Feature Overview

After a domain name is connected to CDN, a user's resource request will be scheduled to a CDN node for response. If the node has the resource cached, it will directly return the resource content; otherwise, it will pass through the request to the origin server to pull the requested resource.

As CDN nodes respond to most user requests, to help you analyze user access, CDN packages access logs of the entire network at an hourly granularity and retains them for 30 days by default. These logs can also be downloaded.

Currently, only node access logs are provided.

Use Cases

Access behavior analysis

You can download access logs and analyze popular resources and active users.

Service quality monitoring

By downloading access logs, you can stay on top of the service status of all CDN nodes and calculate the average response time, average download speed, and other metrics.

Directions

How to use

Log in to the CDN Console, click Log Service on the left sidebar, and select a domain name and time range to query access logs. You can select multiple log packages and download them in batches:

• The access logs are packaged by hour by default. If there is no request to the domain name for the hour, no log package will be generated for this hour.
• Overseas access logs and Mainland China access logs of the same domain name are packaged separately. Log packages are named in the format of "time-domain name-acceleration region".
• The access logs are collected from each CDN cache node, so the delay may vary. Generally, log packages can be queried and downloaded after about 30 minutes. Log packages will be added continuously and will stabilize after 2–3 hours.
• The access log packages of a domain name are retained for 30 days. You can use an SCF function to transfer the log packages to COS as instructed here for permanent storage.

Fields

The fields (from left to right) in the logs are listed as below:

Region/ISP mappings

Mainland China provinces

Mainland China ISPs

Regions outside Mainland China

ISPs outside Mainland China

Precautions

The traffic/bandwidth data calculated based on the number of bytes recorded in the fifth field of an access log is different from the billable CDN traffic/bandwidth data for the following reason:

• Only application-layer data can be recorded in access logs. The traffic generated during actual data transfer over the network is around 5–15% more than application-layer traffic, including the following two parts:
  • Consumption by TCP/IP headers: in TCP/IP-based HTTP requests, each packet has a maximum size of 1,500 bytes. This includes TCP and IP headers which accounts for 40 bytes and generate traffic during transfer but cannot be counted by the application layer. The overhead of this part is around 3%.
  • TCP retransmission: during normal data transfer over the network, around 3–10% packets are lost on the internet, and the server will re-transmit the lost parts. This traffic cannot be counted by the application layer, which accounts for 3–7% of the total traffic.
• As an industry standard, the billable traffic is the sum of the application-layer traffic and the overheads as described above. Tencent Cloud CDN takes 10% as the overheads proportion, so the monitored traffic is around 110% of the logged traffic.

Use Cases

Sample Mainland China access log

Sample overseas access log