Anti-DDoS:Fields included in full logs

Field

Description

Example

__topic__

The log topic. The value is fixed as ddos_access_log, which indicates the logs of Anti-DDoS Proxy.

ddos_access_log

user_id

The ID of the Alibaba Cloud account.

166688437215****

Field

Description

Example

body_bytes_sent

The size of the response body that is actually sent to the client. Unit: bytes.

2

content_type

The content type.

application/x-www-form-urlencoded

host

The origin website.

api.aliyundoc.com

http_cookie

The request cookie.

k1=v1;k2=v2

http_referer

The Referer of the request. If no Referer exists, the returned value is -.

http://aliyundoc.com

http_user_agent

The user agent of the request.

Dalvik/2.1.0 (Linux; U; Android 10; Android SDK built for x86 Build/QSR1.200715.002)

http_x_forwarded_for

The IP address of the upstream user that is forwarded through proxies.

192.0.XX.XX

https

Indicates whether the request is an HTTPS request. Valid values: true and false.

true

matched_host

The origin domain name of the matched configuration, which can be a wildcard domain name. If no match is found, the returned value is -.

*.aliyundoc.com

real_client_ip

The real source IP address of the request. If the IP address cannot be obtained, the returned value is -.

192.0.XX.XX

isp_line

The line information of the Internet service provider (ISP), such as BGP, China Telecom, or China Unicom.

China Telecom

remote_addr

The IP address of the client that initiates the request.

192.0.XX.XX

remote_port

The port number of the client that initiates the request.

23713

src_ip

The IP address of the client that initiates the request.

192.0.XX.XX

src_port

The port number of the client that initiates the request.

23713

request_length

The length of the request. Unit: bytes.

123

request_method

The HTTP method of the request.

GET

start_time

The time when Anti-DDoS Proxy returns a response to the client, in timestamp format.

1735553169000

request_time_msec

The request processing duration. This is the time that Anti-DDoS Proxy takes to receive a request from the client, process the request, and return a response. Unit: milliseconds.

44

request_uri

The path of the request.

/answers/377971214/banner

server_name

The matched hostname. If no match is found, the returned value is default.

api.aliyundoc.com

status

The HTTP status code.

200

time

The time when the request starts, in ISO 8601 format.

2024-12-30T18:06:09+08:00

querystring

The query string of the request.

token=bbcd&abc=123

upstream_addr

The list of back-to-origin addresses, in the IP:Port format. Multiple addresses are separated by commas (,).

192.0.XX.XX:443

upstream_ip

The back-to-origin IP address.

192.0.XX.XX

upstream_response_time

The back-to-origin response time. Unit: seconds.

0.044

upstream_status

The HTTP status code of the back-to-origin request.

200

vip_addr

The IP address of the Anti-DDoS Proxy instance.

203.107.XX.XX

http2_client_fingerprint

The original fingerprint of the HTTP/2 client.

2:0;4:2097152;3:100|10485760|0|m,s,p,a

http2_client_fingerprint_md5

The original fingerprint of the HTTP/2 client is extracted and hashed by using the MD5 algorithm. The result is an MD5 hash value of a fixed length (128 bits, or 32 characters).

The hash value is used to analyze and identify different clients, which enables more secure and efficient communication.

ad8424af1cc590e09f7b0c499bf7fcdb

ssl_client_ja3_fingerprinting

The original JA3 fingerprint of the client. It contains key parameters of the TLS handshake process, such as the TLS version, cipher suites, the compression algorithm, and TLS extensions.

771,4865-49195-49196-49197,29,0

ssl_client_ja3_fingerprinting_md5

The MD5 hash value that is generated from the original JA3 fingerprint.

c1bd7c674bbec9f0f2474e3eee3564f4

ssl_client_ja4_fingerprinting

The original JA4 fingerprint of the client. It contains key parameters of the TLS handshake process, such as the TLS version, cipher suites, the compression algorithm, TLS extensions, the browser version, and the operating system.

t13d1516h2_acb858a92679_e5627efa2ab1

ssl_client_ja4_fingerprinting_md5

The MD5 hash value that is generated from the original JA4 fingerprint.

8c3d99fb6ed08a39c799aad27b4854f4

ssl_client_tls_fingerprinting_md5

The MD5 hash value of the client TLS fingerprint.

21d696a76962c9912d765a9372d8c773

cache_status

Indicates whether the requested data hits the cache of the Anti-DDoS Proxy device.

• hit: The cache is hit.

• miss: The cache is not hit.

hit

traceid

The globally unique identifier that is generated for each request in a distributed system. The identifier spans the entire request processing flow and correlates request information across the logs of service components, which facilitates tracing, troubleshooting, and performance analysis.

ac11000117388144519311412e387f

Field

Description

Example

ua_browser

The identifier of the browser.

ie9

ua_browser_family

The family of the browser.

internet explorer

ua_browser_type

The type of the browser.

web_browser

ua_browser_version

The version of the browser.

9.0

ua_device_type

The type of the client device.

computer

ua_os

The identifier of the operating system that runs on the client.

windows_7

ua_os_family

The family of the operating system that runs on the client.

windows

server_protocol

The protocol and version number that the origin server uses to respond to the back-to-origin request from Anti-DDoS Proxy.

HTTP/1.1

ssl_protocol

The SSL or TLS protocol and version that the client request uses.

TLSv1.2

ssl_cipher

The cipher suite that the client request uses.

ECDHE-RSA-AES128-GCM-SHA256

ssl_handshake_time

The time when the client completes the TLS handshake. Unit: ms.

99

Field

Description

Example

cc_action

The action of the HTTP flood mitigation policy. Valid values:

• accept: allows the access request.

• block: blocks the access request.

• challenge: initiates verification on the source IP address of the access request by using a challenge algorithm.

• alarm: indicates that an observation rule is hit and the access request is allowed.

accept

cc_blocks

Indicates whether the request is blocked by the HTTP flood mitigation policy. Valid values:

• 1: indicates that the request is blocked.

• Other values indicate that the request is allowed.

1

cc_phase

The type of the mitigation policy. Valid values:

• The new Tengine engine

  • gfbwip: Blacklist and whitelist

  • gfcc: HTTP flood protection mode

  • gfacl: Custom mitigation policy

  • gfglobal: Global mitigation policy

  • gfareaban: Location blacklist

• The previous famax engine

  • ipFilter: Blacklist and whitelist

  • statProtect: HTTP flood protection mode

  • preciseProtect: Custom mitigation policy

  • regionBLock: Location blacklist

gfbwip

last_module

The type of the mitigation policy for website services. Valid values:

• gfareaban: Location blacklist

• gfbwip: Blacklist and whitelist

• gfacl: Accurate access control

• gfcc: HTTP flood blocking

• gfglobal: Global mitigation policy

gfareaban

last_owner

The name of the website mitigation policy rule, including the mitigation policies that Anti-DDoS Proxy automatically issues and the custom mitigation policies that users create.

The mitigation policies that Anti-DDoS Proxy automatically issues include:

• Names that start with smartcc_ : indicate intelligent protection policies based on AI.

• Names that start with global: indicate global mitigation policies.

• Names that start with gf_internal: indicate the built-in HTTP flood protection policies of the system.

global_th_4_C_****|global

last_result

The final mitigation action on the request. Valid values:

• ok: indicates that the request is allowed.

• failed: indicates that the request is not allowed, including verification failures and blocks.

failed