The Log Analysis page in the Anti-DDoS Pro and Anti-DDoS Premium console provides two built-in dashboards powered by Simple Log Service (SLS): DDoS Access Center and DDoS Operation Center. Once you enable Log Analysis for a domain name, you can use these dashboards to monitor website traffic and track attack activity.
Prerequisites
Before you begin, make sure that you have:
A domain name added to Anti-DDoS Pro or Anti-DDoS Premium. For more information, see Add one or more websites.
Log Analysis enabled for the domain name. For more information, see Overview.
View log reports
Log on to the Anti-DDoS Pro console.
In the top navigation bar, select the region of your instance.
Anti-DDoS Proxy (Chinese Mainland): Select Chinese Mainland for Anti-DDoS Pro instances.
Anti-DDoS Proxy (Outside Chinese Mainland): Select Outside Chinese Mainland for Anti-DDoS Premium instances.
In the left-side navigation pane, choose Investigation > Log Analysis.
Select the target domain name, then click Log Reports. Two dashboards are available:
DDoS Access Center: Focuses on website traffic — page views (PVs), unique visitors (UVs), inbound traffic volume, bandwidth peaks, access source distribution by country or ISP, client types, and response performance.
DDoS Operation Center: Focuses on attack defense — inbound and outbound bandwidth trends, the ratio of total requests to intercepted attack requests, attacker details, and the most-targeted websites.
The Status switch must be turned on for the domain name.
Each chart is rendered using SLS chart types. For a description of each chart type, see Chart overview.
To filter all charts to the same time range, use the time picker in the upper-right corner of the dashboard. The selected time range applies to all charts on the dashboard at once.
Click Please Select in the upper-right corner.
In the Time pane, set a time range. Options include a relative time range, a time frame, or a custom time range.
The time range is not saved. The next time you open the dashboard, each chart reverts to its default time range.
Charts on the default dashboards
Each chart has its own default time range. To apply a uniform time range to the entire dashboard, use the time picker described in the previous section.
DDoS Access Center
Use this dashboard to answer questions about who is accessing your website, where they come from, and how your website is performing under normal conditions.
| Chart name | Type | Default time range | Description |
|---|---|---|---|
| PV | Single value | 1 hour (relative) | Total page views. Example: 100,000 |
| UV | Single value | 1 hour (relative) | Total unique visitors. Example: 100,000 |
| Inbound traffic | Single value | 1 hour (relative) | Total inbound traffic volume. Unit: MB. Example: 300 MB |
| Peak network in | Single value | Today (time frame) | Maximum inbound bandwidth. Unit: byte/s. Example: 100 Bytes/s |
| Peak network out | Single value | Today (time frame) | Maximum outbound bandwidth. Unit: byte/s. Example: 100 Bytes/s |
| Traffic network trend | Double-line chart | 1 week (relative) | Trends of inbound and outbound traffic. Unit: KB/s |
| PV/UV trends | Double-line chart | 1 week (relative) | Trends of page views and unique visitors |
| Access status distribution | Pie chart | 1 week (relative) | Distribution of HTTP status codes (such as 200, 304, and 400). Unit: count/minute |
| Access source | World map | 1 hour (relative) | Distribution of page views by country |
| Traffic in source (world) | World map | 1 hour (relative) | Distribution of inbound traffic by country. Unit: MB |
| Traffic in source (China) | Map of China | 1 hour (relative) | Distribution of inbound traffic by province in China. Unit: MB |
| Access heat map | Amap | 1 hour (relative) | Geographic heat map of visitor locations |
| Network provider source | Donut chart | 1 hour (relative) | Distribution of inbound traffic by ISP (such as China Telecom, China Unicom, China Mobile, and CERNET). Unit: MB |
| Referer | Table | 1 hour (relative) | Top 100 referer URLs, target hosts, and redirect counts |
| Access line distribution | Donut chart | 1 hour (relative) | Distribution of requests across Anti-DDoS Pro or Anti-DDoS Premium access lines |
| Client distribution | Donut chart | 1 hour (relative) | Top 20 user agents (such as iPhone, iPad, Internet Explorer, and Google Chrome) |
| Request content type distribution | Donut chart | 1 hour (relative) | Top 20 requested content types (such as HTML, form, JSON, and streaming) |
| Access domain name | Donut chart | 1 hour (relative) | Top 20 most visited domain names |
| Top clients | Table | 1 hour (relative) | Top 100 clients by request volume, including IP address, page views, inbound traffic, invalid request count, and attack count |
| URL with slowest response | Table | 1 hour (relative) | Top 100 URLs with the longest response times, including website, URL, response time, and access count |
DDoS Operation Center
Use this dashboard to answer questions about attack activity — how many requests were intercepted, which IP addresses are attacking, and which websites are most targeted.
| Chart name | Type | Default time range | Description |
|---|---|---|---|
| Inbound and outbound bandwidth (Kbit/s) | Double-line chart | 1 week (relative) | Trends of inbound and outbound bandwidth |
| Request and interception | Double-line chart | 1 week (relative) | Trends of total requests and intercepted attack requests |
| Attacker list | Table | 1 hour (relative) | Top 100 attackers by attack volume, including attacker IP address, source location, attack count, and total attack traffic |
| Top 10 attacked websites | Table | 1 hour (relative) | The 10 most targeted websites |
What's next
To learn more about chart types displayed in these dashboards, see Chart overview.