How to get started with the Anti-DDoS Proxy Log Analysis service - Anti-DDoS

This topic shows you how to enable and use the Log Analysis feature.

Before you begin

Before you use Log Analysis, familiarize yourself with its core concepts, required storage capacity calculations, and log sampling mechanism. For more information, see Overview.

Prerequisites

You have purchased an Anti-DDoS Proxy instance and added your website to it for protection. For more information, see Add a website.
You have signed in to the Simple Log Service console and activated Simple Log Service (SLS).

Step 1: Purchase log analysis

Log on to the Anti-DDoS Proxy console.
In the top navigation bar, select the region of your instance.
- Anti-DDoS Proxy (Chinese Mainland): Choose the Chinese Mainland region.
- Anti-DDoS Proxy (Outside Chinese Mainland): Choose the Outside Chinese Mainland region.
In the left-side navigation pane, choose Analysis > Log Analysis.
On the Log Analysis page, click Buy Now.

On the Full Logs purchase page, configure the parameters, click Buy Now, and then complete the payment.

Parameter	Description
Applicable To	Select the type of your Anti-DDoS Proxy instance.
Log storage	Select the maximum log storage capacity in terabytes (TB). If your service is active and has sufficient storage, logs are retained for 180 days. After this period, the oldest logs are overwritten by new ones, ensuring that a rolling 180-day window of log data is available. Important If your log storage is exhausted, new logs will not be stored.
Log Storage Period	Select the validity period of the service. Important After the service expires, new logs will not be stored.

Step 2: Authorize log service access

Return to the Log Analysis page and complete the authorization.
The system automatically creates the service-linked role AliyunDDoSCOOLogArchiveRole. Anti-DDoS Proxy uses this role to access SLS and store log data in a dedicated Logstore.
Select the Logstore region for your Anti-DDoS Proxy (Outside Chinese Mainland) instance, which serves as the storage region for your log data.
The supported regions are Singapore, Indonesia (Jakarta), US (Virginia), China (Hong Kong), UK (London), Germany (Frankfurt), Japan (Tokyo), and Malaysia (Kuala Lumpur).
Important
- The selected region is permanent. To change it, you must disable and then re-enable the feature, which permanently deletes the Logstore and all associated log data. This action is irreversible.
- Anti-DDoS Proxy (Chinese Mainland) does not require region selection and is stored in the China (Hangzhou) region by default.
- After you enable Log Analysis, Anti-DDoS Proxy creates a Logstore in the specified region and collects logs from the specified domain names into it.

Step 3: Enable log collection

On the Log Analysis page, enable log collection for your website domain names.

To enable log collection for a single domain name, select the target domain name from the Select Domain Names drop-down list and turn on the Status switch.
To enable log collection for multiple domain names, click Batch Configure in the upper-right corner. In the Batch Configure panel, select the domain names and click Batch Enable.

After you enable log collection, SLS automatically creates a dedicated project for Anti-DDoS Proxy to manage its log data.

You can view the dedicated projects for Anti-DDoS Proxy on the homepage of the Simple Log Service console. The names of dedicated projects start with ddoscoo-project for Anti-DDoS Proxy (Chinese Mainland) and ddosdip-project for Anti-DDoS Proxy (Outside Chinese Mainland). By default, a dedicated project contains the following resources:

One dedicated Logstore is used to store log data from Anti-DDoS Proxy. The dedicated Logstore is named ddoscoo-LogStore for the Anti-DDoS Proxy (Chinese Mainland) service and ddosdip-LogStore for the Anti-DDoS Proxy (Outside Chinese Mainland) service.
Two preset log dashboards (DDoS Access Center and DDoS Operation Center) that provide graphical analysis reports. The content is identical for all instance types.

(Optional) Step 4: Query and analyze logs

On the Log Analysis page, select a target domain name from the Select Domain Names drop-down list.
On the Full Logs tab, set a time range for your query.
Note
- You can query logs from the last 180 days. Older logs are automatically deleted.
- Query results may include logs generated up to 1 minute outside the specified time range.

Enter a query statement in the search box and click Search & Analyze.

A query statement consists of a search statement and an analytic statement, separated by a vertical bar (|): search statement|analytic statement.

Component

Required

Description

search statement

Specifies the search conditions. You can use keywords, fuzzy searches, numeric values, ranges, or a combination of conditions.

If left empty or set to an asterisk ()), no filter is applied, and all data within the current time range is returned. For more information, see Search syntax.

Note

For a description of Anti-DDoS Proxy access log fields, see Log fields.

analytic statement

Processes the search results to perform calculations and statistical analysis. If no search statement is provided, it analyzes the entire dataset within the time range.

If left empty, only the search results are returned without statistical analysis. For more information, see Overview of search and analysis.

Note

You can omit the standard SQL clause from table_name, which means you can omit from log, in the analytic statement.
By default, the first 100 log entries are returned. You can modify this range by using the LIMIT clause.

Query results appear in a table by default. You can also display results in other formats, such as line charts, column charts, and pie charts. For more information, see Overview of statistical charts.

You can also create alerts based on the charts in the dashboard to monitor service status in real time. For more information, see Alerting overview.

Common query examples

Query the number of visits to a domain name

* | SELECT COUNT(*) as times, host GROUP by host ORDER by times desc limit 100

Query interception types

* | select cc_action,cc_phase,count(*) as t group by cc_action,cc_phase order by t desc limit 10

Query QPS

* | select time_series(__time__,'15m','%H:%i','0') as time,count(*)/900 as QPS group by time order by time

Query attacked domain names

* and cc_blocks:1 | select cc_action,cc_phase,count(*) as t group by cc_action,cc_phase order by t desc limit 10

Query attacked URLs

* and cc_blocks:1 | select count(*) as times,host,request_path group by host,request_path order by times

Query request details

* | select date_format(date_trunc('second',__time__),'%H:%i:%s') as time,host,request_uri,request_method,status,upstream_status,querystring limit 10

Query details of 5xx status codes

* and status>499 | select host,status,upstream_status,count(*)as t group by host,status,upstream_status order by t desc

Query request latency distribution

* | SELECT count_if(upstream_response_time<20) as "<20",
count_if(upstream_response_time<50 and upstream_response_time>20) as "<50",
count_if(upstream_response_time<100 and upstream_response_time>50) as "<100",
count_if(upstream_response_time<500 and upstream_response_time>100) as "<500",
count_if(upstream_response_time<1000 and upstream_response_time>500) as "<1000",
count_if(upstream_response_time>1000) as ">1000"

(Optional) Step 5: View log reports

A dashboard is a real-time analytics console provided by SLS. You can save charts that are generated from query results to a dashboard. The Log Analysis feature provides two default dashboards: DDoS Access Center and DDoS Operation Center.

On the Log Analysis page, select a target domain name from the Select Domain Names drop-down list.
Click the Log Reports tab, and then click Time Selection to set a time range.
Note
Each chart in a report has a default time range (for example, 1 hour for traffic metrics and 1 week for trends). However, using the Time Selection control overrides these defaults and updates all charts on the page to reflect the range you specify.

View the default Anti-DDoS Proxy dashboards.

The log report area displays multiple reports in a predefined layout that includes various chart types. For more information about chart types, see Overview of statistical charts.

DDoS Access Center: Displays key website metrics, including PV, UV, inbound traffic, peak traffic rates, access trends, source distributions, accessed domain names, and client types.

Chart	Type	Default time range	Description	Example
PV	Single value	1 hour (relative)	The total number of requests.	100,000
UV	Single value	1 hour (relative)	The total number of unique clients.	100,000
Inbound traffic	Single value	1 hour (relative)	The total inbound traffic of the website, in MB.	300 MB
Peak inbound traffic	Single value	Today (on the hour)	The peak inbound traffic rate for the website, in Bytes/s.	100 Bytes/s
Peak outbound traffic	Single value	Today (on the hour)	The peak outbound traffic rate for the website, in Bytes/s.	100 Bytes/s
Traffic and bandwidth trend	Dual-line chart	1 week (relative)	The trend of inbound and outbound traffic rates for the website, in KB/s.	N/A
PV/UV access trend	Dual-line chart	1 week (relative)	The trend of PV and UV counts.	N/A
Access status distribution	Pie chart	1 week (relative)	The distribution of request status codes (for example, 200, 304, and 400).	N/A
Access source	World map	1 hour (relative)	The distribution of visitor PVs by source country.	N/A
Inbound traffic source (World)	World map	1 hour (relative)	The distribution of total inbound traffic by source country, in MB.	N/A
Inbound traffic source (China)	China map	1 hour (relative)	The distribution of total inbound traffic by source province, in MB.	N/A
Access heatmap	AMap	1 hour (relative)	A heatmap of visitor access by geographic location.	N/A
Internet service provider (ISP)	Donut chart	1 hour (relative)	The distribution of inbound traffic volume by internet service provider (ISP), in MB.	N/A
Referer	Table	1 hour (relative)	The top 100 most frequent referer URLs, hosts, and access counts.	N/A
Access line distribution	Donut chart	1 hour (relative)	The distribution of Anti-DDoS Proxy access lines used by incoming requests.	N/A
Client type distribution	Donut chart	1 hour (relative)	The top 20 most frequent user agents, such as iPhone, iPad, Windows IE, and Chrome.	N/A
Request content type distribution	Donut chart	1 hour (relative)	The top 20 most frequent request content types, such as HTML, Form, JSON, and streaming data.	N/A
Accessed domain names	Donut chart	1 hour (relative)	The top 20 most frequently accessed domain names.	N/A
Top clients	Table	1 hour (relative)	Lists the top 100 clients by visit count, including details such as IP address, PV, inbound traffic, and error and attack counts.	N/A
URL with slowest response	Table	1 hour (relative)	Lists the top 100 URLs with the slowest response times, including details such as the URL, access count, and response time.	N/A

DDoS Operation Center: Shows the overall operational status of the website, including inbound and outbound bandwidth trends, request and interception trends, a list of attackers, and a list of accessed websites.

To receive scheduled dashboard reports by email or DingTalk, click the Subscribe button in the upper-right corner of a dashboard. For more information, see Subscribe to a dashboard.

Anti-DDoS:Get started with Log Analysis