The security reports of Web Application Firewall (WAF) retain logs for a limited period only. To obtain complete raw logs for in-depth analysis or to meet compliance and audit requirements, enable the log service. This topic describes how to enable and disable this service.
Enable the log service
The log service is not available for Basic edition WAF subscription instances. To use this service, do one of the following:
Upgrade your current instance.
Unsubscribe from the current subscription instance and purchase a pay-as-you-go instance.
-
Log on to the Web Application Firewall 3.0 console. From the top menu bar, select the resource group and region (Chinese Mainland or Outside Chinese Mainland) for the WAF instance.
-
In the navigation pane on the left, choose .
Click Upgrade Now to open the upgrade page. (This step applies only if you did not enable the log service when purchasing WAF. If the service is already enabled, skip to Step 5.)
Set Log Service to Enabled, select a log storage capacity, and complete the payment. If you are unsure about the required capacity, you can use the default configuration and upgrade it later.
In the Enable Logging for Protected Objects area, select a log storage region. This region determines where the log service Project is created.
ImportantThe log storage region cannot be changed after it is selected. To change the region, you must first disable and then re-enable the log service. Choose this region carefully.
Click Enable Log Service.
Next steps
Enable log delivery: After enabling the log service, you must also enable log delivery for your WAF protected objects to query and analyze their log data.
Enable individually: In the upper-left corner of the Log Service page, select a protected object and enable its log delivery.
Enable in bulk: In the upper-right corner, click Log Configuration to enable SLS delivery in bulk. For more information, see Configure log fields and delivery status.
Query and analyze logs: You can query and analyze log data for your protected objects, and then generate charts or create an alert based on the analysis results. For more information, see Query logs.
Log delay: After you enable log delivery for a protected object and it starts receiving traffic, logs appear in SLS after a delay of about 10 minutes. We recommend sending a test request and waiting a few minutes before checking the log query page for data.
Historical log limitation: The WAF log service records logs only from the time it is enabled. Historical logs generated before this time cannot be retrieved.
Log data deletion: If you unsubscribe from a subscription WAF instance, or disable and release a pay-as-you-go WAF instance, the associated logs are permanently deleted and can no longer be queried.
Projects and Logstores
After you enable the log service, the system automatically creates a WAF-dedicated Project and Logstore.
Do not manually delete the Project or Logstore automatically created by the system. Otherwise, your log data will be permanently lost.
Resource type | Description |
Project | Alibaba Cloud Log Service automatically creates a dedicated Project for WAF with the following naming convention:
Starting from 00:00:00 on August 14, 2026 (UTC+8), WAF will gradually roll out a log feature upgrade in batches for pay-as-you-go instances that have the log service enabled. During this upgrade, the system creates a new Logstore and implements a dual-write mechanism, ensuring that log data is written to both the old and new Logstores simultaneously. For more information, see Notice on the upgrade of Web Core Protection, Bot Management, and Log Service for Web Application Firewall. You can find this dedicated Project on the homepage of the Alibaba Cloud Log Service console. Click the Project name to open it. For more information about Projects, see Manage Projects. |
Logstore | By default, a Logstore is created in the WAF Project to store all WAF logs. The naming convention for the Logstore is as follows:
This Logstore can store only WAF logs. You cannot write other types of data to it by using an API, an SDK, or other methods. No special restrictions apply to features such as queries, statistical analysis, alerting, and streaming consumption. Important The Logstore's functionality depends on the status of Alibaba Cloud Log Service in your account. If your account has overdue payments for Alibaba Cloud Log Service, WAF log delivery is suspended. Service resumes automatically after the overdue payment is settled. For more information about Logstores, see Manage Logstores. |
Disable the log service
Pay-as-you-go
Disabling the log service permanently deletes the dedicated WAF Project and all its log data. Before you proceed, ensure you no longer need this data.
-
Log on to the Web Application Firewall 3.0 console. From the top menu bar, select the resource group and region (Chinese Mainland or Outside Chinese Mainland) for the WAF instance.
-
In the navigation pane on the left, choose .
On the Log Service page, click Disable in the upper-right corner. In the dialog box that appears, click OK.
Subscription
For subscription instances, the log service cannot be disabled directly. It is disabled automatically only if the WAF instance expires and is released, or when you unsubscribe from the instance.
To reduce fees for the log service, you can use the following methods:
Reduce the log storage capacity: For more information, see Upgrade and downgrade an instance.
Unsubscribe from the instance and repurchase it: For more information, see Unsubscribe from WAF.
If you reduce the log storage capacity, new logs cannot be written once the storage limit is reached, resulting in data loss.
FAQ
No log data appears
If no log data is generated after you enable the WAF log service, check the following items in order:
Check the log delivery switch for the protected object: Enabling the log service is a global setting. However, you must also enable log delivery for each protected object individually. Enabling the global service alone is not sufficient to start log delivery.
Confirm that traffic is passing through WAF: Logs are generated only when the protected object receives traffic.
Allow for a 10-minute delay: After you enable log delivery, there is a delay of about 10 minutes before log data becomes available.
Check the log storage type configuration: WAF supports three log storage types. If a request does not match a configured storage type, no log data is generated. In Log Configuration > Default Field Settings > Log Type, verify your configuration.
Block Logs: Records requests blocked by security policies such as Block, JS Challenge, Slider Challenge, or dynamic token verification that do not reach the origin server.
Detection Logs: Records requests that trigger monitoring rules only.
Normal Request Logs: Records normal requests only. Requests that pass JS verification, slider verification, or dynamic token verification are also recorded in normal request logs.
Obtain and query WAF logs
You can query and obtain WAF logs in the following ways:
Query and download in the console: Go to the WAF console to query logs. You can download logs by clicking the
icon. For more information, see Query logs.Obtain logs by using APIs: WAF does not offer a direct OpenAPI for querying or downloading logs. Instead, because log data is delivered to Alibaba Cloud Log Service (SLS), you must use SLS OpenAPI operations, such as
GetLogs, along with the Project and Logstore information to retrieve logs. For more information, see Query logs in a Logstore.