After you enable Web Application Firewall (WAF) Log Service, monitor your log storage usage. If your log storage capacity approaches or reaches its limit, upgrade it promptly to prevent write failures and data loss.
Use cases
Upgrading your log capacity helps prevent data loss from insufficient storage and allows you to meet the following business needs:
Enhance visibility and monitoring: Increased capacity lets you record more requests and events for comprehensive monitoring of traffic and potential threats. Detailed log data helps security teams analyze attack patterns and behaviors to develop more effective defense strategies.
Meet compliance requirements: Some industry regulations require businesses to retain detailed access and security logs. Increasing log capacity ensures that the retention period and data volume meet compliance standards, mitigating legal and financial risks.
Support long-term trend analysis: Storing more historical data lets you perform long-term trend analysis to identify potential security threats and changes in traffic patterns. This helps you optimize security policies and resource allocation.
Upgrade log storage capacity
Supported editions
You can upgrade the log storage capacity for subscription instances (Advanced, Enterprise, and Ultimate editions) and pay-as-you-go instances that are billed by WAF.
Starting August 14, 2026, WAF will gradually upgrade the Log Service for pay-as-you-go instances in batches. The billing rules will be adjusted as follows:
For Log Service enabled on or after August 14, 2026: Billing is handled by WAF.
For Log Service enabled before August 14, 2026: Log Service continues to handle billing, with no charges from WAF. If you upgrade your service, a 180-day parallel billing period begins. After this period, WAF will handle billing.
For more information, see the announcement: [Announcement] Service Upgrade for WAF Web Core Protection, Bot Management, and Log Service.
Capacity alerts and handling
When your log storage usage reaches 80%, the system sends you a notification by SMS and email. To prevent write failures or data loss due to insufficient storage space, upgrade your log storage capacity promptly after you receive the notification.
Procedure
Log on to the WAF 3.0 console. In the top menu bar, select the resource group and region for the WAF instance (Chinese Mainland or Outside Chinese Mainland).
In the left-side navigation pane, choose .
Manage log storage space:
View log storage space: The upper-right corner of the Log Service page displays your provisioned log storage capacity, current usage, and usage percentage.
Upgrade log storage capacity: In the upper-right corner of the Log Service page, click Upgrade Storage, select a larger Log Storage Capacity specification, and complete the purchase.
FAQ
How to downgrade capacity or disable Log Service?
If your log storage capacity exceeds your needs, you can downgrade the capacity or disable the service to save costs.
Disable Log Service: If you no longer need Log Service, disable it. For more information, see Disable Log Service.
Downgrade log capacity: The downgrade method depends on your instance's billing method:
Subscription instances: See Upgrade or downgrade an instance.
Pay-as-you-go instances billed by WAF: In the upper-right corner of the Log Service page, click Downgrade Capacity and select a smaller specification.
Pay-as-you-go instances billed by Log Service: Downgrading is not supported. Costs are based on actual usage.