achieve this?

Accepted Answer

Set the maximum aggregation interval on the flow log to 1 minute instead of 10 minutes.

Answer

Change the flow log destination from CloudWatch Logs to an S3 bucket to speed up delivery.

Answer

Enable a custom flow log format that includes TCP flags to accelerate record processing.

Answer

Increase the CloudWatch Logs retention period so records are indexed faster.