# Azure Flow Log on a Gateway Subnet | ZopNight

> A flow log on a gateway subnet whose network is already recorded at the virtual network level pays to collect the same flows twice.

Source: https://zop.dev/zopnight/rules/azure-flow-log-on-a-gateway-subnet

---

_Orphaned resources · Medium severity_

## Azure Flow Log on a Gateway Subnet

A flow log on a gateway subnet whose network is already recorded at the virtual network level pays to collect the same flows twice.

- Azure — provider
- Medium — severity
- Savings — where it shows up
- Manual — fix, change spelled out

Free to start. No card. The playground just needs your work email.

## Found, explained, handed over.

Findings with a dollar figure attached, idle, oversized, orphaned, unscheduled and undiscounted spend.

- 01. Detect — ZopNight checks this automatically across Azure, with read-only access to the account.
- 02. Explain — Every finding says exactly what to change: Delete the gateway-subnet flow log. Where the saving can be proven it is priced; where it cannot, the finding says so.
- 03. Fix — The finding opens with the change already spelled out, so the fix is one ticket, not an investigation.

- applies_to_fallback: Any resource in the account
- where_it_appears: The Savings tab of Recommendations, with every affected resource listed.

## Related

- [Azure Duplicate Flow Logging](https://zop.dev/zopnight/rules/azure-duplicate-flow-logging)
- [Azure NSG Flow Logs Past End-of-Life](https://zop.dev/zopnight/rules/azure-nsg-flow-logs-past-end-of-life)
- [Azure Traffic Analytics on the 10-Minute Interval](https://zop.dev/zopnight/rules/azure-traffic-analytics-on-the-10-minute-interval)
- [Azure Connection Monitor with No Surviving Source](https://zop.dev/zopnight/rules/azure-connection-monitor-with-no-surviving-source)
- [Azure Recovery Vault Orphan](https://zop.dev/zopnight/rules/azure-recovery-vault-orphan)
- [Bedrock Custom Model Orphan](https://zop.dev/zopnight/rules/bedrock-custom-model-orphan)

## See the orphaned resources in your account.

Connect a read-only role and the first pass runs on your own estate. This check, and the rest of the catalogue, with it.

[object Object]