Simple Log Service:Get started with WAF log service

Overview

WAF stores logs only for websites with log collection enabled.

You can customize these configurations. Modify log settings.

Prerequisites

• You have a subscription WAF instance of the Advanced Edition, Enterprise, Ultimate Edition, or Exclusive edition.

• You have added your website domain to WAF for protection.

  Domains not added to WAF generate no logs. Add your domain by following the Tutorials.

• You have enabled Log Service.

  Enable Log Service when you first log on to the Log Service console.

  WAF log collection requires an active Log Service subscription.

  Note

  Overdue Log Service payments suspend WAF log collection. Collection resumes automatically after payment.

Step 1: Enable the WAF log service

1. Log on to the Web Application Firewall (WAF) console. In the top menu bar, select the resource group and region for your WAF instance: Chinese Mainland or Outside Chinese Mainland.

2. In the left navigation pane, choose Security Operations > Log Service.

3. On the Log Service page, click Upgrade Now and follow the on-screen instructions to upgrade.

   Note

   If you enabled the Log Service when you purchased the WAF instance, you can skip this step.

   Procedure:

   1. On the Upgrade/Downgrade page, enable Log Service and select a Log Storage Capacity.

   2. Click Proceed to Payment and complete the payment.

4. Authorize WAF to access cloud resources. Create a service-linked role.

After you enable WAF log service, Log Service creates a dedicated Project and Logstore for your account. Default configurations are listed in Dedicated WAF Project and Logstore.

Step 2: Use the WAF log service

1. Log on to the Web Application Firewall (WAF) console. In the top menu bar, select the resource group and region for your WAF instance: Chinese Mainland or Outside Chinese Mainland.

2. In the left navigation pane, choose Security Operations > Log Service.

3. Select a domain from the drop-down list and turn on the Status switch.

   The drop-down list shows only domains added to WAF. To add a domain, follow the Tutorials.

4. On the Log Search tab, analyze WAF logs with query statements. Log query.

   Additional examples: Query and analysis examples.

5. On the Log Analysis tab, view the dashboards that WAF generates from your log data.

   Log analysis dashboards are predefined reports that visualize log data for monitoring web services and security.

   • Operation Center: Displays business operation metrics, including request trends and attack overviews.

   • Access Center: Displays access metrics, client distribution, traffic, and performance data.

   • Security Center: Displays attack metrics, trends, and source distribution.

   Set a time range to query dashboards. You can also subscribe to receive reports by email. View a log analysis dashboard.

Dedicated WAF Project and Logstore

Log Service automatically creates the following resources for WAF.

Next steps

• To let a RAM user query and analyze WAF logs, grant the required permissions. Grant a RAM user permissions to query and analyze logs.

• WAF log query and analysis tutorials: Log application tutorials.

• To modify WAF log storage rules or capacity: Manage log storage.