The log analysis feature integrates Anti-DDoS Pro and Anti-DDoS Premium with Simple Log Service to give you real-time visibility into website traffic and attack patterns. After you enable the feature, Simple Log Service collects full access logs from your protected websites. Query and analyze those logs using SQL, view built-in dashboards, and forward log data downstream as needed. You can also use the log consumption and delivery features of Simple Log Service to manage all website access logs.
The log analysis feature is a value-added service and must be enabled separately before use. See Use the log analysis feature for setup instructions.
Use cases
Troubleshoot website access issues
Query full access logs in real time to identify the root cause of access problems. Run SQL statements to analyze read/write latencies, carrier distribution, and request patterns across your protected websites.
Track CC attack sources
Access logs capture the distribution and origin of CC attacks. Query logs in real time to trace attack sources by country, analyze page views (PVs), and build a response strategy based on observed patterns.
Analyze website operations
Run SQL queries against collected access data to understand website popularity, traffic sources, and client distribution — all in real time.
How it works
Anti-DDoS Pro and Anti-DDoS Premium use region-specific platforms to collect and deliver logs. View traffic and attack statistics on the Security Overview and Attack Analysis pages, filtered by product and region.
Chinese mainland products are managed by the platform in the China (Hangzhou) region. Logs are delivered to China (Hangzhou).
Products outside the Chinese mainland are managed by the platform in the Singapore region. Logs can be delivered to Singapore, Indonesia (Jakarta), US (Virginia), China (Hong Kong), UK (London), Germany (Frankfurt), Japan (Tokyo), or Malaysia (Kuala Lumpur). You can specify the delivery region.
Estimate log storage capacity
Each request log uses approximately 2 KB of storage. Use the following formula to estimate how much storage you need:
Daily storage (KB) = QPS × 60 × 60 × 24 × 2Example: At 500 queries per second (QPS), daily storage is approximately 82 GB:
500 × 60 × 60 × 24 × 2 = 86,400,000 KB ≈ 82 GB/dayThe default log retention period is 180 days. At 500 QPS, storing 180 days of logs requires approximately 14,832 GB (about 14.5 TB).
Log collection behavior
When your service QPS stays within your Anti-DDoS Pro or Anti-DDoS Premium instance's specifications, the system collects logs for all traffic. If traffic spikes beyond the instance specifications, the system automatically adjusts the collection ratio — the higher the traffic volume, the higher the collection ratio applied.
Billing
The log analysis feature uses subscription billing only. Pricing is based on log storage capacity. For current rates, see the log analysis instance buy page.
| Log storage capacity | Chinese mainland (USD/month) | Outside the Chinese mainland (USD/month) |
|---|---|---|
| 3 TB | 234 | 468 |
| 5 TB | 390 | 780 |
| 10 TB | 780 | 1,560 |
| 20 TB | 1,560 | 3,120 |
| 50 TB | 3,900 | 7,800 |
| 100 TB | 7,800 | 15,600 |
| 200 TB | 15,600 | 31,200 |
| 500 TB | 39,000 | 78,000 |
| 800 TB | 62,400 | 124,800 |
| 1000 TB | 78,000 | 156,000 |
What's next
| Document | Description |
|---|---|
| Use the log analysis feature | Enable and configure the log analysis feature. Start here if this is your first time using it. |
| Fields in full logs | Reference for all log fields included in Anti-DDoS Pro and Anti-DDoS Premium log data. |
| Query and analyze full logs | Use query statements to search and analyze collected log data. |
| Query log reports | View preset dashboards: DDoS Operation Center and DDoS Access Center. |