This topic describes the SQL statements used to query and analyze monitoring metrics by using Log Service in WAF.

The following list describes the metrics that are commonly used to query and analyze logs in Log Service. You can click a metric to view the corresponding SQL statements. For more information about the metrics, see Common monitoring metrics.

request_time_msec

Time period between the time when the client sends a request and the time when the client receives a response.

* |SELECT user_id,host,round(round(request_time_cnt*1.0000/countall,4)*100,2)
as percent FROM  (select user_id,host,count_if(request_time_msec>500)
AS request_time_cnt ,COUNT(*)  as countall from log group by user_id,host)
group by user_id,host,percent

upstream_response_time

The time period between the time when WAF sends data to the origin server and the time when WAF receives a response from the origin server.

* |SELECT
user_id,host,round(round(upstream_response_time_cnt*1.0000/countall,4)*100,2)
as percent FROM  (select
user_id,host,count_if(upstream_response_time>500) AS
upstream_response_time_cnt ,COUNT(*)  as countall from log group by
user_id,host) group by user_id,host,percent

ssl_handshake_time

The time required for an SSL handshake between the client and WAF during an HTTPS request.

* |SELECT
user_id,host,round(round(ssl_handshake_time_cnt*1.0000/countall,4)*100,2) as
percent FROM  (select user_id,host,count_if(ssl_handshake_time>10) AS
ssl_handshake_time_cnt ,COUNT(*)  as countall from log group by
user_id,host) group by user_id,host,percent

200

The server has processed the request and returned the requested data.

* |select user_id,host as "Domain",Rate_200 as
"Status code 200 percentage",Rate_302 as "Status code 302 percentage",Rate_404 as "Status code 404 percentage",Rate_405
as "Status code 405 percentage",Rate_444 as "Status code 444 percentage",Rate_499 as "Status code 499 percentage",Rate_500
as "Status code 500 percentage",Rate_502 as "Status code 502 percentage",Rate_503 as "Status code 503 percentage",Rate_504
as "Status code 504 percentage",countall/60 as
"aveQPS",status_200,status_302,status_404,status_405,status_444,status_499,status_500,status_502,status_503,status_504,countall
from(SELECT user_id,host,round(round(status_200*1.0000/countall,4)*100,2) as
Rate_200,round(round(status_302*1.0000/countall,4)*100,2) as Rate_302,
round(round

(status_404*1.0000/countall,4)*100,2) as
Rate_404,round(round

(status_405*1.0000/countall,4)*100,2) as
Rate_405,round(round

(status_405*1.0000/countall,4)*100,2) as
Rate_444,round(round

(status_405*1.0000/countall,4)*100,2)
as Rate_499,round(round(status_500*1.0000/countall,4)*100,2) as
Rate_500,round(round(status_502*1.0000/countall,4)*100,2) as Rate_502,round(round(status_503*1.0000/countall,4)*100,2)
as Rate_503,round(round(status_504*1.0000/countall,4)*100,2) as
Rate_504,status_200,status_302,status_404,status_405,status_444,status_499,status_500,status_502,status_503,status_504,countall
from (select user_id,host,count_if(status=200) as
status_200,count_if(status=302) as status_302,count_if(status=404) as
status_404,count_if(status=405) as status_405,count_if(status=444) as
status_444,count_if(status=499) as status_499,count_if(status=500) as status_500,count_if(status=502)
as status_502,count_if(status=503) as status_503,count_if(status=504) as
status_504,COUNT(*)  as countall from log group by user_id,host))
where  countall>120 order by Rate_200 DESC  limit 5

status:302 and block_action:tmd/status:200 and block_action:tmd

The status code indicates whether CAPTCHA is triggered. Code 302 indicates that CAPTCHA is triggered, and code 200 indicates that CAPTCHA is not triggered and the user needs to customize HTTP flood protection.

* |select user_id,host as "Domain",Rate_200 as
"Status code 200 percentage",Rate_302 as "Status code 302 percentage",Rate_404 as "Status code 404 percentage",Rate_405
as "Status code 405 percentage",Rate_444 as "Status code 444 percentage",Rate_499 as "Status code 499 percentage",Rate_500
as "Status code 500 percentage",Rate_502 as "Status code 502 percentage",Rate_503 as "Status code 503 percentage",Rate_504
as "Status code 504 percentage",countall/60 as
"aveQPS",status_200,status_302,status_404,status_405,status_444,status_499,status_500,status_502,status_503,status_504,countall
from(SELECT user_id,host,round(round(status_200*1.0000/countall,4)*100,2) as
Rate_200,round(round(status_302*1.0000/countall,4)*100,2) as Rate_302,
round(round

(status_404*1.0000/countall,4)*100,2) as
Rate_404,round(round

(status_405*1.0000/countall,4)*100,2) as
Rate_405,round(round

(status_405*1.0000/countall,4)*100,2) as Rate_444,round(round

(status_405*1.0000/countall,4)*100,2) as
Rate_499,round(round(status_500*1.0000/countall,4)*100,2) as
Rate_500,round(round(status_502*1.0000/countall,4)*100,2) as
Rate_502,round(round(status_503*1.0000/countall,4)*100,2) as Rate_503,round(round(status_504*1.0000/countall,4)*100,2)
as
Rate_504,status_200,status_302,status_404,status_405,status_444,status_499,status_500,status_502,status_503,status_504,countall
from (select user_id,host,count_if(status=200 and 

block_action:tmd

) as status_200,count_if(status=302 and 

block_action:tmd

) as
status_302,count_if(status=404) as status_404,count_if(status=405) as
status_405,count_if(status=444) as status_444,count_if(status=499) as
status_499,count_if(status=500) as status_500,count_if(status=502) as
status_502,count_if(status=503) as status_503,count_if(status=504) as
status_504,COUNT(*)  as countall from log group by user_id,host))
where  countall>120 order by Rate_200 DESC  limit 5

200 and block_action:‘antifraud’

A request is blocked by data risk control.

* |select user_id,host as "Domain",Rate_200 as
"Status code 200 percentage",Rate_302 as "Status code 302 percentage",Rate_404 as "Status code 404 percentage",Rate_405
as "Status code 405 percentage",Rate_444 as "Status code 444 percentage",Rate_499 as "Status code 499 percentage",Rate_500
as "Status code 500 percentage",Rate_502 as "Status code 502 percentage",Rate_503 as "Status code 503 percentage",Rate_504
as "Status code 504 percentage",countall/60 as
"aveQPS",status_200,status_302,status_404,status_405,status_444,status_499,status_500,status_502,status_503,status_504,countall
from(SELECT user_id,host,round(round(status_200*1.0000/countall,4)*100,2) as
Rate_200,round(round(status_302*1.0000/countall,4)*100,2) as Rate_302, round(round

(status_404*1.0000/countall,4)*100,2) as
Rate_404,round(round

(status_405*1.0000/countall,4)*100,2) as
Rate_405,round(round

(status_405*1.0000/countall,4)*100,2) as
Rate_444,round(round

(status_405*1.0000/countall,4)*100,2)
as Rate_499,round(round(status_500*1.0000/countall,4)*100,2) as
Rate_500,round(round(status_502*1.0000/countall,4)*100,2) as
Rate_502,round(round(status_503*1.0000/countall,4)*100,2) as
Rate_503,round(round(status_504*1.0000/countall,4)*100,2) as
Rate_504,status_200,status_302,status_404,status_405,status_444,status_499,status_500,status_502,status_503,status_504,countall
from (select user_id,host,count_if(status=200 and block_action:‘antifraud’) as
status_200,count_if(status=302) as status_302,count_if(status=404) as
status_404,count_if(status=405) as status_405,count_if(status=444) as
status_444,count_if(status=499) as status_499,count_if(status=500) as
status_500,count_if(status=502) as status_502,count_if(status=503) as
status_503,count_if(status=504) as status_504,COUNT(*)  as countall from
log group by user_id,host)) where  countall>120 order by Rate_200
DESC  limit 5

status:404

The server cannot find the requested resources.

*|select user_id,host as "Domain",Rate_200 as
"Status code 200 percentage",Rate_302 as "Status code 302 percentage",Rate_404 as "Status code 404 percentage",Rate_405
as "Status code 405 percentage",Rate_500 as "Status code 500 percentage",Rate_502 as "Status code 502 percentage",Rate_503
as "Status code 503 percentage",Rate_504 as "Status code 504 percentage",countall/60 as
"aveQPS",status_200,status_302,status_404,status_405,status_500,status_502,status_503,status_504,countall
from(SELECT user_id,host,round(round(status_200*1.0000/countall,4)*100,2) as
Rate_200,round(round(status_302*1.0000/countall,4)*100,2) as Rate_302,
round(round

(status_404*1.0000/countall,4)*100,2) as
Rate_404,round(round

(status_405*1.0000/countall,4)*100,2)
as Rate_405,round(round(status_500*1.0000/countall,4)*100,2) as
Rate_500,round(round(status_502*1.0000/countall,4)*100,2) as
Rate_502,round(round(status_503*1.0000/countall,4)*100,2) as
Rate_503,round(round(status_504*1.0000/countall,4)*100,2) as
Rate_504,status_200,status_302,status_404,status_405,status_500,status_502,status_503,status_504,countall
from (select user_id,host,count_if(status=200) as
status_200,count_if(status=302) as status_302,count_if(status=404) as
status_404,count_if(status=405) as status_405,count_if(status=499) as
status_499,count_if(status=500) as status_500,count_if(status=502) as
status_502,count_if(status=503) as status_503,count_if(status=504) as
status_504,COUNT(*)  as countall from log group by user_id,host))
where  countall>120 order by Rate_404 DESC  limit 5

status:405 and aliwaf_action='block'

A request is blocked by web application protection rules.

* |select user_id,host as "Domain",Rate_200 as
"Status code 200 percentage",Rate_302 as "Status code 302 percentage",Rate_404 as "Status code 404 percentage",Rate_405
as "Status code 405 percentage",Rate_444 as "Status code 444 percentage",Rate_499 as "Status code 499 percentage",Rate_500
as "Status code 500 percentage",Rate_502 as "Status code 502 percentage",Rate_503 as "Status code 503 percentage",Rate_504
as "Status code 504 percentage",countall/60 as "aveQPS",status_200,status_302,status_404,status_405,status_444,status_499,status_500,status_502,status_503,status_504,countall
from(SELECT user_id,host,round(round(status_200*1.0000/countall,4)*100,2) as
Rate_200,round(round(status_302*1.0000/countall,4)*100,2) as Rate_302,
round(round

(status_404*1.0000/countall,4)*100,2) as
Rate_404,round(round

(status_405*1.0000/countall,4)*100,2) as
Rate_405,round(round

(status_405*1.0000/countall,4)*100,2) as
Rate_444,round(round

(status_405*1.0000/countall,4)*100,2)
as Rate_499,round(round(status_500*1.0000/countall,4)*100,2) as
Rate_500,round(round(status_502*1.0000/countall,4)*100,2) as
Rate_502,round(round(status_503*1.0000/countall,4)*100,2) as
Rate_503,round(round(status_504*1.0000/countall,4)*100,2) as Rate_504,status_200,status_302,status_404,status_405,status_444,status_499,status_500,status_502,status_503,status_504,countall
from (select user_id,host,count_if(status=200) as
status_200,count_if(status=302) as status_302,count_if(status=404) as
status_404,count_if(status=405 and aliwaf_action='block' ) as
status_405,count_if(status=444) as status_444,count_if(status=499) as
status_499,count_if(status=500) as status_500,count_if(status=502) as
status_502,count_if(status=503) as status_503,count_if(status=504) as status_504,COUNT(*) 
as countall from log group by user_id,host)) where  countall>120 order
by Rate_405 DESC  limit 5

status:405 and aliwaf_action='acl'

A request is blocked by HTTP ACL policy rules.

user_id: 1111111111111 |select user_id,host as "Domain",Rate_200 as
"Status code 200 percentage",Rate_302 as "Status code 302 percentage",Rate_404 as "Status code 404 percentage",Rate_405
as "Status code 405 percentage",Rate_444 as "Status code 444 percentage",Rate_499 as "Status code 499 percentage",Rate_500
as "Status code 500 percentage",Rate_502 as "Status code 502 percentage",Rate_503 as "Status code 503 percentage",Rate_504
as "Status code 504 percentage",countall/60 as
"aveQPS",status_200,status_302,status_404,status_405,status_444,status_499,status_500,status_502,status_503,status_504,countall
from(SELECT user_id,host,round(round(status_200*1.0000/countall,4)*100,2) as
Rate_200,round(round(status_302*1.0000/countall,4)*100,2) as Rate_302,
round(round

(status_404*1.0000/countall,4)*100,2) as Rate_404,round(round

(status_405*1.0000/countall,4)*100,2) as
Rate_405,round(round

(status_405*1.0000/countall,4)*100,2) as
Rate_444,round(round

(status_405*1.0000/countall,4)*100,2)
as Rate_499,round(round(status_500*1.0000/countall,4)*100,2) as Rate_500,round(round(status_502*1.0000/countall,4)*100,2)
as Rate_502,round(round(status_503*1.0000/countall,4)*100,2) as
Rate_503,round(round(status_504*1.0000/countall,4)*100,2) as
Rate_504,status_200,status_302,status_404,status_405,status_444,status_499,status_500,status_502,status_503,status_504,countall
from (select user_id,host,count_if(status=200) as
status_200,count_if(status=302) as status_302,count_if(status=404) as
status_404,count_if(status=405 and aliwaf_action='acl') as
status_405,count_if(status=444) as status_444,count_if(status=499) as
status_499,count_if(status=500) as status_500,count_if(status=502) as
status_502,count_if(status=503) as status_503,count_if(status=504) as
status_504,COUNT(*)  as countall from log group by user_id,host)) where 
countall>120 order by Rate_405 DESC  limit 5

status:444

A request is blocked by custom HTTP flood protection rules.

* |select user_id,host as "Domain",Rate_200 as
"Status code 200 percentage",Rate_302 as "Status code 302 percentage",Rate_404 as "Status code 404 percentage",Rate_405
as "Status code 405 percentage",Rate_444 as "Status code 444 percentage",Rate_499 as "Status code 499 percentage",Rate_500
as "Status code 500 percentage",Rate_502 as "Status code 502 percentage",Rate_503 as "Status code 503 percentage",Rate_504
as "Status code 504 percentage",countall/60 as
"aveQPS",status_200,status_302,status_404,status_405,status_444,status_499,status_500,status_502,status_503,status_504,countall
from(SELECT user_id,host,round(round(status_200*1.0000/countall,4)*100,2) as
Rate_200,round(round(status_302*1.0000/countall,4)*100,2) as Rate_302,
round(round

(status_404*1.0000/countall,4)*100,2) as
Rate_404,round(round

(status_405*1.0000/countall,4)*100,2) as
Rate_405,round(round

(status_405*1.0000/countall,4)*100,2) as Rate_444,round(round

(status_405*1.0000/countall,4)*100,2)
as Rate_499,round(round(status_500*1.0000/countall,4)*100,2) as
Rate_500,round(round(status_502*1.0000/countall,4)*100,2) as
Rate_502,round(round(status_503*1.0000/countall,4)*100,2) as Rate_503,round(round(status_504*1.0000/countall,4)*100,2)
as
Rate_504,status_200,status_302,status_404,status_405,status_444,status_499,status_500,status_502,status_503,status_504,countall
from (select user_id,host,count_if(status=200) as status_200,count_if(status=302)
as status_302,count_if(status=404) as status_404,count_if(status=405) as
status_405,count_if(status=444) as status_444,count_if(status=499) as
status_499,count_if(status=500) as status_500,count_if(status=502) as
status_502,count_if(status=503) as status_503,count_if(status=504) as
status_504,COUNT(*)  as countall from log group by user_id,host))
where  countall>120 order by Rate_444 DESC  limit 5

status:499

After a client sends a request, the server does not return data. After the maximum wait time of the client is reached, the client disconnects, and the server returns this status code.

* |select user_id,host as "Domain",Rate_200 as
"Status code 200 percentage",Rate_302 as "Status code 302 percentage",Rate_404 as "Status code 404 percentage",Rate_405
as "Status code 405 percentage",Rate_444 as "Status code 444 percentage",Rate_499 as "Status code 499 percentage",Rate_500
as "Status code 500 percentage",Rate_502 as "Status code 502 percentage",Rate_503 as "Status code 503 percentage",Rate_504
as "Status code 504 percentage",countall/60 as
"aveQPS",status_200,status_302,status_404,status_405,status_444,status_499,status_500,status_502,status_503,status_504,countall
from(SELECT user_id,host,round(round(status_200*1.0000/countall,4)*100,2) as
Rate_200,round(round(status_302*1.0000/countall,4)*100,2) as Rate_302,
round(round

(status_404*1.0000/countall,4)*100,2) as
Rate_404,round(round

(status_405*1.0000/countall,4)*100,2) as
Rate_405,round(round

(status_405*1.0000/countall,4)*100,2) as
Rate_444,round(round

(status_405*1.0000/countall,4)*100,2)
as Rate_499,round(round(status_500*1.0000/countall,4)*100,2) as
Rate_500,round(round(status_502*1.0000/countall,4)*100,2) as
Rate_502,round(round(status_503*1.0000/countall,4)*100,2) as
Rate_503,round(round(status_504*1.0000/countall,4)*100,2) as
Rate_504,status_200,status_302,status_404,status_405,status_444,status_499,status_500,status_502,status_503,status_504,countall
from (select user_id,host,count_if(status=200) as
status_200,count_if(status=302) as status_302,count_if(status=404) as
status_404,count_if(status=405) as status_405,count_if(status=444) as
status_444,count_if(status=499) as status_499,count_if(status=500) as
status_500,count_if(status=502) as status_502,count_if(status=503) as
status_503,count_if(status=504) as status_504,COUNT(*)  as countall from
log group by user_id,host)) where  countall>120 order by Rate_499
DESC  limit 5

status:500

A request cannot be processed due to the 500 Internal Server Error.

* |select user_id,host as "Domain",Rate_200 as
"Status code 200 percentage",Rate_302 as "Status code 302 percentage",Rate_404 as "Status code 404 percentage",Rate_405
as "Status code 405 percentage",Rate_444 as "Status code 444 percentage",Rate_499 as "Status code 499 percentage",Rate_500
as "Status code 500 percentage",Rate_502 as "Status code 502 percentage",Rate_503 as "Status code 503 percentage",Rate_504
as "Status code 504 percentage",countall/60 as
"aveQPS",status_200,status_302,status_404,status_405,status_444,status_499,status_500,status_502,status_503,status_504,countall
from(SELECT user_id,host,round(round(status_200*1.0000/countall,4)*100,2) as
Rate_200,round(round(status_302*1.0000/countall,4)*100,2) as Rate_302,
round(round

(status_404*1.0000/countall,4)*100,2) as Rate_404,round(round

(status_405*1.0000/countall,4)*100,2) as
Rate_405,round(round

(status_405*1.0000/countall,4)*100,2) as
Rate_444,round(round

(status_405*1.0000/countall,4)*100,2)
as Rate_499,round(round(status_500*1.0000/countall,4)*100,2) as
Rate_500,round(round(status_502*1.0000/countall,4)*100,2) as
Rate_502,round(round(status_503*1.0000/countall,4)*100,2) as
Rate_503,round(round(status_504*1.0000/countall,4)*100,2) as
Rate_504,status_200,status_302,status_404,status_405,status_444,status_499,status_500,status_502,status_503,status_504,countall
from (select user_id,host,count_if(status=200) as
status_200,count_if(status=302) as status_302,count_if(status=404) as
status_404,count_if(status=405) as status_405,count_if(status=444) as
status_444,count_if(status=499) as status_499,count_if(status=500) as
status_500,count_if(status=502) as status_502,count_if(status=503) as
status_503,count_if(status=504) as status_504,COUNT(*)  as countall from
log group by user_id,host)) where  countall>120 order by Rate_500
DESC  limit 5

status:502

The server is used as a gateway or a proxy and receives invalid responses from the upstream server due to a 502 Bad Gateway error. The origin server does not respond due to low quality performance of the back-to-origin network or the fact that back-to-origin requests are blocked by access control policies configured for the origin server.

* |select user_id,host as "Domain",Rate_200 as
"Status code 200 percentage",Rate_302 as "Status code 302 percentage",Rate_404 as "Status code 404 percentage",Rate_405
as "Status code 405 percentage",Rate_444 as "Status code 444 percentage",Rate_499 as "Status code 499 percentage",Rate_500
as "Status code 500 percentage",Rate_502 as "Status code 502 percentage",Rate_503 as "Status code 503 percentage",Rate_504
as "Status code 504 percentage",countall/60 as
"aveQPS",status_200,status_302,status_404,status_405,status_444,status_499,status_500,status_502,status_503,status_504,countall
from(SELECT user_id,host,round(round(status_200*1.0000/countall,4)*100,2) as
Rate_200,round(round(status_302*1.0000/countall,4)*100,2) as Rate_302,
round(round

(status_404*1.0000/countall,4)*100,2) as
Rate_404,round(round

(status_405*1.0000/countall,4)*100,2) as
Rate_405,round(round

(status_405*1.0000/countall,4)*100,2) as
Rate_444,round(round

(status_405*1.0000/countall,4)*100,2)
as Rate_499,round(round(status_500*1.0000/countall,4)*100,2) as
Rate_500,round(round(status_502*1.0000/countall,4)*100,2) as Rate_502,round(round(status_503*1.0000/countall,4)*100,2)
as Rate_503,round(round(status_504*1.0000/countall,4)*100,2) as
Rate_504,status_200,status_302,status_404,status_405,status_444,status_499,status_500,status_502,status_503,status_504,countall
from (select user_id,host,count_if(status=200) as
status_200,count_if(status=302) as status_302,count_if(status=404) as
status_404,count_if(status=405) as status_405,count_if(status=444) as
status_444,count_if(status=499) as status_499,count_if(status=500) as status_500,count_if(status=502)
as status_502,count_if(status=503) as status_503,count_if(status=504) as
status_504,COUNT(*)  as countall from log group by user_id,host))
where  countall>120 order by Rate_502 DESC  limit 5

status:503

The service is unavailable due to overloads or maintenance needs.

* |select user_id,host as "Domain",Rate_200 as
"Status code 200 percentage",Rate_302 as "Status code 302 percentage",Rate_404 as "Status code 404 percentage",Rate_405
as "Status code 405 percentage",Rate_444 as "Status code 444 percentage",Rate_499 as "Status code 499 percentage",Rate_500
as "Status code 500 percentage",Rate_502 as "Status code 502 percentage",Rate_503 as "Status code 503 percentage",Rate_504
as "Status code 504 percentage",countall/60 as
"aveQPS",status_200,status_302,status_404,status_405,status_444,status_499,status_500,status_502,status_503,status_504,countall
from(SELECT user_id,host,round(round(status_200*1.0000/countall,4)*100,2) as
Rate_200,round(round(status_302*1.0000/countall,4)*100,2) as Rate_302,
round(round

(status_404*1.0000/countall,4)*100,2) as
Rate_404,round(round

(status_405*1.0000/countall,4)*100,2) as
Rate_405,round(round

(status_405*1.0000/countall,4)*100,2) as
Rate_444,round(round

(status_405*1.0000/countall,4)*100,2)
as Rate_499,round(round(status_500*1.0000/countall,4)*100,2) as
Rate_500,round(round(status_502*1.0000/countall,4)*100,2) as
Rate_502,round(round(status_503*1.0000/countall,4)*100,2) as
Rate_503,round(round(status_504*1.0000/countall,4)*100,2) as
Rate_504,status_200,status_302,status_404,status_405,status_444,status_499,status_500,status_502,status_503,status_504,countall
from (select user_id,host,count_if(status=200) as
status_200,count_if(status=302) as status_302,count_if(status=404) as status_404,count_if(status=405)
as status_405,count_if(status=444) as status_444,count_if(status=499) as
status_499,count_if(status=500) as status_500,count_if(status=502) as
status_502,count_if(status=503) as status_503,count_if(status=504) as status_504,COUNT(*) 
as countall from log group by user_id,host)) where  countall>120 order
by Rate_503 DESC  limit 5

status:504

The server serves as a gateway or proxy and fails to receive requests from the upstream server in time. The 504 Gateway Timeout error occurred.

* |select user_id,host as "Domain",Rate_200 as
"Status code 200 percentage",Rate_302 as "Status code 302 percentage",Rate_404 as "Status code 404 percentage",Rate_405
as "Status code 405 percentage",Rate_444 as "Status code 444 percentage",Rate_499 as "Status code 499 percentage",Rate_500
as "Status code 500 percentage",Rate_502 as "Status code 502 percentage",Rate_503 as "Status code 503 percentage",Rate_504
as "Status code 504 percentage",countall/60 as
"aveQPS",status_200,status_302,status_404,status_405,status_444,status_499,status_500,status_502,status_503,status_504,countall
from(SELECT user_id,host,round(round(status_200*1.0000/countall,4)*100,2) as
Rate_200,round(round(status_302*1.0000/countall,4)*100,2) as Rate_302,
round(round

(status_404*1.0000/countall,4)*100,2) as
Rate_404,round(round

(status_405*1.0000/countall,4)*100,2) as
Rate_405,round(round

(status_405*1.0000/countall,4)*100,2) as
Rate_444,round(round

(status_405*1.0000/countall,4)*100,2)
as Rate_499,round(round(status_500*1.0000/countall,4)*100,2) as
Rate_500,round(round(status_502*1.0000/countall,4)*100,2) as
Rate_502,round(round(status_503*1.0000/countall,4)*100,2) as
Rate_503,round(round(status_504*1.0000/countall,4)*100,2) as
Rate_504,status_200,status_302,status_404,status_405,status_444,status_499,status_500,status_502,status_503,status_504,countall
from (select user_id,host,count_if(status=200) as
status_200,count_if(status=302) as status_302,count_if(status=404) as
status_404,count_if(status=405) as status_405,count_if(status=444) as
status_444,count_if(status=499) as status_499,count_if(status=500) as
status_500,count_if(status=502) as status_502,count_if(status=503) as
status_503,count_if(status=504) as status_504,COUNT(*)  as countall from
log group by user_id,host)) where  countall>120 order by Rate_504 DESC 
limit 5