Question

An application team reports intermittent connection resets between two VM tiers in the same subnet. You suspect asymmetric traffic or dropped flows, but the existing VPC Flow Logs configuration on the subnet uses a 0.5 (50%) sampling rate with a 5-second aggregation interval and default metadata. You need to capture the most complete, granular record of individual flows during a scheduled 30-minute reproduction window while minimizing changes elsewhere. What should you do?

Accepted Answer

Temporarily reconfigure VPC Flow Logs on the subnet to a 1.0 (100%) sampling rate with a 5-second aggregation interval and include all metadata, then analyze the logs during the window.

Answer

Temporarily reconfigure VPC Flow Logs on the subnet to a 1.0 (100%) sampling rate and a 30-second aggregation interval, then export logs to BigQuery for analysis.

Answer

Enable Firewall Rules Logging on the relevant rules and rely on those logs instead, since flow logs cannot show dropped packets.

Answer

Leave the 0.5 sampling rate unchanged and increase the aggregation interval to 10 minutes so fewer, larger flow records are produced for easier review.