Question

Your security team enabled VPC Flow Logs on a busy subnet hosting thousands of high-throughput VMs. Cloud Logging costs have risen sharply, but the team still needs enough traffic visibility to investigate occasional connection anomalies. They do not require every packet flow to be captured. What is the most effective way to reduce logging costs while retaining useful diagnostic data?

Accepted Answer

Reduce the flow log sample rate below 1.0 (e.g., 0.1) and optionally add metadata filtering to limit exported fields

Answer

Lower the flow log aggregation interval to 5 seconds so fewer records are generated

Answer

Disable VPC Flow Logs on the subnet and rely on Firewall Rules Logging instead

Answer

Move the VMs to a new subnet in a different region where Flow Log pricing is lower