Anti-DDoS Proxy works with Alibaba Cloud Simple Log Service to provide the log analysis feature for your website access logs. The log analysis feature is a value-added service that you must enable before use. After you enable the log analysis feature, Simple Log Service collects the logs of website workloads protected by Anti-DDoS Proxy in real time and provides log query and analysis and Log Reports based on the collected log data.
What is the log analysis feature?
The Anti-DDoS Proxy log analysis feature is built on Alibaba Cloud Simple Log Service. The feature provides a log query and analysis page in the Anti-DDoS Proxy console, so you can analyze the website workloads connected to Anti-DDoS Proxy on your own. After you enable full logs, you can also use the log consumption and delivery features of Simple Log Service to manage all Anti-DDoS Proxy website access logs.
Anti-DDoS Proxy uses different log collection management platforms depending on the region of the product. On the Security Overview and Attack Analysis pages, you can view centralized statistics of the service traffic and attack information of the workloads connected to Anti-DDoS Proxy. Charts and information are displayed based on the Anti-DDoS Proxy instances that you purchase in different regions.
Anti-DDoS Proxy (Chinese Mainland) is managed by the management platform in the China (Hangzhou) region. Processed logs are delivered to China (Hangzhou).
Anti-DDoS Proxy (Outside Chinese Mainland) is managed by the management platform in the Singapore region. Processed logs can be delivered to Singapore, Indonesia (Jakarta), US (Virginia), China (Hong Kong), UK (London), Germany (Frankfurt), Japan (Tokyo), or Malaysia (Kuala Lumpur). You specify the delivery region.
For more information about Alibaba Cloud Simple Log Service, see What is Simple Log Service?.
Use cases
The Anti-DDoS Proxy log analysis feature meets the following requirements:
Troubleshoot website access exceptions
After you enable log collection for your website workloads, you can query and analyze the collected logs in real time. For example, use SQL statements to analyze website access logs. Quickly troubleshoot access exceptions, analyze issues, and view information such as read/write latency and ISP distribution.
Track CC attack sources
Anti-DDoS Proxy website access logs record the distribution and sources of CC attackers. By querying and analyzing website access logs in real time, you can track the sources of CC attackers and trace attack events. The results provide a reference for your response strategies. For example, you can analyze the country distribution of CC attackers and query page views (PVs).
Analyze website operations
Website access logs record website access data in real time. You can run SQL queries on the collected access log data to get real-time access insights. For example, determine website popularity, access sources and channels, and client distribution to support website operations analysis.
How do I calculate the log storage capacity that I need?
In most cases, each request log occupies about 2 KB of storage space. If your workload averages 500 QPS, the storage space required for one day of logs is 500*60*60*24*2 = 86,400,000 KB (about 82 GB). The default retention period is 180 days. To store the logs of the last 180 days, select a log storage capacity of 14,832 GB (about 14.5 TB).
Log sampling
When QPS is within your instance specifications, logs are sampled at close to 1:1, so accuracy is highest when traffic is low. If traffic surges, the sampling ratio adjusts automatically and increases with traffic volume.
Billing
The log analysis feature supports only the subscription billing method. For specific pricing, see the log analysis instance buy page.
Log storage capacity | Unit price of Anti-DDoS Proxy (Chinese Mainland)(USD/month) | Unit price of Anti-DDoS Proxy (Outside Chinese Mainland)(USD/month) |
3 TB | 234 | 468 |
5 TB | 390 | 780 |
10 TB | 780 | 1,560 |
20 TB | 1,560 | 3,120 |
50 TB | 3,900 | 7,800 |
100 TB | 7,800 | 15,600 |
200 TB | 15,600 | 31,200 |
500 TB | 39,000 | 78,000 |
800 TB | 62,400 | 124,800 |
1000 TB | 78,000 | 156,000 |
References
Document | Description |
Describes how to enable and quickly use the log analysis feature. Important The first time you use the log analysis feature, you must follow this topic to enable the service and complete the related configurations. | |
Describes the fields included in Anti-DDoS Proxy log data. | |
Describes how to use query statements to query and analyze Anti-DDoS Proxy log data. | |
Describes how to use the preset dashboard charts of the log analysis feature, including DDoS Operation Center and DDoS Access Center. |