All Products
Search
Document Center

Anti-DDoS:System logs

Last Updated:Jun 24, 2026

This topic describes how to query the elastic service bandwidth bills, elastic QPS bills, alerts on exceeded instance specifications, and destination rate-limiting events for your Anti-DDoS Proxy instance within the last 90 days.

Query bills for elastic bandwidth

Scope

Billing and settlement times

Billing mode

Bill generation time

Settlement time

Daily 95th percentile

At 14:00 the next day, Anti-DDoS Proxy pushes the elastic bandwidth bill for the previous calendar day through the System Logs page, and sends a billing notification to the contact of your Alibaba Cloud account via email.

At 17:00 the next day, Alibaba Cloud deducts the corresponding fee from your account balance.

Monthly 95th percentile

Before 10:00 on the first day of the next month, Anti-DDoS Proxy pushes the elastic bandwidth bill for the previous calendar month through the System Logs page, and sends a billing notification to the contact of your Alibaba Cloud account via email.

At 10:00 on the third day of the next month, Alibaba Cloud deducts the corresponding fee from your account balance.

Procedure

  1. Log on to the Anti-DDoS Proxy console.

  2. In the top navigation bar, select the region of your instance.

    • Anti-DDoS Proxy (Chinese Mainland): Choose the Chinese Mainland region.

    • Anti-DDoS Proxy (Outside Chinese Mainland): Choose the Outside Chinese Mainland region.

  3. In the left-side navigation pane, choose Analysis > System Logs.

  4. On the System Logs page, select Monthly 95th Percentile of Burstable Clean Bandwidth or Daily 95th Percentile of Burstable Clean Bandwidth. Specify the IP address to query and the time range, then click image..png to view elastic bandwidth bills. The following table describes the values in the Description column and Status column:

    Warning

    Starting 10:00 (UTC+8) on March 6, 2026, the Monthly 95th percentile billing method is no longer available for new purchases. Manual adjustments to burstable clean bandwidth in the console — such as enabling, disabling, changing billing methods, or changing bandwidth specifications — are also no longer available. For details, see [Update] Adjustment to the Anti-DDoS Burstable Billing Feature on March 6, 2026.

    • Description

      Billing mode

      Description of each value in the Description column

      Monthly 95th percentile

      • Traffic peak: The traffic peak of your service within the month.

      • Excess bandwidth: Traffic peak minus the bandwidth specification in effect on the last day the elastic bandwidth feature was enabled within the calendar month.

      • Elastic bandwidth usage: The elastic bandwidth usage, calculated as the monthly 95th percentile bandwidth value minus the bandwidth specification in effect on the last day the elastic bandwidth feature was enabled within the calendar month. For the calculation method of the monthly 95th percentile bandwidth value, see Billing of burstable clean bandwidth.

      Daily 95th percentile

      • Traffic peak: The daily 95th percentile bandwidth peak of the calendar day.

      • Excess bandwidth: The daily 95th percentile bandwidth peak minus the bandwidth specification in effect on that day.

      • Elastic bandwidth usage: The elastic bandwidth usage, calculated as the daily 95th percentile bandwidth value minus the bandwidth specification in effect on that day. For the calculation method of the daily 95th percentile bandwidth value, see Billing of burstable clean bandwidth.

    • Status

      Status

      Description

      Pending billing

      The elastic bandwidth usage has been recorded, but the bill has not been formally generated. You can click Details in the View column to query the actual service traffic details in the Details dialog box.

      Note

      If you have any questions about the actual bandwidth usage, provide feedback promptly. If the bill usage is confirmed to differ from the actual bandwidth usage, Anti-DDoS Proxy sets the status to Billing Terminated (the bill is closed without incurring actual charges).

      Billed

      The bill has been formally generated based on the elastic bandwidth usage. Alibaba Cloud deducts the actual billed amount from your account balance. Ensure that your Alibaba Cloud account has a sufficient balance to avoid suspension of pay-as-you-go services due to overdue payments.

      Billing Terminated

      The bill has been closed and no charges are incurred.

Query bills for elastic QPS

Applicable scope

Billing and settlement times

Billing mode

Bill generation time

Settlement time

Daily 95th percentile

At 10:00 the next day, Anti-DDoS Proxy pushes the elastic QPS bill for the previous calendar day through the System Logs page, and sends a billing notification to the contact of your Alibaba Cloud account via email.

At 16:00 the next day, Alibaba Cloud deducts the corresponding fee from your account balance.

Monthly 95th percentile

Before 10:00 on the first day of the next month, Anti-DDoS Proxy pushes the elastic QPS bill for the previous calendar month through the System Logs page, and sends a billing notification to the contact of your Alibaba Cloud account via email.

At 11:00 on the third day of the next month, Alibaba Cloud deducts the corresponding fee from your account balance.

Procedure

  1. Log on to the Anti-DDoS Proxy console.

  2. In the top navigation bar, select the region of your instance.

    • Anti-DDoS Proxy (Chinese Mainland): Choose the Chinese Mainland region.

    • Anti-DDoS Proxy (Outside Chinese Mainland): Choose the Outside Chinese Mainland region.

  3. In the left-side navigation pane, choose Analysis > System Logs.

  4. On the System Logs page, select Monthly 95th Percentile of Burstable QPS or Daily 95th Percentile of Burstable QPS. Specify the IP address to query and the time range to view elastic QPS bills. The following table describes the values in the Description column and Status column:

    Warning

    Starting from 10:00:00 UTC+8 on March 6, 2026, new customers can no longer enable the monthly 95th percentile billing mode for burstable QPS. You also cannot manually adjust burstable QPS settings in the console, including enabling or disabling the feature, changing the billing mode, or modifying the specification. For more information, see [Update] Announcement on changes to the burstable billing feature for Anti-DDoS on March 6, 2026.

    • Description

      Billing mode

      Description of each value in the Description column

      Daily 95th percentile

      • Peak QPS: The daily 95th percentile QPS peak of the calendar day.

      • Excess instance QPS: The daily 95th percentile QPS peak minus the service QPS specification in effect on that day.

      • Elastic QPS usage: The elastic QPS usage, calculated as the daily 95th percentile QPS value minus the service QPS specification in effect on that day. For the calculation method of the daily 95th percentile QPS value, see Billing of burstable QPS.

      Monthly 95th percentile

      • Peak QPS: The actual peak service QPS within the month.

      • Excess instance QPS: Peak service QPS minus the service QPS specification in effect on the last day the elastic QPS feature was enabled within the calendar month.

      • Elastic QPS usage: The elastic QPS usage, calculated as the monthly 95th percentile QPS value minus the service QPS specification in effect on the last day the elastic QPS feature was enabled within the calendar month. For the calculation method of the monthly 95th percentile QPS value, see Billing of burstable QPS.

    • Status

      Status

      Description

      Pending billing

      The elastic QPS usage has been recorded, but the bill has not been formally generated. You can click Details in the View column to query the actual service QPS details in the Details dialog box.

      Note

      If you have any questions about the actual QPS usage, provide feedback promptly. If the bill usage is confirmed to differ from the actual QPS usage, Anti-DDoS Proxy sets the status to Billing Terminated (the bill is closed without incurring actual charges).

      Billed

      The bill has been formally generated based on the elastic QPS usage. Alibaba Cloud deducts the actual billed amount from your account balance. Ensure that your Alibaba Cloud account has a sufficient balance to avoid suspension of pay-as-you-go services due to overdue payments.

      Billing Terminated

      The bill has been closed and no charges are incurred.

Query alerts on exceeded instance specifications

Applicable scope

An Anti-DDoS Proxy (Chinese Mainland) or Anti-DDoS Proxy (Outside Chinese Mainland) instance is purchased. For more information, see Purchase an Anti-DDoS Proxy instance.

Procedure

  1. Log on to the Anti-DDoS Proxy console.

  2. In the top navigation bar, select the region of your instance.

    • Anti-DDoS Proxy (Chinese Mainland): Choose the Chinese Mainland region.

    • Anti-DDoS Proxy (Outside Chinese Mainland): Choose the Outside Chinese Mainland region.

  3. In the left-side navigation pane, choose Analysis > System Logs.

  4. On the System Logs page, select Alerts on Exceeded Upper Limits. Specify the IP address to query and the time range to view the alerts on exceeded instance specifications. The following table describes the values in the Description column and Details column:

    • Description

      The Anti-DDoS IP address and event type that triggered the alert. Event types include service bandwidth, new connections, and concurrent connections. An alert is generated when the specification for an event type exceeds the purchased specification.

    • Details

      Click View in the Details column of an alert to view the full alert details.

      For example, if concurrent connections exceed the specification, you can see from the alert details that the number of active connections has exceeded the concurrent connection limit, triggering the alert.

Query destination rate-limiting events

When metrics such as new connections, concurrent connections, or service bandwidth significantly exceed the instance specifications, a rate-limiting policy is triggered. This affects your services and generates a destination rate limit event.

  • If rate limiting is triggered by normal service traffic, upgrade your instance as soon as possible. For more information, see Upgrade an instance.

  • If rate limiting is triggered by a DDoS attack, adjust your protection settings promptly. For more information, see Protection settings.

Applicable scope

An Anti-DDoS Proxy (Chinese Mainland) or Anti-DDoS Proxy (Outside Chinese Mainland) instance is purchased. For more information, see Purchase an Anti-DDoS Proxy instance.

Procedure

  1. Log on to the Anti-DDoS Proxy console.

  2. In the top navigation bar, select the region of your instance.

    • Anti-DDoS Proxy (Chinese Mainland): Choose the Chinese Mainland region.

    • Anti-DDoS Proxy (Outside Chinese Mainland): Choose the Outside Chinese Mainland region.

  3. In the left-side navigation pane, choose Analysis > System Logs.

  4. On the System Logs page, select Destination Rate Limit Events. Specify the IP address to query and the time range to view the events.

    You can click View in the Details column of a destination rate-limiting event to view the event details.

Related topics