This topic describes the billing of the Log Service for WAF feature. You are charged based on the log storage capacity that you purchase.

Overview

The Log Service for WAF feature is available for subscription WAF instances that run the Business or higher edition.

To enable the Log Service for WAF feature, perform the following steps: On the Web Application Firewall buy page, set the Log Service parameter to YES. Then, configure the Log Storage Period and Log Storage Size parameters based on your business requirements. For more information, see Enable Log Service for WAF.

WAF calculates fees based on the log storage capacity that you select and the subscription period of your WAF instance.

Log storage specifications

Specification Impact on billing Description Modification after the Log Service for WAF feature is enabled
Log storage capacity Yes When you enable the Log Service for WAF feature, you can specify the log storage capacity based on your business requirements. The log storage capacity is measured in TB. The log storage capacity is charged by using the subscription billing method. The fees displayed on the Web Application Firewall buy page shall prevail. You can upgrade your WAF instance to increase the log storage capacity. For more information, see Renewal and upgrade.
Notice If the log storage capacity that you purchase is exhausted and you do not increase the log storage capacity at the earliest opportunity, WAF no longer writes log data to the dedicated Logstore of WAF. Logs that are stored for longer than the storage period that you specify are deleted.
Storage period No When you enable the Log Service for WAF feature, you can specify the storage period to 180 days or 360 days. You can specify a custom storage period that ranges from 30 days to 360 days only for subscription WAF instances that run the Business or higher edition. For more information, see Modify log settings.

Methods to specify the log storage capacity

You can specify the log storage capacity based on the log storage configurations and the daily QPS of your website service.

Log storage configurations include the following items:
  • Log type: The log types include full logs and attack logs. If you want to store full logs, you must specify a larger storage capacity than the capacity that is required for attack logs.
  • Log storage period: A longer storage period requires a larger log storage capacity.
  • Fields contained in logs: WAF log fields are classified into required fields and optional fields. If you want to include more optional fields, you must specify a larger log storage capacity.
If you enable the Log Service for WAF feature for the first time, the following default log storage configurations are used: full log type, 180-day storage period, and only required fields. You can modify log storage configurations by using the log settings feature. For more information, see Modify log settings.
For example, the default log storage configurations are used. The following list provides suggestions on how to select the required log storage capacity based on the daily QPS of your website service:
  • If the daily average QPS is not greater than 80, we recommend that you select 3 TB of storage capacity.
  • If the daily average QPS ranges from 80 to 120, we recommend that you select 5 TB of storage capacity.
  • If the daily average QPS ranges from 120 to 260, we recommend that you select 10 TB of storage capacity.
  • If the daily average QPS ranges from 260 to 350, we recommend that you select 15 TB of storage capacity.
  • If the daily average QPS ranges from 350 to 500, we recommend that you select 20 TB of storage capacity.
  • If the daily average QPS ranges from 500 to 1,200, we recommend that you select 50 TB of storage capacity.
Note If you want to customize the log storage configurations, you can estimate the required log storage capacity based on the preceding information.

Billing cycle

The billing cycle of the Log Service for WAF feature varies based on the method that you use to enable the Log Service for WAF feature.
  • If you enable the Log Service for WAF feature when you purchase a subscription WAF instance, the billing cycle of the feature is the same as the subscription period that you select for the WAF instance.
  • If you upgrade your subscription WAF instance to enable the Log Service for WAF feature, the billing cycle of the feature is equal to the remaining validity period of your WAF instance. The billing cycle is accurate to the minute.

Expiration

If your WAF instance expires, the Log Service for WAF feature also expires. If the Log Service for WAF feature expires, the following issues occur:
  • WAF no longer writes log data to the dedicated Logstore.
  • Log data is retained only for seven days.

    If you renew your WAF instance within seven days, you can continue to use this feature. Otherwise, all log data is deleted.