When Simple Log Service for WAF is enabled, WAF writes access and security logs to a Simple Log Service Logstore. Each subscription-based WAF instance has a fixed log storage capacity. When usage approaches or reaches that limit, upgrade the capacity to prevent log write failures and data loss.
If log storage capacity is insufficient, WAF stops writing new logs to the Logstore. Logs generated after the capacity is full are lost. When usage reaches 80%, the system sends a notification by text message and email. Upgrade storage immediately after receiving this notification.
Prerequisites
Before you begin, ensure that you have:
A WAF instance on the Pro, Enterprise, or Ultimate edition using the subscription billing method
Pay-as-you-go WAF instances use Simple Log Service with no fixed storage limit. Billing is based on actual usage, so no capacity upgrade is needed.
Upgrade benefits
Upgrading log storage capacity helps prevent log write failures. It also supports the following long-term requirements:
Improve visibility and monitoring capabilities: With greater storage capacity, WAF can record more requests and events, enabling security teams to monitor traffic, identify threats, and better understand attack behavior and patterns for more effective countermeasures.
Meet compliance requirements: Some industries and regulations require enterprises to retain detailed access and security logs. Upgrading storage capacity ensures all required logs are retained, helping prevent potential legal and financial liabilities.
Analyze long-term trends: With more historical data, enterprises can identify threats and traffic pattern changes over time, enabling more effective policy and resource configuration.
Upgrade log storage capacity
Log on to the WAF 3.0 console. In the top navigation bar, select the resource group and region of your WAF instance. You can select Chinese Mainland or Outside Chinese Mainland.
In the left-side navigation pane, choose Detection and Response > Log Service.
In the upper-right corner of the Log Service page, view the current log storage capacity and storage usage percentage.
Click Upgrade Storage. In the panel that appears, find the Log Storage Capacity parameter, select a larger value, and complete the payment.
What's next
If your current log storage capacity exceeds your actual needs and is adding unnecessary cost, you can downgrade it. For more information, see Upgrade or downgrade a WAF instance.