customize and subscribe to offline analysis data from operations reports for accelerated domain names - CDN

Operations reports provide the offline analytics data of your accelerated domain names over different time periods. Use this data to understand how your accelerated domain names are running and to analyze the status of your business.

Prerequisites

You have added an accelerated domain name. If you have not, see Add an accelerated domain name.

Features

By default, operations reports collect and display user access data such as PV/UV, Regions and ISPs, Domain Names, , Popular Referer, Popular URLs, Popular Back-to-origin URLs, and Top Client IPs. Customize and subscribe to reports based on your business requirements. The following table describes each type of report content.

Report content	Description
PV/UV	Query the PV and UV of a domain name by time.
Regions and ISPs	View the access region distribution and the ISP distribution of users in the Chinese mainland, China (Hong Kong), Macao (China), Taiwan (China), and regions outside China over a specified time range.
Domain Names	Displays the access ranking of each accelerated domain name, including the percentage, traffic or peak bandwidth, time of peak, and number of requests. Note The minimum granularity for a domain name ranking query is one day. For example, after you select a date to query, the system displays the top 200 records for that date.
Popular Referer	Displays the traffic, traffic percentage, number of requests, and request percentage of popular Referers used for hotlink protection. Note When the operations report feature analyzes user logs, it collects statistics on the `http_referer` field in user request logs. The statistical results include the following two cases: If the Referer in a user request is a standard URL, the operations report counts and records the domain name in the URL. For example, the following URLs are both counted as `example.com`: `http://example.com/aliyundoc/` and `https://example.com/aliyundoc/image`. If the Referer in a user request is not a standard URL, the operations report counts it as a hyphen (`-`).
Popular URLs	Query the popular URLs of a specified domain name for a specified status code and date, including the traffic, traffic percentage, number of requests, and request percentage. Note The minimum granularity for a popular URL query is one day. For example, after you select a date to query, the system displays the top 3,000 records for that date.
Popular Back-to-origin URLs	Query the popular back-to-origin URLs of a specified domain name for a specified status code and date, including the traffic, traffic percentage, number of requests, and request percentage. Note The minimum granularity for a popular back-to-origin URL query is one day. For example, after you select a date to query, the system displays the top 100 records for that date.
Top Client IPs	Query the top client IPs of a specified domain name for a specified region and date. You can sort the results by traffic or by number of requests. Note The minimum granularity for top client IPs is one day. After you select a date to query, the system displays the top 200 records for that date if you query all regions, or the top 20 records for that date if you query a single region.

Note

After you subscribe to operations reports, Alibaba Cloud CDNperiodically sends report emails to your mailbox. The traffic data in these reports is measured in bytes.

Customize an operations report

Before you customize or subscribe to operations reports, review the following items:

Customization comes first — The system generates statistics only for the domain names and the report content that you customize. If you have not customized the reports, the subscription fails.
Subscription quota — The subscription feature is in trial operation. Each Alibaba Cloud account, including its Resource Access Management (RAM) users, can create a maximum of five subscription tasks.
Data latency — Because of log integrity latency, operations report data is delayed by more than 6 hours. If you create an operations report on Day T, you can obtain the report data for Day T+1 and later, but not for Day T or earlier. Therefore, the report data for Day T+1 is available only after 06:00 on Day T+1. For a subscription, the system sends a report only after it collects all the data.
Data generation intervals — The generation interval varies by metric from 1 to 6 hours:
Popular URL (sorted by number of requests or traffic): 6 hours
Popular Referer (sorted by number of requests or traffic): 1 hour
Popular back-to-origin URL (sorted by number of requests or traffic): 1 hour
Top client IP (sorted by number of requests or traffic): 6 hours
Ranking of domain names (sorted by traffic only): 1 [TODO: confirm time unit]
PV/UV: 1 hour
Access region distribution: 1 hour
ISP distribution: 1 hour
Console display — Other report data is not displayed in the console by default. Subscribe to those reports, have them sent to a specified mailbox, and then query the data.

Log on to the CDN console.
In the left-side navigation pane, choose Statistics > Operations Reports.
On the Operations Reports tab, turn on the Customize Operations Report switch.
You can view detailed information for PV/UV, Regions and ISPs, Domain Name Ranking, Popular Referer Headers, Popular URLs, Popular Origin URLs, and Top Client IPs for your account.
Note
Domain Name Ranking shows the ranking of domain names by traffic aggregated across all regions and does not support filtering by region. To find the traffic ranking of domain names in a specific region (for example, outside the Chinese mainland), use one of the following alternatives:
1. Use the Usage Query feature to select the target domain names and a billing region (Asia Pacific 1, Asia Pacific 2, Asia Pacific 3, North America, South America, Europe, or Middle East and Africa), and then query and export the traffic data for comparison. Usage Query supports 5-minute granularity and allows you to export data for up to 30 days.
2. Create a tracking task to subscribe to Operations Reports and receive the domain name ranking data by email. Subscribed operations reports provide data at a daily granularity (T+1).

Subscribe to an operations report

Subscribe to operations reports to have them delivered by email. After you subscribe, the system sends the reports to the mailbox that you specify, and you can analyze the report content. Customize the report content before you subscribe, and check the subscription quota.

Log on to the CDN console.
In the left-side navigation pane, choose Statistics > Operations Reports.
On the Operations Reports page, click the Tracking Tasks tab.

Click Tracking Tasks and configure the subscription settings.

Parameter	Description
Task Name	Enter a name for the tracking task.
Report Type	The report frequency. Valid values: Daily, Weekly, and Monthly. Daily: After the log data from the previous day is fully collected and processed, the system sends the report to your email address. Weekly: The report is calculated by calendar week. After a week of log data is fully collected and processed, the system sends the report to your email address. The report for the previous week is typically sent on the following Monday morning. Monthly: The report is calculated by calendar month. After a month of log data is fully collected and processed, the system sends the report to your email address.
Email Address	The recipient's email address. To add multiple addresses, separate them with commas (,).
Domain Names	Select the accelerated domain names for which you want to subscribe to operations reports.
Report Metrics	Select the report metrics to which you want to subscribe.

Click OK. A "The tracking task is created." message appears.
Note
- After you create a tracking task, if you delete a report metric from a customized operations report, the deleted metric is displayed with an error (as its report ID) when you click Modify for the task. This indicates that the metric is no longer customized and you cannot track it. For the mapping between report IDs and report names, see Report Mappings.
- In the reports, traffic data is measured in bytes.
Optional: Modify a Tracking Tasks.
To modify a tracking task, select it, click Modify, update the settings as described in Step 4, and then click OK.

Report ID to metric mapping

This table maps report IDs to their corresponding metric names.

Report ID	English name	Metric name	Calculation method
1	TopUrlByAcc	popular URLs (ranked by number of requests)	Ranked by the number of requests for each URL.
3	TopUrlByTraf	popular URLs (ranked by traffic)	Ranked by traffic. The traffic value includes the TCP packet header overhead. For more information, see Why do traffic values differ among monitoring, usage query, and log statistics?.
5	TopReferByAcc	popular referers (ranked by number of requests)	Based on the number of requests.
7	TopReferByTraf	popular referers (ranked by traffic)	Ranked by traffic. The traffic value includes the TCP packet header overhead. For more information, see Why do traffic values differ among monitoring, usage query, and log statistics?.
9	OriginTopUrlByAcc	popular origin URLs (ranked by number of requests)	Based on the number of requests for each URL.
11	OriginTopUrlByTraf	popular origin URLs (ranked by traffic)	Ranked by traffic. The traffic value includes the TCP packet header overhead. For more information, see Why do traffic values differ among monitoring, usage query, and log statistics?.
13	TopIpByAcc	top client IPs (ranked by number of requests)	Ranked by the number of requests from each client IP.
15	TopIpByTraf	top client IPs (ranked by traffic)	Ranked by traffic. The traffic value includes the TCP packet header overhead. For more information, see Why do traffic values differ among monitoring, usage query, and log statistics?.
17	DomainByTraf	domain name ranking (ranked by traffic)	Ranked by the traffic of each domain name.
19	DomainPvUv	PV/UV	PV: Counted by the number of daily terminal accesses. UV: Counted by the number of unique IP addresses. Each IP address is counted only once.
21	AreaTrafStat	Visitor distribution by region	Calculates the distribution of requests for a domain name across different regions.
23	IspTrafStat	Distribution by ISP	Calculates the distribution of requests for a domain name across different ISPs.

IP data analysis guide

After you view the top client IPs in an operations report, you can analyze the data to identify potential security risks and take protective action.

Analyze IP geolocation

Top client IPs in operations reports are ranked by request count or traffic volume. To identify the geographic origin of these IPs, use an IP geolocation lookup tool to check the region and ISP of each IP address. Compare the results against your expected business coverage areas to detect unusual access patterns, such as high-volume traffic from regions where you do not have business operations.

Identify abnormal IPs

Consider an IP address abnormal if any of the following conditions apply:

A single IP has a significantly higher request volume than normal. This may indicate crawler activity or volumetric attack traffic.
Requests originate in large quantities from regions outside your business coverage areas.
Traffic patterns show sudden spikes that do not align with normal business activity.

Configure security protection

After you identify abnormal IPs, configure the following security features to protect your CDN resources:

To block or allow specific IP addresses, see Configure an IP address blacklist or whitelist.
To control access based on the HTTP Referer header, see Configure a Referer blacklist or whitelist.
To authenticate access requests using a signing algorithm, see Configure URL signing.

Monitor with subscription tasks

You can create a subscription task to receive operations report emails on a regular basis. Select a daily, weekly, or monthly delivery frequency to continuously monitor changes in the top client IPs over time. For more information about creating a subscription task, see the Subscribe to an operations report section of this topic.

Data granularity and real-time analysis

Operations reports use daily data aggregation and are typically generated around 06:00 on the following day (T+1). Therefore, the top client IP data reflects the previous day's access and is not available in real time.

If you require real-time analysis of client IP access patterns, enable the real-time log delivery feature to push CDN logs to Simple Log Service (SLS). For more information, see Best practices for delivering CDN real-time logs to SLS for user access data analysis.

Disable a customized operations report

When you disable Customize Operations Report, all tracking tasks stop generating data, but the Tracking Tasks remain. If you no longer need a tracking task, you can manually delete it on the Tracking Tasks tab. For more information, see Delete a tracking task.

Log on to the CDN console.
In the left-side navigation pane, choose Statistics > Operations Reports.
On the Operations Reports page, turn off the Disable Operations Report switch.
Click OK to disable the customized operations report.

Delete a tracking task

Log on to the CDN console.
In the left-side navigation pane, choose Statistics > Operations Reports.
On the Tracking Tasks tab, find the task that you want to delete and click Delete in the Actions column.
Click OK to delete the tracking task.

FAQ

No data in customized reports

Due to delays in log collection, data generation takes time. A report customized on a specific day is typically generated on the next day. For example, a report customized on August 1, 2021, is generated at around 06:00 on August 2, 2021.

If the console still shows no data on the next day, one of the following issues may have occurred:

The domain name that you added when customizing the operations report has no traffic. Click Customize Operations Report, check the Selected Domain Names to confirm that the target domain name is correct and has traffic. If the domain name is incorrect, you must customize the report again for the correct domain name and wait for data generation.
You did not select the required report metrics when you customized the report. For example, if you want to view the Popular URLs report but did not select the Popular URLs metric during customization, no data is generated for the report. In this case, you must select the report metrics again for the domain name and wait for data generation.

Tracking task limit

Each Alibaba Cloud account, including its RAM users, can create up to five tracking tasks. You must customize an operations report before creating a tracking task; otherwise, the subscription will fail.

Viewing real-time data

Operations reports provide data aggregated daily and are typically generated around 06:00 on the following day (T+1). Therefore, you cannot use them to view the current day's access data. To view today's CDN access data in real time, such as access URLs and the number of requests, you can enable the real-time log delivery feature. This feature delivers CDN logs to Simple Log Service (SLS) for real-time querying and analysis. Real-time log delivery is a paid feature. For more information, see Configure real-time log delivery.

Related APIs

For API operations related to operations reports, see Operations reports.