We have a private Azure network configured with a Virtual Network Gateway where all traffic is passing through. Network Security Groups are not currently used.

I've tried to enable diagnostic logs on a VNG and archive to a storage account, but I don't see logs coming in the storage account blobs.

Do VNG diagnostic logs capture client IPs? How can I log IP addresses of all connections to virtual machines in Azure?

1 Answer 1


You need to enable NSG Flow Logging. Check the article below:


This will give you:

  • Outbound and inbound flows on a per-rule basis
  • The NIC that the flow applies to
  • 5-tuple information about the flow (source/destination IP, source/destination port, protocol)
  • Information about whether traffic was allowed or denied

I believe you need to create and associate the subnet (or individual NIC) to an NSG, even if it only has the default rules - which allows traffic in/out of VPN and within the VNet.

Once you have the logs configured, you can analyse it with Log Analytics (OMS)

  • But we're not using an NSG (see the question), we're using a VNG. Jan 21, 2018 at 21:10
  • And im telling you to enable one even if it doesn't have any non default rules to be able to capture data from the VMs instead. Jan 21, 2018 at 21:13
  • Got it, thanks! I've created a new NSG with the default rules and I'll accept the answer. For some reason, Azure hangs when I drill down in Network Watcher > NSG flow logs > {our NSG}. I'll guess we can follow up on that with MS support. Jan 21, 2018 at 22:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .