The Log Analysis feature uses the subscription billing method. The fees are calculated based on the log storage capacity that you purchase.

Overview

The Log Analysis feature is a value-added capability that is provided by Anti-DDoS Pro and Anti-DDoS Premium. However, you must separately purchase this feature. After you add your websites to your Anti-DDoS Pro or Anti-DDoS Premium instance, the instance does not store the access logs of the websites. If you want to store the access logs and use the access logs for business analysis, you must enable the Log Analysis feature.

To enable the Log Analysis feature, you can go to the buy page of Log Analysis. You are charged for the Log Analysis feature based on the log storage capacity and log storage duration that you select. For more information about how to enable the Log Analysis feature, see Step 1: Enable Log Analysis.

After you enable the Log Analysis feature, a Log Analysis instance is provided. You can use the Log Analysis feature to collect the access logs of your websites within the validity period of the Log Analysis instance. You can query and analyze the access logs, and configure alerts based on the access logs.
Notice The Log Analysis instance and the Anti-DDoS Pro or Anti-DDoS Premium instance are independent of each other and must be separately managed. For example, you must separately renew the Anti-DDoS Pro or Anti-DDoS Premium instance and the Log Analysis instance.

Log storage specifications

Specification Impact on billing Description Modification supported after the Log Analysis feature is enabled
Log storage capacity Yes When you enable the Log Analysis feature, you must specify the log storage capacity. The log storage capacity is measured in TB. The fees that are displayed on the buy page of Log Analysis shall prevail. Supported.
After you enable the Log Analysis feature, you can perform the following operations to modify the log storage capacity:
Warning If the log storage capacity is exhausted, new logs cannot be stored and are lost. Logs that are stored longer than the log storage duration that you specify are automatically deleted.

When the log storage capacity is exhausted, you can upgrade your Log Analysis instance to increase the log storage capacity or delete logs. For more information about how to delete logs, see Delete logs.

Log storage duration No By default, logs are stored for 180 days. Supported.

After you enable the Log Analysis feature, you can customize the log storage duration. You can specify a value that ranges from 30 days to 180 days. For more information, see Modify the log storage duration.

Storage object No Only the full logs of the websites for which log collection is enabled are stored. Supported.

After you enable the Log Analysis feature, you can enable or disable log collection for the websites that are added to your Anti-DDoS Pro or Anti-DDoS Premium instance. For more information, see Step 2: Enable the log collection feature.

Log field No For more information about the log fields that are included in the full logs of Anti-DDoS Pro or Anti-DDoS Premium, see Fields included in full logs. Not supported.

Method to select a log storage capacity

The following example shows how to select the required log storage capacity based on the daily QPS of your website:

In most cases, each request log occupies approximately 2 KB of storage. If the average QPS of your website is 500, the required storage for the logs that are generated within a day is 86,400,000 KB, which is approximately 82 GB. This value is calculated by using the following formula: 500 × 60 × 60 × 24 × 2 = 86,400,000. If you want to store logs that are generated within 180 days, the required log storage capacity is 15,552,000,000 KB, which is approximately 14.5 TB. This value is calculated by using the following formula: 86,400,000 × 180 = 15,552,000,000.

Expiration

When your Log Analysis instance expires, the following issues occur:
  • Anti-DDoS Pro or Anti-DDoS Premium no longer stores new logs.
  • The logs that are stored are retained for seven days.

    If you renew your Log Analysis instance within seven days, you can continue to use this instance. Otherwise, all logs are deleted.

    For more information about how to renew your Log Analysis instance, see Renew a Log Analysis instance.