# Ensure subnet has VCN flow logging enabled

- Source: https://support.icompaas.com/support/solutions/articles/a_1790698519476128-ensure-subnet-has-vcn-flow-logging-enabled
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Oracle Cloud](https://support.icompaas.com/support/solutions/c_1790697859097233) › [Checks](https://support.icompaas.com/support/solutions/folders/f_1790697878907807)
- Last updated: 2026-09-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure VCN flow logs are enabled for every subnet, either by enabling them for the whole VCN or for each subnet. Flow logs record details about accepted and rejected network traffic, such as source, destination, ports, and protocol, and store them in a Logging service log group.

**Rationale**

Without flow logs, there is no record of which systems talked to each other or what traffic was blocked. This makes it very hard to detect scanning, data exfiltration, or lateral movement, and to investigate incidents afterwards. Flow logs also help troubleshoot security list and network security group rules.

**Impact**

-   Records network traffic metadata for monitoring and investigations
    
-   Helps troubleshoot security rules
    
-   Adds logging storage and ingestion costs
    

**Default Value**

By default, VCN flow logs are not enabled.

**Pre-Requisites**

-   Permission to manage flow logs, log groups, and capture filters
    
-   A log group to store the flow logs (or create one during setup)
    

**Test Plan**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the navigation menu, select Networking, and under Network Command Center select Flow logs.
    
3.  Verify that an active flow log exists for each VCN, or for each subnet.
    
4.  If any subnet is not covered, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the navigation menu, select Networking, and under Network Command Center select Flow logs.
    
3.  Select Enable flow logs, enter a name, and select or create a log group.
    
4.  Select or create a capture filter (for example, 100% sampling of all traffic).
    
5.  Select Next, then add an enablement point: choose Virtual cloud network and select the VCN, or choose Subnet and select the subnet.
    
6.  Review the settings and select Enable flow logs.
    

**Backout Plan**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the navigation menu, select Networking, and under Network Command Center select Flow logs.
    
3.  Select the flow log and disable or delete it.
    

**Reference**

-   [https://docs.oracle.com/en-us/iaas/Content/Network/Tasks/vcn-flow-logs-enable.htm](https://docs.oracle.com/en-us/iaas/Content/Network/Tasks/vcn-flow-logs-enable.htm)
    
-   [https://docs.oracle.com/en-us/iaas/Content/Network/Concepts/vcn-flow-logs.htm](https://docs.oracle.com/en-us/iaas/Content/Network/Concepts/vcn-flow-logs.htm)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.