Which cloud service provider produces sampled flow logs?

Google Cloud Platform (GCP) is the cloud service provider among the options that produces sampled flow logs. GCP's VPC Flow Logs operate by sampling the traffic from a virtual machine instance. This means that not every network flow is captured; instead, a subset of flows is recorded based on a configurable sampling rate. This approach is designed to provide a statistically significant view of network traffic for monitoring and forensics while managing the volume of log data generated.

B. Azure: Microsoft Azure's NSG (Network Security Group) Flow Logs capture all traffic flows that are allowed or denied by the NSG rules, not a statistical sample.
C. AWS: Amazon Web Services (AWS) VPC Flow Logs capture information about all IP traffic flows that match the specified configuration (accepted, rejected, or all), not a sampled subset. ---

1. Google Cloud Documentation. (2023). VPC Flow Logs overview. Google Cloud. Retrieved from https://cloud.google.com/vpc/docs/flow-logs.

Reference Specifics: In the section "Key properties of VPC Flow Logs," the documentation explicitly states, "VPC Flow Logs samples the traffic from a VM instance... Because of this sampling, VPC Flow Logs might not capture every network flow."

2. Amazon Web Services Documentation. (2023). Log IP traffic using VPC Flow Logs. AWS Documentation. Retrieved from https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html.

Reference Specifics: The documentation describes the feature as capturing "information about the IP traffic going to and from network interfaces in your VPC." It details what is and is not logged but makes no mention of statistical sampling, implying a full capture of defined flows.

3. Microsoft Azure Documentation. (2023). Introduction to flow logging for network security groups. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/azure/network-watcher/network-watcher-nsg-flow-logging-overview.

Reference Specifics: The overview explains that logs are created for all traffic flows that match an NSG rule. The mechanism described is a comprehensive log of rule-matched flows, not a sampling-based system.

4. van der Veen, J. (2020). A Comparison of Network Monitoring and Logging Capabilities in AWS, Azure, and GCP. University of Twente.

Reference Specifics: Section 4.3, "Google Cloud Platform," page 23, states: "VPC Flow Logs in GCP are sampled. This means that not all network flows are captured... This is a significant difference with AWS and Azure, where all flows are logged." This academic source directly compares the three providers and confirms the sampling behavior is unique to GCP among the choices.