All Products
Search

This Product

    Edge Security Acceleration:Standard log fields

    Document Center

    Edge Security Acceleration:Standard log fields

    Last Updated:Jun 01, 2026

    Alibaba Cloud DCDN records hourly access logs and WAF logs for your accelerated domains. You can download logs generated within the last 30 days for analysis.

    Download instructions

    • To download logs, go to the Standard Logs page. The navigation path is Data Center > Logs > Standard Logs. On the Log Download tab, you can select a date to download the logs.

    • Log file delay: Log files are typically available within 24 hours but may be delayed. To view logs with less delay, see real-time logs.

    Usage notes

    • Log file naming convention: acceleratedDomain_YYYY_MM_DD_HHMMSS_HHMMSS[_extension].gz. The extension, if present, starts with an underscore (_). Example: aliyundoc.com_2018_10_30_000000_010000_xx.gz.

      Note

      The extension may not be present. Example: aliyundoc.com_2018_10_30_000000_010000.gz.

    • DCDN logs can be viewed with common IDE tools, such as Notepad++.

    • Traffic data for an accelerated domain name from the DCDN console or an API may differ from the data calculated from logs. Typically, traffic data from monitoring is about 1.1 times the amount calculated from logs. For more information, see Why is the traffic amount found by using the monitoring and usage analytics feature or the usage statistics feature different from the traffic amount that is logged?

    • Resource monitoring collects data based on the client's region and ISP. For billing, data is metered based on the traffic, bandwidth, and number of requests generated at DCDN points of presence (POPs) in each billable region. Due to the different statistical methods, the results may vary.

    • Some Internet service providers (ISPs) may assign private IP addresses to clients in specific regions. Therefore, POPs may receive requests from private IP addresses.

      Note

      Private IP addresses are of the following types:

      • Type-A private IP addresses: 10.0.0.0 to 10.255.255.255. Subnet mask: 10.0.0.0/8.

      • Type-B private IP addresses: 172.16.0.0 to 172.31.255.255. Subnet mask: 172.16.0.0/12.

      • Type-C private IP addresses: 192.168.0.0 to 192.168.255.255. Subnet mask: 192.168.0.0/16.

    Access log fields

    • Sample log entry 

      // Sample log entry
//         Request Time             Client IP     Proxy IP  Response Time   Referrer    "Request Method Request URL"      HTTP Status Code Request Size Response Size    Cache Status                 User-Agent                                                           Content Type Connection IP
[9/Jun/2015:01:58:09 +0800]    10.10.10.10   -         1542          "-"         "GET http://www.aliyun.com/index.html"      200              191           2830           MISS                 "Mozilla/5.0 (compatible; AhrefsBot/5.0; +http://example.com/robot/)" "text/html"  1.1.X.X

    • Fields

      Example

      Field name

      Description

      [9/Jun/2015:01:58:09 +0800]

      Request timestamp

      The end time of the user access request.

      10.10.10.10

      Client IP

      The first IP address from the left in the X-Forwarded-For request header, representing the client's IP address (client_ip). If no proxy sits between the client and the or DCDN edge node, this matches the IP address that established the TCP connection with the edge node.

      Note

      • The X-Forwarded-For header follows the format X-Forwarded-For: <client_ip>, <proxy_ip>.

      • If the client does not use a proxy to connect to the DCDN node (meaning the X-Forwarded-For header only contains <client_ip>), the value of <client_ip> in logs may be a private IP address. A common reason is that the Internet service provider (ISP) allocates a private IP address to the client to reduce the usage of public IP addresses and costs.

      • If the client uses a proxy to connect to the POP, the X-Forwarded-For request header contains <client_ip> and <proxy_ip>. In this case, the value of client_ip in logs may also be a private IP address. A common reason is that the ISP allocates a public IP address to the proxy and a private IP address to the client.

      • Because the X-Forwarded-For header can be forged, use the remote_ip field from real-time logs for analysis and for configuring WAF rules to block malicious IP addresses. The remote_ip field contains the real IP address that established the connection with DCDN.

      -

      Proxy IP

      The second IP address from the left in the X-Forwarded-For request header, representing the proxy's IP address (proxy_ip). If no proxy is used, this field contains a hyphen (-).

      1542

      Response time

      The response time. Unit: milliseconds.

      "-"

      Referer

      The Referer header in HTTP requests.

      GET

      Request method

      The request method. For example, GET, POST, PUT, or DELETE.

      http://www.aliyun.com/index.html

      Request URL

      The request URL.

      200

      HTTP status code

      The HTTP status code. Common examples include 200, 403, 404, and 500.

      191

      Request size

      The size of the request. Unit: bytes.

      2830

      Response size

      The size of the response. Unit: bytes.

      MISS

      Cache status

      The cache hit status.

      • HIT: The edge node served the content from its cache. No origin fetch was required.

      • MISS: The edge node did not have the requested content in cache. The content is fetched from an upstream server, which can be an L2 or DCDN node or the origin server.

      Alibaba Cloud DCDN currently only provides log information from DCDN edge nodes, not including origin-related information from DCDN L2 nodes. Therefore, when this field is MISS, you cannot obtain origin information, and cannot directly see from the logs whether the user request was forwarded to the origin.

      Mozilla/5.0 (compatible; AhrefsBot/5.0; +http://example.com/robot/)

      User-Agent

      The User-Agent header.

      text/html

      Content type

      The webpage type.

      null

      Logs of domain names for which you enable the global resource plan do not contain this field.

      1.1.1.1

      Connection IP

      The IP address that established the connection.

      Note

      Other fields:

      • DYNAMIC: Indicates a dynamic request.

      • CHARGE: Indicates a billable request.

      • NOTLAST: A reserved field with no practical meaning.

    WAF log fields

    • Sample log entry 

      [16/May/2023:10:36:09 +0800] HEAD "http" api.aliyun.com "/block" "_dyc=89e7639543f17ddbe77361c56b9952b9" "-" api.aliyun.com 3d30530216842045692847280e 403 "-" "curl/7.29.0" "-" 1.XX.XX.1 1.XX.XX.1 false "-" deny "custom_acl" 20000014

    • Fields

      Field name

      Example

      Description

      unixtime

      [16/May/2023:10:36:09 +0800]

      The request timestamp.

      method

      HEAD

      The request method.

      scheme

      http

      The request protocol.

      domain

      api.aliyun.com

      The domain name in the request.

      uri

      /block

      The resource path in the request.

      uri_param

      _dyc=89e7639543f17ddbe77361c56b9952b9

      The request's query string.

      content_type

      -

      The content type of the requested resource.

      matched_host

      api.aliyun.com

      The accelerated domain that the request matched.

      request_id

      3d30530216842045692847280e

      The unique ID of the request.

      return_code

      403

      The HTTP status code returned for the request.

      referer

      -

      The HTTP Referer header.

      user_agent

      curl/7.29.0

      The request's User-Agent string.

      x_forwarded_for

      -

      The X-Forwarded-For (XFF) header, used to identify the original IP address of a client that connects to a web server through an HTTP proxy or a load balancer.

      client_ip

      1.XX.XX.1

      The user's real IP address.

      remote_addr

      1.XX.XX.1

      The IP address that connected to the DCDN node.

      final_test

      false

      Indicates whether the final matched rule was in monitoring mode. A value of false means it was not.

      cookie

      -

      The client request's Cookie header.

      final_action

      deny

      The final protection action taken.

      • block: Blocked by the basic web protection module.

      • deny: Blocked by a module other than the basic web protection module.

      • captcha: Challenged with a slider CAPTCHA.

      • js: Challenged with JavaScript verification.

      • Empty string: The request was allowed. This can occur if no protection rule was triggered, a whitelist rule or monitor rule was triggered, or the client passed a slider CAPTCHA or JavaScript verification.

      Note

      If a request triggers multiple protection modules, this field records only the final action taken. Actions are prioritized in the following order: block (block) > slider CAPTCHA (captcha) > dynamic token-based authentication (sigchl) > JavaScript verification (js).

      final_plugin

      custom_acl

      The protection module that was ultimately matched.

      • If the final_action field is not empty, this field indicates the single module that took the action.

      • If the final_action field is empty, this field lists all modules that were triggered by the request. A -T suffix on a module name indicates that the request matched a monitor rule within that module. The suffix does not apply to the whitelist or basic web protection modules.

      This field can contain multiple values separated by commas (,). The possible module values are:

      • whitelist: The request matched a rule in the whitelist module.

      • waf: The request matched a rule in the basic web protection module.

      • custom_acl: The request matched a rule in the custom rule module.

      • ip_blacklist: The request matched a rule in the IP blacklist module.

      • region_block: The request matched a rule in the region blacklist module.

      • bot: The request matched a rule in the bot management module.

      • anti_scan: The request matched a rule in the scan protection module.

      • intelligent_cc_global: The request matched a rule in the DDoS global protection strategy module.

      • intelligent_cc_acl: The request matched a rule in the DDoS intelligent CC protection module.

      final_rule_id

      20000014

      Information about the protection rule that was ultimately matched.

      • If the final_action field is not empty, this field indicates the ID of the single rule that took the action. The rule ID is a numeric value and does not include the module name.

      • If the final_action field is empty, this field lists all rules triggered by the request. The format for each rule is ModuleName-RuleID(-T). A -T suffix indicates that the rule is a monitor rule. The suffix does not apply to rules in the whitelist or basic web protection modules.

      This field can contain multiple values separated by commas (,).

    Procedure

    1. Log on to the DCDN console.

    2. In the left-side navigation pane, choose Logs.

    3. On the Log Download tab, select an accelerated domain and a time range, and then click Search.

    4. In the search results, click Download in the Actions column.

    Related APIs

    DescribeDcdnDomainLog: Queries the download URLs for Standard Logs of an accelerated domain.