Notice:

Field value "HTTP/3" for the HTTP protocol identifier (the 14th field in the offline log) in general logs will be in beta from September 13, 2021, which will not affect the CDN console and APIs. Please note that getting log data from offline log packages may require adjustment.

QUIC access has been in beta. For more details, see QUIC.

Features

After a domain name is connected to CDN, all requests will be scheduled to a CDN node. If the requested resource is cached on the node, the resource will be returned directly; otherwise, the request will be passed to the origin server to pull the requested resource.

CDN nodes respond to most of the user requests. To facilitate access analysis, CDN packages access logs of the entire network at an hourly granularity and retains them for 30 days by default. These logs can also be downloaded.

Note：

• Currently origin-pull logs are not provided. Only node access logs are provided.
• ECDN domain name offline logs cannot be queried by regions for now. For more information, see Log Management.

Use Cases

Access behavior analysis

You can download access logs and analyze popular resources and active users.

Service quality monitoring

By downloading access logs, you can stay on top of the service status of all CDN nodes and calculate the average response time, average download speed, and other metrics.

Directions

How to use

Log in to the CDN console, click Log Service on the left sidebar, and select a domain name and time range to query access logs. You can select multiple log packages and download them in batches:

Note：

• The access logs are packaged by hour by default. If there is no request to the domain name for the hour, no log package will be generated for this hour.
• For the same domain name, logs of accesses from within and outside the Chinese mainland are packaged separately. Log packages are named in the format of "[time]-[domain name]-[acceleration region]".
• The access logs are collected from each CDN cache node, so the delay may vary. Generally, the delay for querying and downloading log packages is about 30 minutes. Log packages will be added continuously and will stabilize after around 24 hours.
• The access log packages of a domain name are retained for 30 days. You can use an SCF function to transfer the log packages to COS as instructed in Regularly Storing CDN Logs for permanent storage.

Fields

The fields (from left to right) in the logs are listed as below:

Region/ISP mappings

Chinese mainland provinces

Chinese mainland ISPs

Regions outside the Chinese mainland

ISPs outside the Chinese mainland

Notes

The traffic/bandwidth data calculated based on the number of bytes recorded in the fifth field of an access log is different from the billable CDN traffic/bandwidth data for the following reason:

• Only application-layer data can be recorded in access logs. During actual data transfer, the traffic generated over the network is around 5-15% more than the application-layer traffic, including the following two parts:
  • Consumption by TCP/IP headers: in TCP/IP-based HTTP requests, each packet has a maximum size of 1,500 bytes and includes TCP and IP headers of 40 bytes, which generate traffic during transfer but cannot be counted by the application layer. The overhead of this part is around 3%.
  • TCP retransmission: during normal data transfer over the network, around 3% to 10% of packets are lost on the Internet and retransmitted by the server. This type of traffic, which accounts for 3-7% of the total traffic, cannot be counted at the application layer.
• As an industry standard, the billable traffic is the sum of the application-layer traffic and the overheads described above. Tencent Cloud CDN takes 10% as the overheads proportion, so the monitored traffic is around 110% of the logged traffic.

Examples

Sample log of accesses from within the Chinese mainland

Sample log of accesses from outside the Chinese mainland