Log Service for WAF is available on subscription WAF instances of the Business, Enterprise, and Exclusive editions. You are charged based on the log storage capacity you purchase — not on how often you query or access your logs.
Billable items
The only billable item is log storage capacity, measured in TB. The cost is bundled into your WAF instance subscription fee — there are no separate per-query or per-write charges.
When you enable Log Service for WAF, specify a log storage capacity based on your expected log volume. To estimate the right capacity, see Choose a log storage capacity.
When you enable the Log Service for WAF feature for a subscription WAF instance, you can specify a log storage capacity based on your business requirements. The log storage capacity is measured in TB. The fee for the log storage capacity is included in the subscription fee for the WAF instance.
Billing cycle
The billing cycle depends on when you enable Log Service for WAF:
Enabled when purchasing a WAF instance: The billing cycle matches the subscription period you selected for the WAF instance.
Enabled by upgrading an existing WAF instance: The billing cycle equals the remaining validity period of your WAF instance, calculated to the minute.
Expiration
Log Service for WAF expires when your WAF instance expires. After expiration:
WAF stops writing log data to the dedicated Logstore.
Existing log data is retained for seven days.
Renew your WAF instance within seven days to continue using the feature. If you do not renew within seven days, all log data is permanently deleted.
Choose a log storage capacity
Log storage capacity depends on three factors:
| Factor | Description | Default |
|---|---|---|
| Storage duration | Longer storage requires more capacity. | 180 days |
| Custom field configuration | WAF log fields are classified as required or optional. Required fields are always included. Optional fields increase storage usage when enabled. | All required fields and some optional fields |
| Storage type | Full logs require more capacity than attack logs only. | Full logs for the protected domain name |
The following table provides recommended capacity values based on average daily QPS, assuming default storage configurations (180-day retention, default fields, full logs):
| Average daily QPS | Recommended capacity |
|---|---|
| ≤ 80 Mbit/s | 3 TB |
| > 80 Mbit/s and ≤ 120 Mbit/s | 5 TB |
| > 120 Mbit/s and ≤ 260 Mbit/s | 10 TB |
| > 260 Mbit/s and ≤ 350 Mbit/s | 15 TB |
| > 350 Mbit/s and ≤ 500 Mbit/s | 20 TB |
| > 500 Mbit/s and ≤ 1,200 Mbit/s | 50 TB |
If your log storage configurations differ from the defaults — for example, if you enable more optional fields, extend the storage duration, or switch to attack logs only — adjust your capacity estimate accordingly.
To modify log storage configurations after enabling the feature, see Modify log settings.