Notes on offline logs - CDN - Alibaba Cloud Documentation Center

Content Delivery Network (CDN) collects domain access logs on an hourly basis. You can download the daily log data of a domain name collected in the last 30 days to your local PC for further analysis. This topic introduces the information you may need to know before and after downloading the logs.

Notes on log download

You can download your logs of a specified date. On the CDN console, choose Logs & Reports > Logs > Offline logs > Log Download, filter the logs by date and time, and click Download.
In most cases, log data is generated within 24 hours after an event occurs. In some cases, it may take longer. For real-time logs, see Real-time logs.
By default, CDN stores log data for 30 days. If you want to retain log data for a longer period of time, you can use the log storage feature to store log data to an Object Storage Service (OSS) bucket. For more information, see Use Function Compute to deliver logs.

Notes on log usage

The naming rule of log files: accelerated domain name_year_month_day_start time_end time[extension field].gz. The extension field starts with an underscore (_). Example: aliyundoc.com_2018_10_30_000000_010000_xx.gz.
Note
Names of specific log files may not contain an extension field. Example: aliyundoc.com_2018_10_30_000000_010000.gz.
You can use IDE tools such as notepad++ to view the logs.
The traffic usage of accelerated domain names that is queried by using the Monitoring & Usage Analytics or Usage Statistics feature in the console or through APIs is 1.1 times of the logged usage. For more information about the difference, see Why is the traffic amount found by using the monitoring and usage analytics feature or the usage statistics feature different from the traffic amount that is logged?
Some Internet service providers (ISPs) may assign private IP addresses to clients in specific regions. Therefore, POPs may receive requests from private IP addresses.
Note
Private IP addresses are of the following types:
- Type-A private IP addresses: 10.0.0.0 to 10.255.255.255. Subnet mask: 10.0.0.0/8.
- Type-B private IP addresses: 172.16.0.0 to 172.31.255.255. Subnet mask: 172.16.0.0/12.
- Type-C private IP addresses: 192.168.0.0 to 192.168.255.255. Subnet mask: 192.168.0.0/16.

Fields and descriptions

The following is an example of offline logs:

// Sample log 
[8/Jan/2025:20:16:54 +0800] 139.224.XXX.XXX   -     246     "-"                          "GET    http://cdn.aliyun.cn/images/cdn.gif"    403       369        978               MISS      "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36" "application/xml" 139.224.XXX.XXX
[8/Jan/2025:20:16:55 +0800] 139.224.XXX.XXX   -     197     "https://www.aliyun.com/"    "GET    http://cdn.aliyun.cn/images/cdn.jpg"    200       369        1143              HIT       "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36" "application/xml" 139.224.XXX.XXX
[8/Jan/2025:20:16:53 +0800] 139.224.XXX.XXX   -     1073    "https://www.aliyun.com/"    "GET    http://cdn.aliyun.cn/"                  200       368        985               HIT       "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36" "application/xml" 139.224.XXX.XXX
[8/Jan/2025:20:09:42 +0800] 139.196.XXX.XXX   -     233     "https://www.aliyun.com/"    "GET    http://cdn.aliyun.cn/"                  200       284        857               HIT       "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36" "text/html"       139.196.XXX.XXX
[8/Jan/2025:20:09:43 +0800] 139.196.XXX.XXX   -     42      "https://www.aliyun.com/"    "GET    http://cdn.aliyun.cn/"                  200       404        809               HIT       "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/126.0.6478.182 Safari/537.36"  "text/html"       139.196.XXX.XXX
[8/Jan/2025:20:16:54 +0800] 139.224.XXX.XXX   -     152     "https://www.aliyun.com/"    "GET    http://cdn.aliyun.cn/images/cdn.png"    200       374        1139              HIT       "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36" "application/xml" 139.224.XXX.XXX

Taking the first entry of the log as an example, the following table explains each field:

Field example	Description
`[8/Jan/2025:20:16:54 +0800]`	The end time of the request.
`139.224.XXX.XXX`	The first IP address in the X-Forwarded-For header that is carried in the request, which is client IP. If the client does not use a proxy to connect to the POP, the IP address is used by the client to connect to the POP. Note The format of the X-Forwarded-For request header is `X-Forwarded-For: <client_ip>, <proxy_ip>`. If the client does not use a proxy to connect to the POP, the X-Forwarded-For request header contains only <client_ip>. In this case, the value of client_ip in logs may be a private IP address. A common reason is that the Internet service provider (ISP) allocates a private IP address to the client to reduce the usage of public IP addresses and costs. If the client uses a proxy to connect to the POP, the X-Forwarded-For request header contains <client_ip> and <proxy_ip>. In this case, the value of client_ip in logs may also be a private IP address. A common reason is that the ISP allocates a public IP address to the proxy and a private IP address to the client.
`-`	The second IP address in the X-Forwarded-For header that is carried in the request, which is proxy IP. The value of this field is `-` when the client does not use a proxy to connect to the CDN POP.
`246`	The response time. Unit: milliseconds.
`"-"`	The Referer header in HTTP requests.
`GET`	The request method. For example, GET, POST, PUT, or DELETE.
`http://cdn.aliyun.cn/images/cdn.gif`	The request URL.
403	The HTTP status code.
369	The size of the request. Unit: bytes.
978	The size of the response. Unit: bytes.
`MISS`	The cache hit status. Valid values: HIT: The request is a cache hit and does not need to be redirected to the origin server. MISS: The request is a cache miss and must be redirected to L2 POPs or the origin server. Note CDN collects log data from POPs, except L2 POPs. If the field value is MISS, origin information is not included, and the log does not indicate if a cache-miss request was redirected to the origin server.
`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36`	The User-Agent header.
`application/html`	The file type. Note Logs of domain names for which you enable the global resource plan do not contain this field.
`139.224.XXX.XXX`	The IP address that is used by the client to connect to the POP.

Related API

You can call DescribeCdnDomainLogs to query the log download address of a domain name.

What to do next

You can analyze the downloaded logs. See Analyze offline logs.