Anti-DDoS:Query and analyze logs

Log sampling

When QPS is within your instance specifications, logs are sampled at close to 1:1, so accuracy is highest when traffic is low. If traffic surges, the sampling ratio adjusts automatically and increases with traffic volume.

Prerequisites

• The website domain is added to Anti-DDoS Proxy. For more information, see Add a website configuration.

• Full log analysis is enabled and collection is turned on for the website domain. For more information, see Overview.

Procedure

1. Log on to the Anti-DDoS Proxy console.

2. In the top navigation bar, select the region of your instance.

   • Anti-DDoS Proxy (Chinese Mainland): Choose a Chinese Mainland region.

   • Anti-DDoS Proxy (Outside Chinese Mainland): Choose an Outside Chinese Mainland region.

3. In the left-side navigation pane, choose Analysis > Log Analysis.

4. Select the domain to query.

   Note

   Make sure that Status is turned on for the domain's full logs. Otherwise, the feature is unavailable.

5. Set the time range to query.

   Select a relative time, a time frame, or a custom range.

   Note

   • Logs are retained for 180 days. Older data is deleted and cannot be queried.

   • Query results may deviate from the specified time range by up to 1 minute.

6. Enter a query and analysis statement in the search box.

   Combine a search statement and an analytics statement, separated by a vertical bar (|). Format: Search statement|Analytics statement.

   Statement type	Optional	Description
   Search statement	Yes	The search condition: a keyword, a fuzzy match, a numeric value, a numeric range, or a combination. If left empty or set to an asterisk (*), all data in the current time range is returned. For more information, see Search syntax and functions. Note For the log fields of Anti-DDoS Proxy access logs, see Fields included in full logs.
   Analytics statement	Yes	Computes and aggregates the search results or all data. If left empty, the search results are returned without statistical analysis. For more information, see Overview of log query and analysis. Note You can omit the from <table name> clause required by standard SQL, which is from log. By default, the first 100 entries are returned. Use LIMIT clause to change the range.

7. Click Full Logs to view the query and analysis results.

   Simple Log Service displays the results as a log distribution histogram, Raw Logs, and Full Logs. You can also configure alerts and save quick queries. For more information, see Query & Analysis page.

8. (Optional) Filter the logs by indexed field. For more information about log fields, see Fields included in full logs. On the Raw Logs tab, the left-side panel lists the Indexed Fields (46 fields in total, such as body_bytes_sent, cache_status, client_proto, and host). The right-side panel shows the details of a single log entry, including fields such as server_protocol, ssl_protocol, status, ua_browser, and ua_os with their values.