---
sourceDocument: Yokohama IT Operations Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/yokohama/it-operations-management

 Release :

    - yokohama

ft:locale :

    - en-US

ft:publication_title :

    - Yokohama IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Configure data collection using VPC Flow Logs

# Configure data collection using VPC Flow Logs {#ariaid-title1}

* Release version: Yokohama
* 
* Updated January 30, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read

Enable Service Mapping to
perform discovery based on data collected using Virtual Private Cloud (VPC) logs. This
method is relevant for organizations using Amazon Web Services (AWS).

## Before you begin

Verify that credentials for the AWS account are configured in the Credentials module
of the platform by navigating to Service MappingCredentialsAWS Credentials. For more information about AWS credentials, see [Cloud
credentials](https://www.servicenow.com/docs/access?context=r_CloudManagementCredentialsForm&version=yokohama&pubname=yokohama-platform-security&ft:locale=en-US).

Role required: admin or service_mapping_admin

## About this task

In base systems, which are the default or standard configurations, traffic-based discovery relies solely on TCP-related data collected using the netstat, ss, and lsof commands. Discovery based on Netflow and VPC logs requires additional configuration. You can
enrich your traffic-based discovery by configuring Service Mapping to use VPC Flow
Logs. For more information about the Service Mapping discovery flow
based on VPC Flow logs, see [Data collection and discovery using VPC Flow Logs](https://servicenow-prod.fluidtopics.net/DK_4puB5aelFPZFGyXMZEw "Service Mapping can perform discovery based on data collected using VPC Flow Logs. Amazon VPC hosts Amazon Elastic Compute Cloud (EC2) instances that provide Amazon Web Services. VPC Flow Logs collect data on IP traffic going to and from network interfaces in the VPC.").

Amazon VPC hosts Amazon Elastic Compute Cloud (EC2) instances that provide Amazon Web
Services. VPC flow logs collect data on IP traffic going to and from network
interfaces in the VPC.

Configure the ServiceNow
connector to trigger MID Server
to collect the data from the flow log and processes it. In deployments with multiple
flow log groups, configure a dedicated connector that works with one MID Server for every flow log
group. Multiple flow log groups my use the same AWS credentials.

## Procedure

1. Configure VPC Flow Logs on the Amazon EC2 console as described in the official AWS documentation.
2. Configure Service Mapping to work with VPC Flow Logs:
   1. Navigate to Service MappingAdministrationFlow Connectors.
   2. Click New.
   3. Click AWS VPC flow logs.
   4. On the AWS VPC flow logs page, configure the connector parameters as follows:  
      {#configure-vpc-log-service-mapping__table_xtr_yyk_xy__entry__2}

      | Field | Description |
      |-|-|
      | Name | A descriptive name for the connector. |
      | Group name | The name of the central flow log group to which Amazon EC2 instances forward their log streams. |
      | MID Server | The MID Server that Service Mapping uses to collect the data from the flow log group on AWS. |
      | AWS Credentials | Select AWS credentials relevant for the account for which you want to collect flow logs. |
      [ ]

      {#configure-vpc-log-service-mapping__table_xtr_yyk_xy}
   5. Click Submit.
   {#configure-vpc-log-service-mapping__substeps_ytm_sjm_xy}
3. Verify that Service Mapping collects data using VPC Flow Logs:
   1. On the AWS VPC flow logs form, select the newly configured connector and click Run now to start the data collection flow and populate the Flow Connection \[sa_flow_connection\] table.
   2. Navigate to System DefinitionsTables.
   3. Click the Flow Connection \[sa_flow_connection\] table.
   4. Under Related Links, click Show List.
   5. Verify that the table contains data.
   {#configure-vpc-log-service-mapping__substeps_pnp_4wg_1z}

*[\>]: and then