The Log Service for Web Application Firewall (WAF) feature can be enabled for subscription WAF instances of the Business, Enterprise, and Exclusive editions.You are charged based on the log storage capacity that you purchase.

Billable items

You are charged only for the log storage capacity that you purchase.

When you enable the Log Service for WAF feature for a subscription WAF instance, you can specify a log storage capacity based on your business requirements. The log storage capacity is measured in TB. The fee for the log storage capacity is included in the subscription fee for the WAF instance.

You can specify a log storage capacity based on the log storage configurations and the daily QPS of your website service. For more information, see

Billing duration

The billing cycle of the Log Service for WAF feature varies based on the method that you use to enable the Log Service for WAF feature.
  • If you enable the Log Service for WAF feature when you purchase a subscription WAF instance, the billing cycle of the feature is the same as the subscription period that you select for the WAF instance.
  • If you upgrade your subscription WAF instance to enable the Log Service for WAF feature, the billing cycle of the feature is equal to the remaining validity period of your WAF instance. The billing cycle is accurate to the minute.

Expiration

If your WAF instance expires, the Log Service for WAF feature also expires. If the Log Service for WAF feature expires, the following issues occur:
  • WAF no longer writes log data to the dedicated Logstore.
  • Log data is retained only for seven days.

    If you renew your WAF instance within seven days, you can continue to use this feature. Otherwise, all log data is deleted.

Method to specify a log storage capacity

A log storage capacity is related to the storage duration, custom field configuration, and storage type.

FactorDescriptionDefault specification
Storage durationThe longer the storage duration, the larger the required log storage capacity. By default, logs are stored for 180 days.
Custom field configurationWAF log fields are classified into required fields and optional fields.
  • Required fields: You must include required fields in logs.
  • Optional fields: You can customize whether to include optional fields in logs. If you want to include more optional fields, you must specify a larger log storage capacity.
By default, all required fields and some optional fields are included.
Storage typeThe logs can be stored in the following two types:
  • Storage of full logs: You must specify a larger storage capacity than the capacity that is required for attack logs.
  • Storage of attack logs.
By default, the full logs of the domain name for which the Log Service for WAF is enabled are stored.
For example, the default log storage configurations are used. The following list provides suggestions on how to select the required log storage capacity based on the daily QPS of your website service.
Average daily QPSRecommended storage capacity (unit:TB)
Lower than or equal to 80 Mbit/s3
Higher than 80 Mbit/s and lower than or equal to 120 Mbit/s5
Higher than 120 Mbit/s and lower than or equal to 260 Mbit/s10
Higher than 260 Mbit/s and lower than or equal to 350 Mbit/s15
Higher than 350 Mbit/s and lower than or equal to 500 Mbit/s20
Higher than 500 Mbit/s and lower than or equal to 1,200 Mbit/s50
Note You can modify log storage configurations by using the log settings feature. For more information, see Modify log settings.