A company is using VPC Flow Logs to analyze traffic patterns. They need to reduce the volume of logs by approximately 75% while still capturing representative data for troubleshooting. What is the most effective configuration change?
Trap 1: Export logs only to BigQuery instead of Stackdriver
Export destination does not reduce volume; it just moves data.
Trap 2: Filter logs to only include traffic on port 80
This removes potentially important data.
Trap 3: Set the sampling rate to 0.25
Reducing sampling from 0.5 to 0.25 cuts log volume by half, achieving ~75% reduction from original.
- A
Export logs only to BigQuery instead of Stackdriver
Why wrong: Export destination does not reduce volume; it just moves data.
- B
Filter logs to only include traffic on port 80
Why wrong: This removes potentially important data.
- C
Disable VPC Flow Logs on subnets with low traffic
This would reduce volume but may miss critical flows.
- D
Set the sampling rate to 0.25
Why wrong: Reducing sampling from 0.5 to 0.25 cuts log volume by half, achieving ~75% reduction from original.