This document describes how to use the log analysis feature of AI Agent Security Gateway to search and analyze security logs and access logs.
Background Information
AI Agent Security Gateway provides two types of logs: Security Log and Access Log, helping you understand the security protection and request status during calls to LLM applications and MCP services.
Security log: record the alarm and interception records generated when requests such as LLM calls and MCP service calls hit security protection rules (such as prompt injection, sensitive content, and unauthorized access), including information such as rule names, attack types, executed actions, and risk levels.
Access log: record the details of every request to LLM applications and MCP services, including information such as request sources, called models or tools, request paths, and response status, for call auditing and Behavior Analytics.
AI Agent Security Gateway supports log analysis on security logs and access logs, including operations such as search, filtering, and statistical charts.
2. Set the time range to search, and click Affirm.
3. Both types of logs can be filtered by the following dimensions:
Interactive Mode: search logs based on the search criteria.
a. Switch the search mode to Interactive Mode.
b. Click Add Search Conditions, select a log field and set the logical relationship, and then click OK. For details about log fields, see Log Field Description.
c. Repeat the previous step until all search conditions are added.
Statement Mode: search logs based on the search statement.
a. Switch the search mode to Statement Mode.
b. You can write query statements in the following ways:
Enter the search statement directly in the statement box. For syntax details, see Syntax Rules.
After searching logs, you can analyze the search results.
Original Log
1. After completing Log Search, select the Original Log tab.
2. Above the raw log list, you can view the total number of logs that match the current search conditions and their time distribution. You can also switch the log display style through the settings bar below.
3. On the left side of the log data list, click a field name. The system will sort by the number of logs of that field and display the TOP 5 field values and their percentages, helping you quickly understand the log distribution.
4. In the log list, click
on the left side of a log entry to view structured field details. Click JSON to view the complete fields in JSON format. For field descriptions, see Log Field Description.
Statistical Chart
1. After completing Log Search, select the Statistical Chart tab.
2. When generating a chart, you can choose one of the following two methods:
Interactive Mode: Click Add Statistical Statement, configure metrics, dimensions, sorting, statistical method, and maximum number of results, and then click OK to generate the chart.
Statement mode:
Click Statement Template, and select and use a statement from an existing template.
Enter the search statement directly in the statement box. For syntax details, see Syntax Rules.
Click Chart Recommendation, select the desired statement from Style Recommendation or Statement Recommendation, and then click OK.
3. After the chart is generated, you can modify the chart type in Chart Configuration, or use the styles and statement templates provided by Chart Recommendation to quickly optimize the display.
Appendix
Log Field Description
Security Log Fields
Field Name
Field Description
Example Value
action
Execution action, such as interception, release, and other security handling actions.
Block
agentAppID
Agent application ID, used to locate specific customer applications/Agent instances.
app-example
agentType
Agent type. Currently, it supports identifying Agent types such as WorkBuddy.
WorkBuddy
agentUser
User ID using the Agent. Currently, it supports identifying WorkBuddy user IDs.
xxx-xxx
alarmMsg
Violating content detected after a hit, including only the violating segments matched by detection and excluding other content in the request/response body.
-
mcpToolName
MCP tool name, used to locate the tool call that triggers security detection.
get_weather
realIP
Source IP address of the request, used for troubleshooting, tracing, and security analysis.
1.1.1.1
riskLevel
Risk level, such as high, medium, and low, used to determine the severity of an alarm.
Highly risky
ruleID
ID of the matched detection rule, used to locate specific security rules.
10000244
ruleName
Name of the matched detection rule, such as TMS detection, used to identify the rule type.
TMS detection
serverID
Service or instance ID, used to locate backend service/gateway instances.
server-example
type
Log or detection type, used to distinguish security log categories.
Content security
xRioSeq
Request trace ID, used to correlate logs within the same request trace.
xrio-xxxx-yyyy
Access Log Fields
Field Name
Field Description
Example Value
@timestamp
Log collection time or event time, used for log search and sorting.
2025-06-23T11:55:42+08:00
appID
Customer application or account ID, used to locate customer accounts/applications.
app-example
authorization
Authentication/authorization field, stored and displayed in a masked format.
Bearer ****
backServerAddress
Backend server address, used to locate the request forwarding backend; if empty, this field is not involved.
10.0.0.1
duration
Request duration, used for performance troubleshooting.
320
errorInfo
Error information, used to locate the cause of request failures or exceptions.
-
forwardedFor
Original IP address chain forwarded by the proxy, used to identify the real client source; may contain IP addresses.
1.1.1.1, 2.2.2.2
host
Request Host, used to locate the access domain; if empty, no specific Host is involved.
api.example.com
instanceID
Instance ID, used to locate gateway/service instances.
gw-example
method
HTTP request method, such as GET/POST.
POST
methodName
Method name, used to locate the called method; if empty, no specific method is involved.
chat.completions
orgHost
Original request domain, used to locate the domain accessed by customers.
api.example.com
orgPathName
Original request path, used to locate the gateway/MCP path accessed by customers.
/v1/chat/completions
orgUrl
Original request URL, used to locate the customer access path.
https://api.example.com/v1/chat/completions
path
Actual request path, used to locate gateway routes.
/v1/chat/completions
port
Port number, used to locate the access port.
443
referer
Request source page or referrer address, used to determine the request source.
https://console.example.com
remoteAddress
Client IP address, used to locate the request source.
1.1.1.1
requestTime
Request time, used to locate when the request occurred.
2025-06-23T11:55:42+08:00
requestTimestamp
Request timestamp, used to locate when the request occurred.
1719114942
reqLength
Request length, used to troubleshoot issues such as request size and abnormal requests.
1024
resLength
Response length, used to troubleshoot response size and abnormal responses.
2048
serverIp
Server IP address, used to locate the server that processes requests; if empty, this field is not involved.
10.0.0.2
source
Log file path, used to locate the log source file and collection path.
/var/log/gateway/access.log
sourceName
Log source name, used to locate the log source module or index.
access_log
statusCode
HTTP status code, used to determine the request processing result.
200
targetName
Target service name, used to locate the target service for request forwarding; if empty, no specific target name is involved.
hunyuan-turbo
targetXRioSeq
Target trace ID, used to correlate with the backend target service trace.
xrio-target-xxxx
userAgent
Client User-Agent, used to identify the client type, system, and version.
Mozilla/5.0 ...
xRioSeq
Request trace ID, used to correlate logs within the same request trace.
