Feature Overview

The access log feature is used to record access logs of domain names protected by WAF. It allows you to query and download access logs generated in the last 30 days and retain them for up to 180 days. After enabling this feature, you can query and download access logs as needed to meet your security compliance and OPS requirements.

To use the access log feature, you need to purchase the security log service package and enable access log as instructed in Instructions. Only after access log is enabled for a domain name can its access requests be logged by WAF.

Instructions

Enabling access log

Log in to the WAF Console and select Web Application Firewall > Protection Setting on the left sidebar to enter the protection settings page. Select a desired domain name and click Enable Access Log.

Querying access logs

1. Log in to the WAF Console and select Security Overview on the left sidebar to enter the security overview page. Select Access Log > Log Query and select a desired domain name to view its access logs.
   
2. You can click in the top-right corner as shown above. On the "Customize List Field" page, select the fields to be displayed in the list as shown below:
   
3. Query the access logs. You can use multiple keywords separated by carriage return. After entering the keywords of the corresponding fields, click Query to search for logs.
   

   • Access logs can be queried by key-value (kv) pairs where up to 7 keys are supported. In value, you can enter multiple keywords of log data for easier search, which are case-insensitive and separated by separators (default separators include !@#%^&*()-_="', <>/?|;:\n\t\r[]{}).
   • Access log supports fuzzy query. You can use certain fuzzy keywords to query logs as described below:

Log query field description:

Downloading access logs

1. Log in to the WAF Console and select Security Overview on the left sidebar to enter the security overview page. Select Access Log > Log Query and click the download icon in the top-right corner to create a download task.
   

• Only one download task can be created within a certain time period. Please be patient.
• Up to 10,000 logs can be downloaded at a time. If you want to download more logs, you are recommended to download them in multiple batches or contact us for assistance.
• If you select a wildcard domain name (e.g., *.abc.com), logs of all associated subdomain names such as those suffixed with .abc.com will also be downloaded.

2. Click Query Download Task, select the desired download task, and click Download to download the log file to your local file system.
   
   Log file field description: