Offline log fields quick start - CDN - Alibaba Cloud Documentation Center

CDN offline logs provide historical access log files for batch download. Use them to analyze access patterns, troubleshoot issues, or audit traffic for your accelerated domain.

Prerequisites

Before downloading offline logs, ensure:

Your RAM user has the required permissions. Attach AliyunCDNFullAccess policy or a custom policy that grants log download permissions.
At least one accelerated domain name is configured and has received traffic. Logs are generated only for domains with active requests.
Your Alibaba Cloud account is in good standing. Accounts with overdue payments cannot access log download.

Download

Navigate to Logs & Reports > Log Management > Offline Logs > Log Download.
Select the date for which you want to download logs. Logs are available for the last 30 days.
Click the download button. The log file is provided as a compressed .gz archive. Depending on the traffic volume, file sizes can range from a few kilobytes to several megabytes.
After the download, verify the file. You can check the file size, decompress it with gunzip, or use a checksum to confirm the .gz archive is not corrupted.

Log delay: Log files are typically available within 24 hours, though delays may be longer in some cases. For logs with a shorter delay, see real-time log.

To retain logs for a longer period, archive them to Object Storage Service (OSS). For more information, see Archive offline logs to Object Storage Service (OSS) by using Function Compute.

Logs

File format

Log file naming convention: accelerated domain name_year_month_day_start time_end time[extension field].gz. The extension field, if present, starts with an underscore (_). For example, aliyundoc.com_2018_10_30_000000_010000_xx.gz.

Note

The extension field may be absent. For example, aliyundoc.com_2018_10_30_000000_010000.gz.

You can open a CDN offline log file with any text editor or IDE, such as Notepad++.

Known discrepancies

Traffic data reported in Monitoring & Usage Analytics or Usage Statistics is typically about 10% higher than the traffic calculated from offline logs. For more information, see Why is there a discrepancy between traffic data from Monitoring & Usage Analytics or Usage Statistics and traffic data from logs?.

Network considerations

In some regions, certain Internet Service Providers (ISPs) may assign a private IP address to a client. As a result, a CDN or edge node receives the client's private IP address. This appears as the first IP address from the left in the X-Forwarded-For request header.

Note

The private IP address ranges are as follows:

Class A private IP addresses: 10.0.0.0 to 10.255.255.255, subnet mask: 10.0.0.0/8
Class B private IP addresses: 172.16.0.0 to 172.31.255.255, subnet mask: 172.16.0.0/12
Class C private IP addresses: 192.168.0.0 to 192.168.255.255, subnet mask: 192.168.0.0/16

Format

// Sample log entry
// Access time | Client IP | Proxy IP | Response time | Referer | Request type | Request URL | HTTP status code | Request bytes | Response bytes | Cache hit status | User_Agent | File type | Access IP
[8/Jan/2025:20:16:54 +0800] 139.224.XXX.XXX   -     246     "-"                          "GET    http://cdn.aliyun.cn/images/cdn.gif"    403       369        978               MISS      "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36" "application/xml" 139.224.XXX.XXX
[8/Jan/2025:20:16:55 +0800] 139.224.XXX.XXX   -     197     "https://www.aliyun.com/"    "GET    http://cdn.aliyun.cn/images/cdn.jpg"    200       369        1143              HIT       "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36" "application/xml" 139.224.XXX.XXX
[8/Jan/2025:20:16:53 +0800] 139.224.XXX.XXX   -     1073    "https://www.aliyun.com/"    "GET    http://cdn.aliyun.cn/"                  200       368        985               HIT       "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36" "application/xml" 139.224.XXX.XXX
[8/Jan/2025:20:09:42 +0800] 139.196.XXX.XXX   -     233     "https://www.aliyun.com/"    "GET    http://cdn.aliyun.cn/"                  200       284        857               HIT       "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36" "text/html"       139.196.XXX.XXX
[8/Jan/2025:20:09:43 +0800] 139.196.XXX.XXX   -     42      "https://www.aliyun.com/"    "GET    http://cdn.aliyun.cn/"                  200       404        809               HIT       "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/126.0.6478.182 Safari/537.36"  "text/html"       139.196.XXX.XXX
[8/Jan/2025:20:16:54 +0800] 139.224.XXX.XXX   -     152     "https://www.aliyun.com/"    "GET    http://cdn.aliyun.cn/images/cdn.png"    200       374        1139              HIT       "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36" "application/xml" 139.224.XXX.XXX

Fields

Example	Field	Description
[8/Jan/2025:20:16:54 +0800]	Access time	The time when the edge node receives the request, in the format `[DD/Mon/YYYY:HH:MM:SS ±ZZZZ]`.
139.224.XXX.XXX	Client IP	The first IP address from the left in the `X-Forwarded-For` request header, representing the client's IP address (`client_ip`). If no proxy sits between the client and the CDN or edge node, this matches the IP address that established the TCP connection with the edge node. Note The `X-Forwarded-For` header follows the format `X-Forwarded-For: <client_ip>, <proxy_ip>`. If no proxy sits between the client and the CDN or edge node (that is, the `X-Forwarded-For` header contains only `<client_ip>`), the logged `<client_ip>` value may be a private IP address. This occurs when the client's ISP assigns a private IP address to conserve public IP resources.
-	Proxy IP	The second IP address from the left in the `X-Forwarded-For` request header, representing the proxy's IP address (`proxy_ip`). If no proxy is used, this field contains a hyphen (`-`).
246	Response time	The time, in milliseconds, that the edge node took to respond to the request.
"-"	Referer	The `Referer` header value from the client request.
GET	Request type	The HTTP request method, such as GET, POST, PUT, or DELETE.
http://cdn.aliyun.cn/images/cdn.gif	Request URL	The full URL of the requested resource.
403	HTTP status code	The HTTP status code returned to the client, such as 200, 403, 404, or 500.
369	Request bytes	The size of the client request, in bytes.
978	Response bytes	The size of the response sent to the client, in bytes.
MISS	Cache hit status	Indicates whether the edge node served the request from cache. Possible values: HIT: The edge node served the content from its cache. No origin fetch was required. MISS: The edge node did not have the requested content in cache. The content is fetched from an upstream server, which can be an L2 CDN or node or the origin server. Note Alibaba Cloud CDN provides logs only for its CDN edge nodes. These logs do not include details about fetch requests from CDN L2 nodes to the origin server. Therefore, when the cache status is MISS, you cannot determine from the log whether the edge node fetched the content from the origin server.
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36	User_Agent	The `User-Agent` header value from the client request.
application/xml	File type	The `Content-Type` header value of the response. Note This field is excluded from logs for domain names covered by a global resource plan.
139.224.XXX.XXX	Access IP	The IP address that established the TCP connection with the edge node. This typically matches the client IP address.

What's next

To analyze an offline log, see Analyze offline access logs.