All Products
Search
Document Center

Anti-DDoS:Query log reports

Last Updated:Feb 22, 2024

Log reports on the Log Analysis page of the Anti-DDoS Pro and Anti-DDoS Premium console support dashboards of Log Service. You can view log reports on the default dashboards: DDoS Access Center and DDoS Operation Center. After you enable Log Analysis for a domain name, you can query log reports on the default dashboards.

Prerequisites

  • The domain name of your website is added to Anti-DDoS Pro or Anti-DDoS Premium. For more information, see Add one or more websites.
  • The Log Analysis feature is enabled for the domain name. For more information, see Overview.

Procedure

  1. Log on to the Anti-DDoS Pro console.

  2. In the top navigation bar, select the region of your asset.

    • Anti-DDoS Proxy (Chinese Mainland): If your instance is an Anti-DDoS Pro instance, select Chinese Mainland.

    • Anti-DDoS Proxy (Outside Chinese Mainland): If your instance is an Anti-DDoS Premium instance, select Outside Chinese Mainland.

    You can switch the region to configure and manage Anti-DDoS Pro or Anti-DDoS Premium instances. Make sure that you select the required region when you use Anti-DDoS Pro or Anti-DDoS Premium.

  3. In the left-side navigation pane, choose Investigation > Log Analysis.

  4. Select the target domain name and click Log Reports.
    Note Make sure that the Status switch is turned on for the domain name.
    Log Reports
    You can view log reports on the following dashboards:
    • DDoS Access Center: shows the basic website metrics, access trends, request source distribution, and other statistics such as access domain names and client types. The website metrics include PVs, UVs, inbound traffic, and peak bandwidth.
    • DDoS Operation Center: shows the overall operations status of the website, including inbound and outbound traffic trends, requests and interception trends, attackers, and visited websites.
    Note
  5. Specify a time range to view the log reports on a dashboard.
    Each chart on the dashboard is generated based on the statistics within a specific time range. For example, the default time range is 1 hour for a website access chart and 1 week for an access trend chart. To specify the same time range for all charts on the dashboard, use the time picker.
    1. In the upper-right corner of the dashboard, click Please Select.
    2. In the Time pane, specify a time range.
      You can specify a relative time range, time frame, or custom time range.
      The specified time range applies to all charts on the dashboard.
      Note The time range you specify applies to the charts only once and is not saved. The next time you open the dashboard, the charts are still displayed within the default time ranges.

Charts on the default dashboards

DDoS Access Center
Chart nameTypeDefault time rangeDescriptionExample value
PVSingle value1 hour (relative)The total number of PVs.100000
UVSingle value1 hour (relative)The total number of UVs.100000
Inbound trafficSingle value1 hour (relative)The total volume of inbound traffic of the website. Unit: MB.300 MB
Peak network inSingle valueToday (time frame)The maximum inbound data transmission rate of the website. Unit: byte/s.100 Bytes/s
Peak network outSingle valueToday (time frame)The maximum outbound data transmission rate of the website. Unit: byte/s.100 Bytes/s
Traffic network trendDouble-line chart1 week (relative)The trends of inbound and outbound traffic. Unit: KB/s.None
PV/UV trendsDouble-line chart1 week (relative)The trends of PVs and UVs.None
Access status distributionPie chart1 week (relative)The distribution of requests with different status codes, such as 400, 304, and 200. Unit: count/minute.None
Access sourceWorld map1 hour (relative)The distribution of PVs from different countries.None
Traffic in source (world)World map1 hour (relative)The distribution of inbound traffic from different countries. Unit: MB.None
Traffic in source (China)Map of China1 hour (relative)The distribution of inbound traffic from different provinces in China. Unit: MB.None
Access heat mapAmap1 hour (relative)The heat map that shows the geographical locations of visitors.None
Network provider sourceDonut chart1 hour (relative)The distribution of the inbound traffic from different Internet service providers (ISPs), such as China Telecom, China Unicom, China Mobile, and CERNET. Unit: MB.None
RefererTable1 hour (relative)The top 100 most used referer URLs, target hosts, and the number of redirections.None
Access line distributionDonut chart1 hour (relative)The distribution of Anti-DDoS Pro or Anti-DDoS Premium lines.None
Client distributionDonut chart1 hour (relative)The top 20 most used user agents, such as iPhone, iPad, Internet Explorer, and Google Chrome.None
Request content type distributionDonut chart1 hour (relative)The top 20 most requested content types, such as HTML, form, JSON, and streaming data.None
Access domain nameDonut chart1 hour (relative)The top 20 most visited domain names of the website.None
Top clientsTable1 hour (relative)Information about the top 100 clients that initiates the most requests. The information includes the IP addresses, PVs, inbound traffic, number of invalid requests, and number of attacks.None
URL with slowest responseTable1 hour (relative)Information about the top 100 URLs with the longest response time. The information includes the websites, URLs, response time, and the number of accesses.None
DDoS Operation Center
Chart nameTypeDefault time rangeDescriptionExample value
Inbound and outbound bandwidth (Kbit/s)Double-line chart1 week (relative)The trends of inbound and outbound bandwidth.None
Request and interceptionDouble-line chart1 week (relative)The trends of the total numbers of requests and intercepted attack requests.None
Attacker listTable1 hour (relative)Information about the top 100 attackers that initiates the most attack requests. The information includes the attacker IP addresses, source locations, number of attacks, and total attack traffic.None
Top 10 attacked websitesTable1 hour (relative)The top 10 most attacked websites.None