:日志查询

Prerequisites

• WAF Log Service is enabled. For details, see Enable or disable log service.

• You have added your web services to WAF 3.0 as protected objects and protected object groups.

• Log delivery is enabled for the WAF protected object. For details, see Manage log delivery status.

Query and analyze logs

1. Log on to the Web Application Firewall 3.0 console. From the top menu bar, select the resource group and region (Chinese Mainland or Outside Chinese Mainland) for the WAF instance.

2. In the navigation pane on the left, choose Detection and Response > Log Service.

3. On the Log Service page, select the protected object whose logs you want to query.

   Important

   The protected object must have log collection enabled (the Status toggle must be on). If it isn't enabled, WAF won't collect log data or provide log query and analysis. If log collection isn't enabled for the selected protected object, find it on this page, click the object name, and turn on the Status toggle. Alternatively, go to the Log Configuration page, click the Delivery Settings tab, and use Status of Delivery to Simple Log Service to manage log collection for all protected objects. For details, see Manage log delivery status.

   

4. On the Log Query tab, use query and analytics statements to search and analyze WAF log data.

   

   Follow these steps:

   1. In the statement input box (labeled ①), enter a query statement.

      Query statements use the Alibaba Cloud Log Service syntax. For details about this syntax, see Query syntax and functions. Use WAF log data fields as query fields. For a list of supported query fields, see Log fields.

      If you're unfamiliar with the log query syntax, use Advanced Search. Expand Advanced Search above the statement input box, configure your search conditions, and click Search. The statement input box automatically generates a query statement that matches your conditions. Advanced search supports the following search conditions:

      Search condition	Description
      IP	IP address of the client that sent the request.
      Request ID	Unique ID that WAF generates for the client request. WAF includes this ID in block pages and CAPTCHA challenge responses, and you can use it for issue analysis and troubleshooting.
      Rule ID	ID of the WAF protection rule that the request matched. Find the rule ID on the Protection Rules page, or get it from the rule-hit records and statistics on the Security Reports page. For more information, see Security reports.
      Status Code Returned from Origin Server	HTTP status code that the origin server returned in response to WAF's back-to-origin request.
      Status Code Returned from WAF	HTTP status code that WAF returned to the client.
      Protection Module	Type of WAF protection module that the request matched. For an overview of WAF protection modules and how to configure protection rules for each module, see Protection configuration overview.

   2. To run statistical analysis on query results, append an analytics statement after the query statement in the statement input box (labeled ①). To retrieve only matching log data, skip this step.

      Separate the analytics statement from the query statement with a pipe character (|). Analytics statements use standard SQL 92 syntax. For details, see Overview of log query and analysis.

   3. Use the time range selector (labeled ②) to set the time range for the logs you want to query.

   4. Click Log Query(labeled ③).

      The query and analysis results — WAF log data that matches your query — appear at the bottom of the page. Results include a log distribution histogram, Original Request Header, charts, and log clustering. From the results, run quick analysis, generate charts, and set up alerts. For details, see Description of the Query/Analysis page.