This topic describes the billing method of Anti-DDoS Pro (DDoS) when you store your DDoS log data in Log Service. DDoS is billed based on the billing items of Log Service only after log data is generated. Log Service provides a free quota for the Logstore that stores your DDoS log data. After the free quota is exhausted, Log Service is billed by using the pay-as-you-go billing method.

Background information

Log Service allows you to use your DDoS Logstore to collect, store, query, analyze, and display log data in real time. These operations depend on the real-time query and analysis feature of Log Service. The billing method of DDoS depends on the billing method of Log Service. Log Service provides a free quota for your DDoS Logstore. After the free quota is exhausted, Log Service is billed by using the pay-as-you-go method based on the amount of your log data. If you have created a project and Logstore in Log Service but have not started to collect logs from any website, no fees are incurred.
Note We recommend that you set a log retention period of more than 30 days for the purpose of tracking, troubleshooting, and evidence taking in case of cyber-attacks. For more information, see Modify the storage period of your website log data stored in a Logstore.

Deduction and overdue payment

Log Service is billed by using the pay-as-you-go method. The billing cycle is one day. For more information, see Deduction and overdue payment.

Billing items

Billing item Description
Read/write traffic Read/write traffic refers to the traffic that is generated by reading data from and write data to Log Service.
  • Read/write traffic is calculated based on the logs that have been transmitted. The compression ratio of DDoS logs is 5:1 to 10:1.
  • Read/write traffic also includes traffic generated by streaming consumption when you use APIs, SDKs, or consumer groups to consume log data. You can use APIs or SDKs to enable log data compression.
    Note In the Log Service console, when you click the management icon next to a Logstore in the Logstores pane and then choose Consumption Preview, a small amount of streaming consumption traffic is generated.
  • Traffic generated by index-based queries and analysis does not incur fees. For example, you are not charged when you query and analyze logs, display log data statistics on dashboards, or use the alert feature in the Log Service console.
Storage space The storage space is the total size of compressed log data and the relevant indexes.
Indexing traffic
  • Indexing traffic is calculated based on the index fields that you created. Indexing traffic is billed only once. The full text indexing feature is enabled for DDoS logs by default.
  • If you create both full text and key/value indexes, indexing traffic is calculated only once.
  • Created indexes occupy storage space and incur fees.
Active shards Only the shards in the read/write state are charged when they are leased. Merged or split shards do not incur fees.
Note When you create a Logstore in Log Service, Log Service creates two shards and enables the automatic sharding feature. For more information, see Manage a shard. You can write 430 GB of log data per day to a shard.
Read/write operations The number of operations that write logs to Log Service depends on the log generation speed. Log Service automatically minimizes the number of read/write operations.
Read traffic over public network Read traffic over public network refers to the traffic generated when log data collected by Log Service is read and consumed by external applications over public network.

Billing method

Log Service is not billed in the following conditions:
  • You have created a project and Logstore but have not started to collect DDoS logs from any website.
  • The amount of DDoS log data collected from the specified website does not exceed the free quota.
  • Traffic is generated by index-based queries and analysis, reports, and alerts.
When the amount of log data collected from the specified website exceeds the free quota, the excess amount is charged.
Billing item Free quota Price for excess amount Example
Read/write traffic (USD/GB)
  • Read traffic: billed based on the billing method
  • Write traffic: 30 GB/day free quota
0.045 For example, the amount of log data is 300 GB per day and the compression ratio is 6:1. The size of the compressed log data is 50 GB. The excess amount of 20 GB (50 - 30 = 20) is charged at a rate of USD 0.9/day (0.045 × 20 = 0.9).
Storage space (USD/GB/day) 3 days 0.002875 For example, the amount of log data is 10 GB per day and the log data is compressed to 2 GB. The indexing traffic is 10 GB. If the log data storage period is 30 days, the total size of log data after 30 days is 360 GB (30 × (10 + 2) = 360). The excess amount of log data is 324 GB (27 × (10 + 2) = 324). The excess amount is charged at a rate of USD 0.9315 per day (0.002875 × 324 = 0.9315).
Indexing traffic (USD/GB) 100 GB/day 0.0875 If the amount of log data is 150 GB per day, the excess amount of 50 GB (150 - 100 = 50) is charged at a rate of USD 4.375 per day (0.0875 × 50 = 4.375).
Active shards (USD/day) 4 shards × 30 days/month 0.01 For example, your DDoS Logstore has 10 shards, 7 of which are in the read/write state. The other 3 shards are merged and are in the read-only state. Then, 3 shards (7 - 4 = 3) are charged at a rate of USD 0.03 per day.
Read/write operations (USD/million times)
  • Read operations: billed based on the billing method
  • Write operations: 1 million times/day free quota
0.03 If your website generates 10 billion logs per day and the number of write operations is 500,000 (2,000 logs per time on average), no fees are incurred.
Read traffic over public network (USD/GB) 0 0.2 If Log Service delivers 2 GB of log data to a product that is not provided by Alibaba Cloud, the read traffic over public network is charged USD 0.4 (0.2 × 2 = 0.4).
Note Your log data is stored in Log Store for three days by default. If you change the storage period to more than 3 days, the excess storage period incur fees.

Modify the storage period of your website log data stored in a Logstore

  1. Log on to the Log Service console, and then click the target project name.
  2. On the Overview page that appears, find the Logstore in the left-side navigation pane, click the management icon next to the Logstore, and then choose Modify.
  3. On the Logstore Attributes page that appears, click Modify, modify the Data Retention Period, and then clickSave.
    Figure 1. Modify the data retention period
    Modify the data retention period

View the size of log data and estimate the cost

Log on to the Billing Management console to view the billing data that is refreshed every day.

  1. Log on to the Anti-DDoS Pro console. In the left-side navigation pane, click Full Log.
  2. Select the website whose log data size you want to view, and then clickLog Analyses.
  3. Set the time range to Yesterday (Time Frame), and then enter the following query statement in the query box:
    __topic__: ddos_access_log | select count(1) as PV
  4. Click Search, click the Graph tab, and then select Table as the chart type.

You can view the amount of data that was logged yesterday and estimate the cost based on your data retention period.

Configure an alert that is reported when a large number of logs are generated

When a large number of DDoS logs are collected, they may exceed the free quota and the excess amount incurs fees. If you want to receive an alert notification before fees are incurred, you can configure an alert rule in Log Service. Then, Log Service will send an alert notification to you when a large number of logs are generated.

  1. Log on to the Anti-DDoS Pro console. In the left-side navigation pane, click Full Log.
  2. Select the website whose log data size you want to view, and then clickLog Analyses.
  3. Enter the following query statement in the search box, and then click Search.
    *| select count(1) as PV
  4. In the upper-right corner of the query page, click Save Search, set the parameters such as ddos-metering-pv, and then click OK.
  5. Click Save as Alert, and then create an alert rule. After these settings are saved, the log data size of the last hour is checked every five minutes. If the number of logs exceeds 5.6 million, you will receive an alert notification.
    告警规则
    Note To ensure that the daily log data size is less than the 100 GB free quota, the average logs imported per hour is estimated to be 2.8 million (100 GB ÷ 1600 bytes/log ÷ 24 hours ≈ 2.8 million). In this example, the number of logs imported per hour is set to 5.6 million, which is twice the estimated value. You can set a lower or higher value as needed.