This topic describes how to enable the log analysis feature in the Anti-DDoS Pro or Anti-DDoS Premium console. The log analysis feature allows you to collect the logs of Anti-DDoS Pro or Anti-DDoS Premium to Log Service.

Prerequisites

Procedure

Important Before you can use a RAM user to enable the log analysis feature, you must grant the required permissions to the RAM user. For more information, see RAM user authorization.
  1. Log on to the Anti-DDoS Pro console.
  2. In the upper-left corner of the page, select Chinese Mainland.
    In this example, Anti-DDoS Pro is used. If you want to use Anti-DDoS Premium, select Outside Chinese Mainland.
  3. In the left-side navigation pane, choose Investigation > Log Analysis.
  4. Select a log storage capacity and duration on the buy page.
    If you have purchased a log storage capacity and duration, skip this step.
    1. Click Buy Now.
    2. On the buy page, configure the parameters. The following table describes the parameters.
      ParameterDescription
      Applicable ServiceSelect Anti-DDoS Pro.

      In this example, Anti-DDoS Pro is used. If you want to use Anti-DDoS Premium, select Anti-DDoS Premium.

      Log Storage CapacitySelect a log storage capacity. Unit: TB. If the log storage space is full, no more logs can be stored.

      In most cases, each request log occupies about 2 KB of storage space. If the average request volume of your workload is 500 queries per second (QPS), the storage space required for one day is: 500 × 60 × 60 × 24 × 2 = 86,400,000 KB (about 82 GB). By default, logs are stored for 180 days. If you need to store logs that are generated in the last 180 days, you must select a log storage capacity that is larger than 14,832 GB (about 14.5 TB).

      DurationSelect a validity period for the log analysis feature. After the validity period expires, no more logs can be stored.
      Warning If the log analysis feature expires and is not renewed within seven days, the Anti-DDoS Pro server clears all logs that are stored in the Logstore of your instance.
    3. Click Buy Now and complete the payment.
  5. On the Log Analysis page, authorize Anti-DDoS Pro to use the AliyunDDoSCOOLogArchiveRole role to access Log Service.
    This operation is required only when you enable the log analysis feature for the first time. You must complete the authorization by using your Alibaba Cloud account.
    Warning To ensure that logs can be collected to Log Service, do not revoke permissions from the AliyunDDoSCOOLogArchiveRole role or delete the role.
  6. On the Log Analysis page, select the website domain, and turn on the Status switch to enable the log analysis feature.
    Important We recommend that you check the remaining log storage space and validity period at regular intervals when you use the log analysis feature. If more than 70% of storage space is used, we recommend that you increase the log storage capacity. Otherwise, you cannot store additional logs and data loss may occur.

Related operations

OperationDescription
Disable log deliveryOn the Log Analysis page, select the website domain and turn off Status.
Change the log storage periodClick Details. In the Details dialog box, modify the Storage Period parameter. Valid values: 30 to 180. Unit: days.
Clear logsIf you want to delete logs to release the log storage space, click Clear on the Log Analysis page.
Warning After you perform this operation, all logs that are stored are deleted. Proceed with caution.
RenewAfter the validity period of the log analysis feature expires, no more logs can be stored. The stored logs can be retained for seven days after the log analysis feature expires. Then, the Anti-DDoS Pro server clears all logs that are stored in the Logstore of your instance. To prevent the issues that are related to the expired log analysis feature, we recommend that you pay attention to the expiration time of the feature and renew the feature at the earliest opportunity, or enable auto-renewal.

On the Log Analysis page, click Renew. For more information, see Renew a Log Analysis instance.

Increase the log storage capacityOn the Log Analysis page, click Upgrade to increase the log storage capacity. For more information, see Manage log storage.
Decrease the log storage capacityOn the Log Analysis page, click Downgrade to decrease the log storage capacity. For more information, see Manage log storage.

What to do next

After the logs of the Anti-DDoS Pro or Anti-DDoS Premium instance are collected to Log Service, you can query, analyze, download, ship, and transform the collected logs in the Log Service console. You can also configure alert rules for the logs. For more information, see Common operations on logs of Alibaba Cloud services.