DDoS log collection function is charged according to the charge items of the Log Service. If no log data is generated, no billing is made. Log Service is billed by resource usage and provides the FreeTier quota for DDoS Logstore.

DDoS log collection function provides functions such as log collection, storage, real-time query and analysis, and dashboards. The real-time query and analysis of log data relies on Log Service. Therefore, this feature is charged according to Log Service billing method. Log Service is billed by the resource usage and provides the FreeTier quota for DDoS Logstore. The specific fee depends on the amount of your log data. If you have Log Service enabled, but you have not turned on logging function for any website, no charge appears.

Deduction and outstanding payment

Log Service is billed by the resource usage, and the billing cycle is one day. For more information about deduction and outstanding payment, see Deduction and outstanding payment.

Billing item

Billing item Description
Read and write traffic 
  • The read and write traffic is calculated by the traffic for transmitting compressed logs. DDoS logs are generally compressed by 5 to 10 times. 
  • Read and write traffic also includes a loss of consumption interface that generates read traffic, generally, by using API/SDK and consumer group SDK. According to the compressed transmission traffic calculation, logs can be compressed in the API/SDK mode.
    Note In the Log Service console, Preview function under Log Consumption also can generate micro-flow traffic consumption.
  • The data generated by the index-based query and analysis is free of read and write traffic charges. For example, the log query analysis, dashboards, and alarms in the console are not charged.
Storage space The storage space is the sum of data size after compression and the indexed data size.
Indexing traffic 
  • The indexing traffic is calculated by actual index fields. Storage fee is collected in full during writing. DDoS logs enable full indexing by default.
  • The traffic of fields having both FullText and KeyValue indexes is calculated only once.
  • Indexes occupy the storage space and thus the storage space fee is collected.
Active shard rent Only shards currently in readwrite status are counted. Rent of merged/split shards is not collected.
Note By default, Log Service creates two shards, and enables the Auto Split Shard feature. Typically, each shard can proceed 430 GB of write data volume per day.
Read/write count  The write count of logs written into Log Service is a subject to the log generation speed. The background realization mechanism minimizes the read/write count.
Internet read traffic The data traffic generated when Internet programs read log data collected by Log Service. 

FreeTier quota

Log Service is not charged in the following cases:
  • Log Service is activated, and DDoS logging function has not been enabled for any website. 
  • The amount of website logs that enable DDoS logging is within the free quota.
  • Index-based query analysis, reports, and alarms are not charged.
Log Service provides the free quota for your DDoS Logstore. If the data volume is less than the free-quota limit, no charges appears.
Billing item FreeTier quota
Read and write traffic 30 GB/day
Storage space 3 days
Indexing traffic 100 GB/day
Active shard rent 4 days/month
Read/write count  1 million times/day
Internet read traffic 0
Read traffic consumption 0
Read count consumption 0
Note Log data storage time is set to 3 days by default, and when you modify for more than 3 days, extra charges can appear.

Billing method

When the log volume of the website that enables the log analysis function exceeds the free quota, Log Service charges the excess of the quota amount.
Billing item  Extra payment
Read/write traffic (USD/GB) 0.045
Storage space (USD/GB/day) 0.002875
Indexing traffic (USD/GB) 0.0875
Active shard rent (USD/day) 0.01
Read/write count (USD/million times) 0.03
Internet read traffic (USD/GB) 0.2

Billing example

  • FreeTier quota: The average log is about 1600 bytes, about 60 million logs are generated per day, and the storage period is 3 days. The total log volume is about 96 GB per day, not exceeding the quota.
  • Index: The log volume is 150 GB per day, and the 50 GB is charged (150 GB - 100 GB), which is 0.0875 x 50 = 17.5 USD per day.
  • Write transmitting: The log volume is 300 GB per day, logs are compressed in six times. The actual compression size is about 50GB, and the 20GB is charged (50GB - 30GB), which is 0.045 x 20 = 0.9 USD per day.
  • Storage space size:
    • 10 GB of data per day, 2 GB after compression, and 10 GB of indexing traffic. The storage period is 30 days, and the maximum storage capacity after 30 days is 30 × (10+2) = 360 GB, with a 3-day free quota, it is 27 × (10+2) = 324 GB, and the maximum charge for one day storage is 0.002875 × 324 = 0.9315 USD.
    • 1 GB of data per day, 200 MB after compression, and 1 GB indexing traffic. The cumulative maximum storage capacity after 30 days is 30 × (1000 + 200) ≈ 36 GB, with a 3-day free quota, it is 27 × (1000 + 200) ≈ 32.4 GB, and the maximum charge for one day storage is 0.002875 × 32.4 = 0.09315 USD.
  • Active shard rent: Currently, there are 10 shards, 7 read/write shards, and 3 read-only shards. DDoS Logstores are only charged per day. The rental fee for 3 (7 - 4) shards is 0.03 USD per day.
  • Read/write count: The number of website logs is 10 billions per day, and the write count is about 500,000 (on average, 2,000 per time), free of charge.
  • Internet traffic: 2 GB of Log Service data was delivered to non-Alibaba Cloud products, resulting in an external network read traffic of 0.4 USD.

Billing FAQs

  • How can I modify the storage time of website logs?
    1. Log on to the Log Service console, click the Project name to enter the Logstore list. The default Project for DDoS log is ddos-pro-project-Alibaba Cloud Account ID.
    2. Click Modify in the Action column.
    3. On the Data Storage Time page, click Modify.
  • How can I view the current log volume and estimate the cost?
    • To view the cost measurement data on day basis go to Alibaba Cloud Expense Management Center.
      1. Log on to the DDoS IP protection console and click Full Log on the left.
      2. Select the website which log volume you want to view, and click Log Analysis on the right.
      3. Enter the following query statement in the query box, the time range is Yesterday (entire point time):
        __topic__: ddos_access_log | select count(1) as PV
      4. Click Query and select Statistics Chart with the chart type Table .

      You can get data volume of the previous day, and estimate the cost according to your current log storage time.

    • How can I configure Log Service to trigger an alarm when a large number of logs is generated?
      When a large number of DDoS logs is collected, the free quota of Log Service may be exceeded, and the certain charge can appear. If you want to receive an alarm notification when there is such a risk, you can configure Log Service to trigger an alarm when a large number of logs is generated.
      1. Log on to the DDoS IP protection console and click Full Log on the left.
      2. Select the website which log volume you want to view, and click Log Analysis on the right.
      3. Enter the following query statement in the query box, and click Query:
        *| select count(1) as PV
      4. Click Save as Quick Query in the upper-right corner of the query page to enter the information about the query, such as ddos-metering-pv. Then click OK.
      5. Click Save as Alarm and create an alarm configuration, see the following figure. Check the log volume of the past 1 hour every 5 minutes, and trigger an alarm if more than 5.6 million logs are generated. 
        Note To ensure that the daily log volume is less than 100 GB free quota, the average hourly import volume is estimated to be: 100 GB ÷ 1600 bytes ÷ 24 hours ≈ 2.8 million. The example is two times of the hourly log volume, which is 5.6 millions, and can be adjusted according to the actual situation and needs.