How Long Are CFW Logs Stored by Default? What Is the Maximum Storage Capacity?
CFW stores logs for 7 days free of charge, with a maximum storage capacity of 50 GB.
After you enable Log Analysis, CFW stores logs from the last 6 months by default. Storage capacity starts at 1,000 GB and can scale up to 300 TB.
What Happens When Log Storage Exceeds the Package Time or Capacity Limit?
When the default log storage capacity of 50 GB is used, logs retained for more than 7 days or exceeding 50 GB are automatically overwritten.
After you enable the Log Analysis service, logs retained for more than 6 months are purged.
After you enable the Log Analysis service, if the log storage reaches the purchased capacity limit, the system overwrites the oldest logs in chronological order to store new logs. If the log storage continuously exceeds the purchased capacity and the total amount of rolled logs reaches nine times the purchased capacity, the system stops storing new logs.
Note:
For example, if you purchase 1,000 GB of log storage and the usage continuously exceeds the capacity, the system stops recording new logs after the total volume reaches 10,000 GB.
What Is the Relationship Between Log Auditing and Analysis and CLS?
Currently, Log Auditing is built into CFW and is independent of CLS. CFW logs can be shipped for your own analysis.
What Traffic Is Recorded in Access Control Logs, Intrusion Defense Logs, and Traffic Logs?
Access Control logs record traffic that hits Access Control rules.
Intrusion Defense logs record traffic that hits Intrusion Defense rules.
Traffic logs record permitted traffic.
Can Firewall Logs Be Archived?
Yes, logs support export and shipping features and can be shipped to your Kafka.
How to Download Logs
You can use the log shipping feature to ship logs for analysis, provided that you have purchased a Tencent Cloud Message Queue CKafka instance. For configuration, see Log Analysis.
Alternatively, log in to the CFW console, click Log Auditing > Traffic Logs in the left sidebar to go to the Traffic Logs page, and click
in the upper-right corner to download logs.
Note:
Based on the current search criteria, up to 60,000 logs can be exported.
How Long Does It Take for Log Shipping to Succeed?
Log shipping takes about 1 minute, so there may be a slight delay in related log updates.
Do Shipped Logs Have tags to Identify Log Types?
Logs do not contain tags that identify log types. It is recommended that you select different topics when shipping logs to distinguish different types of logs.
Why Are Observation-Type Logs Still Present When Interception Mode Is Enabled?
Virtual Patching is automatically intercepted, while basic rules do not support automatic interception yet. If an intrusion event contains a vulnerability attack that hits Virtual Patching, it is automatically intercepted. Therefore, basic rules remain in observation mode. It is expected that future versions will support automatic interception for high-confidence basic rules, as well as permanent interception.
Does Traffic Logging Record IP address Traffic Logs Blocked by Access Control or Intrusion Defense Rules?
Traffic logs do not record IP address traffic blocked by Access Control rules or Intrusion Defense, but only record permitted traffic.
Are Logs Generated for Blocked Attacks?
Access Control rules: In Block mode, access data is intercepted, rule hit counts are recorded, and Access Control logs are recorded, but traffic logs are not recorded.
Intrusion Detection: When an intrusion detection policy is hit, an intrusion detection event is generated. You can view specific blocking logs through Log Analysis.
How to Determine Whether Access/Attack in Shipped Logs Is Blocked or Allowed
The strategy field in the log indicates whether the access is blocked or observed.
Note:
Traffic logs do not contain a strategy field value.
Can a Purchased CKafka Not Be Selected as the Supporting Environment for Log Shipping?
You need to add an access method to the CKafka instance and configure access through a public network domain name. The access method for the support environment is not available yet. For details, see Instance List.
