Estas instrucciones de consulta están preconfiguradas para usarse con Log Service for WAF. Copie cualquier instrucción en una regla de alerta o en un gráfico de registros para monitorear la métrica correspondiente.
Haga clic en una métrica para consultar la instrucción de consulta correspondiente. Para obtener más información sobre las métricas, consulte Common monitoring metrics .
Estructura de las consultas
Todas las instrucciones comparten la misma estructura:
Comienzan con
* |, una búsqueda con comodín que selecciona todas las entradas de registro y va seguida de un bloque de análisis SQL.Agrupan los resultados por
user_idyhost(nombre de dominio).Aplican
WHERE countall > 120para excluir los nombres de dominio con menos de 120 solicitudes en la ventana de tiempo. De esta forma, se eliminan de los resultados los hosts con poco tráfico.Utilizan
countall / 60para calcular el promedio de QPS (consultas por segundo).Devuelven los cinco nombres de dominio principales ordenados según la métrica objetivo.
Campos de registro específicos de WAF
Algunas consultas filtran campos de registro de WAF que no son campos HTTP estándar:
|
Campo |
Descripción |
Valores |
|
|
Módulo de protección de WAF que tomó la decisión final sobre la solicitud |
|
|
|
Acción ejecutada por WAF |
|
Monitoreo de latencia
request_time_msec
Tiempo transcurrido entre el envío de una solicitud por parte del cliente y la recepción de la respuesta.
* |
SELECT
user_id,
host,
round(
round(request_time_cnt * 1.0000 / countall, 4) * 100,
2
) AS percent
FROM (
SELECT
user_id,
host,
count_if(request_time_msec > 500) AS request_time_cnt,
COUNT(*) AS countall
FROM log
GROUP BY
user_id,
host
)
GROUP BY
user_id,
host,
percentupstream_response_time
Tiempo transcurrido desde que WAF reenvía una solicitud al servidor de origen hasta que este devuelve los datos.
* |
SELECT
user_id,
host,
round(
round(
upstream_response_time_cnt * 1.0000 / countall,
4
) * 100,
2
) AS percent
FROM (
SELECT
user_id,
host,
count_if(upstream_response_time > 500) AS upstream_response_time_cnt,
COUNT(*) AS countall
FROM log
GROUP BY
user_id,
host
)
GROUP BY
user_id,
host,
percentMonitoreo de códigos de estado
A continuación se presentan consultas que devuelven el desglose completo de códigos de estado por nombre de dominio, ordenado según el porcentaje del código de estado objetivo. Todas las columnas de tasa calculadas usan round(round(status_N * 1.0000 / countall, 4) * 100, 2) para generar un porcentaje redondeado a dos decimales.
status:200
El servidor procesó la solicitud y devolvió los datos solicitados.
* |
SELECT
user_id,
host AS "Domain name",
Rate_200 AS "Percentage of 200 status code",
Rate_302 AS "Percentage of 302 status code",
Rate_404 AS "Percentage of 404 status code",
Rate_405 AS "Percentage of 405 status code",
Rate_444 AS "Percentage of 444 status code",
Rate_499 AS "Percentage of 499 status code",
Rate_500 AS "Percentage of 500 status code",
Rate_502 AS "Percentage of 502 status code",
Rate_503 AS "Percentage of 503 status code",
Rate_504 AS "Percentage of 504 status code",
countall / 60 AS "aveQPS",
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM (
SELECT
user_id,
host,
round(
round(status_200 * 1.0000 / countall, 4) * 100,
2
) AS Rate_200,
round(
round(status_302 * 1.0000 / countall, 4) * 100,
2
) AS Rate_302,
round(
round (status_404 * 1.0000 / countall, 4) * 100,
2
) AS Rate_404,
round(
round (status_405 * 1.0000 / countall, 4) * 100,
2
) AS Rate_405,
round(
round (status_444 * 1.0000 / countall, 4) * 100,
2
) AS Rate_444,
round(
round (status_499 * 1.0000 / countall, 4) * 100,
2
) AS Rate_499,
round(
round(status_500 * 1.0000 / countall, 4) * 100,
2
) AS Rate_500,
round(
round(status_502 * 1.0000 / countall, 4) * 100,
2
) AS Rate_502,
round(
round(status_503 * 1.0000 / countall, 4) * 100,
2
) AS Rate_503,
round(
round(status_504 * 1.0000 / countall, 4) * 100,
2
) AS Rate_504,
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM (
SELECT
user_id,
host,
count_if(status = 200) AS status_200,
count_if(status = 302) AS status_302,
count_if(status = 404) AS status_404,
count_if(status = 405) AS status_405,
count_if(status = 444) AS status_444,
count_if(status = 499) AS status_499,
count_if(status = 500) AS status_500,
count_if(status = 502) AS status_502,
count_if(status = 503) AS status_503,
count_if(status = 504) AS status_504,
COUNT(*) AS countall
FROM log
GROUP BY
user_id,
host
)
)
WHERE
countall > 120
ORDER BY
Rate_200 DESC
LIMIT
5status:404
El servidor no encontró los recursos solicitados.
* |
SELECT
user_id,
host AS "Domain name",
Rate_200 AS "Percentage of 200 status code",
Rate_302 AS "Percentage of 302 status code",
Rate_404 AS "Percentage of 404 status code",
Rate_405 AS "Percentage of 405 status code",
Rate_500 AS "Percentage of 500 status code",
Rate_502 AS "Percentage of 502 status code",
Rate_503 AS "Percentage of 503 status code",
Rate_504 AS "Percentage of 504 status code",
countall / 60 AS "aveQPS",
status_200,
status_302,
status_404,
status_405,
status_500,
status_502,
status_503,
status_504,
countall
FROM (
SELECT
user_id,
host,
round(
round(status_200 * 1.0000 / countall, 4) * 100,
2
) AS Rate_200,
round(
round(status_302 * 1.0000 / countall, 4) * 100,
2
) AS Rate_302,
round(
round (status_404 * 1.0000 / countall, 4) * 100,
2
) AS Rate_404,
round(
round (status_405 * 1.0000 / countall, 4) * 100,
2
) AS Rate_405,
round(
round(status_500 * 1.0000 / countall, 4) * 100,
2
) AS Rate_500,
round(
round(status_502 * 1.0000 / countall, 4) * 100,
2
) AS Rate_502,
round(
round(status_503 * 1.0000 / countall, 4) * 100,
2
) AS Rate_503,
round(
round(status_504 * 1.0000 / countall, 4) * 100,
2
) AS Rate_504,
status_200,
status_302,
status_404,
status_405,
status_500,
status_502,
status_503,
status_504,
countall
FROM (
SELECT
user_id,
host,
count_if(status = 200) AS status_200,
count_if(status = 302) AS status_302,
count_if(status = 404) AS status_404,
count_if(status = 405) AS status_405,
count_if(status = 499) AS status_499,
count_if(status = 500) AS status_500,
count_if(status = 502) AS status_502,
count_if(status = 503) AS status_503,
count_if(status = 504) AS status_504,
COUNT(*) AS countall
FROM log
GROUP BY
user_id,
host
)
)
WHERE
countall > 120
ORDER BY
Rate_404 DESC
LIMIT
5status:499
Los datos solicitados no se devuelven porque la conexión agotó el tiempo de espera y el cliente la cerró. El servidor devuelve el código de estado 499 al cliente.
* |
SELECT
user_id,
host AS "Domain name",
Rate_200 AS "Percentage of 200 status code",
Rate_302 AS "Percentage of 302 status code",
Rate_404 AS "Percentage of 404 status code",
Rate_405 AS "Percentage of 405 status code",
Rate_444 AS "Percentage of 444 status code",
Rate_499 AS "Percentage of 499 status code",
Rate_500 AS "Percentage of 500 status code",
Rate_502 AS "Percentage of 502 status code",
Rate_503 AS "Percentage of 503 status code",
Rate_504 AS "Percentage of 504 status code",
countall / 60 AS "aveQPS",
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM(
SELECT
user_id,
host,
round(
round(status_200 * 1.0000 / countall, 4) * 100,
2
) AS Rate_200,
round(
round(status_302 * 1.0000 / countall, 4) * 100,
2
) AS Rate_302,
round(
round (status_404 * 1.0000 / countall, 4) * 100,
2
) AS Rate_404,
round(
round (status_405 * 1.0000 / countall, 4) * 100,
2
) AS Rate_405,
round(
round (status_444 * 1.0000 / countall, 4) * 100,
2
) AS Rate_444,
round(
round (status_499 * 1.0000 / countall, 4) * 100,
2
) AS Rate_499,
round(
round(status_500 * 1.0000 / countall, 4) * 100,
2
) AS Rate_500,
round(
round(status_502 * 1.0000 / countall, 4) * 100,
2
) AS Rate_502,
round(
round(status_503 * 1.0000 / countall, 4) * 100,
2
) AS Rate_503,
round(
round(status_504 * 1.0000 / countall, 4) * 100,
2
) AS Rate_504,
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM (
SELECT
user_id,
host,
count_if(status = 200) AS status_200,
count_if(status = 302) AS status_302,
count_if(status = 404) AS status_404,
count_if(status = 405) AS status_405,
count_if(status = 444) AS status_444,
count_if(status = 499) AS status_499,
count_if(status = 500) AS status_500,
count_if(status = 502) AS status_502,
count_if(status = 503) AS status_503,
count_if(status = 504) AS status_504,
COUNT(*) AS countall
FROM log
GROUP BY
user_id,
host
)
)
WHERE
countall > 120
ORDER BY
Rate_499 DESC
LIMIT
5status:500
El servidor no procesó la solicitud debido a un error interno.
* |
SELECT
user_id,
host AS "Domain name",
Rate_200 AS "Percentage of 200 status code",
Rate_302 AS "Percentage of 302 status code",
Rate_404 AS "Percentage of 404 status code",
Rate_405 AS "Percentage of 405 status code",
Rate_444 AS "Percentage of 444 status code",
Rate_499 AS "Percentage of 499 status code",
Rate_500 AS "Percentage of 500 status code",
Rate_502 AS "Percentage of 502 status code",
Rate_503 AS "Percentage of 503 status code",
Rate_504 AS "Percentage of 504 status code",
countall / 60 AS "aveQPS",
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM(
SELECT
user_id,
host,
round(
round(status_200 * 1.0000 / countall, 4) * 100,
2
) AS Rate_200,
round(
round(status_302 * 1.0000 / countall, 4) * 100,
2
) AS Rate_302,
round(
round (status_404 * 1.0000 / countall, 4) * 100,
2
) AS Rate_404,
round(
round (status_405 * 1.0000 / countall, 4) * 100,
2
) AS Rate_405,
round(
round (status_444 * 1.0000 / countall, 4) * 100,
2
) AS Rate_444,
round(
round (status_499 * 1.0000 / countall, 4) * 100,
2
) AS Rate_499,
round(
round(status_500 * 1.0000 / countall, 4) * 100,
2
) AS Rate_500,
round(
round(status_502 * 1.0000 / countall, 4) * 100,
2
) AS Rate_502,
round(
round(status_503 * 1.0000 / countall, 4) * 100,
2
) AS Rate_503,
round(
round(status_504 * 1.0000 / countall, 4) * 100,
2
) AS Rate_504,
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM (
SELECT
user_id,
host,
count_if(status = 200) AS status_200,
count_if(status = 302) AS status_302,
count_if(status = 404) AS status_404,
count_if(status = 405) AS status_405,
count_if(status = 444) AS status_444,
count_if(status = 499) AS status_499,
count_if(status = 500) AS status_500,
count_if(status = 502) AS status_502,
count_if(status = 503) AS status_503,
count_if(status = 504) AS status_504,
COUNT(*) AS countall
FROM log
GROUP BY
user_id,
host
)
)
WHERE
countall > 120
ORDER BY
Rate_500 DESC
LIMIT
5status:502
El servidor actúa como puerta de enlace o proxy y recibe una respuesta no válida del servidor ascendente. El servidor de origen no responde porque la red de retorno al origen es inestable o la dirección IP de retorno al origen está bloqueada.
* |
SELECT
user_id,
host AS "Domain name",
Rate_200 AS "Percentage of 200 status code",
Rate_302 AS "Percentage of 302 status code",
Rate_404 AS "Percentage of 404 status code",
Rate_405 AS "Percentage of 405 status code",
Rate_444 AS "Percentage of 444 status code",
Rate_499 AS "Percentage of 499 status code",
Rate_500 AS "Percentage of 500 status code",
Rate_502 AS "Percentage of 502 status code",
Rate_503 AS "Percentage of 503 status code",
Rate_504 AS "Percentage of 504 status code",
countall / 60 AS "aveQPS",
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM(
SELECT
user_id,
host,
round(
round(status_200 * 1.0000 / countall, 4) * 100,
2
) AS Rate_200,
round(
round(status_302 * 1.0000 / countall, 4) * 100,
2
) AS Rate_302,
round(
round (status_404 * 1.0000 / countall, 4) * 100,
2
) AS Rate_404,
round(
round (status_405 * 1.0000 / countall, 4) * 100,
2
) AS Rate_405,
round(
round (status_444 * 1.0000 / countall, 4) * 100,
2
) AS Rate_444,
round(
round (status_499 * 1.0000 / countall, 4) * 100,
2
) AS Rate_499,
round(
round(status_500 * 1.0000 / countall, 4) * 100,
2
) AS Rate_500,
round(
round(status_502 * 1.0000 / countall, 4) * 100,
2
) AS Rate_502,
round(
round(status_503 * 1.0000 / countall, 4) * 100,
2
) AS Rate_503,
round(
round(status_504 * 1.0000 / countall, 4) * 100,
2
) AS Rate_504,
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM (
SELECT
user_id,
host,
count_if(status = 200) AS status_200,
count_if(status = 302) AS status_302,
count_if(status = 404) AS status_404,
count_if(status = 405) AS status_405,
count_if(status = 444) AS status_444,
count_if(status = 499) AS status_499,
count_if(status = 500) AS status_500,
count_if(status = 502) AS status_502,
count_if(status = 503) AS status_503,
count_if(status = 504) AS status_504,
COUNT(*) AS countall
FROM log
GROUP BY
user_id,
host
)
)
WHERE
countall > 120
ORDER BY
Rate_502 DESC
LIMIT
5status:503
El servicio no está disponible porque el servidor está sobrecargado o en mantenimiento.
* |
SELECT
user_id,
host AS "Domain name",
Rate_200 AS "Percentage of 200 status code",
Rate_302 AS "Percentage of 302 status code",
Rate_404 AS "Percentage of 404 status code",
Rate_405 AS "Percentage of 405 status code",
Rate_444 AS "Percentage of 444 status code",
Rate_499 AS "Percentage of 499 status code",
Rate_500 AS "Percentage of 500 status code",
Rate_502 AS "Percentage of 502 status code",
Rate_503 AS "Percentage of 503 status code",
Rate_504 AS "Percentage of 504 status code",
countall / 60 AS "aveQPS",
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM(
SELECT
user_id,
host,
round(
round(status_200 * 1.0000 / countall, 4) * 100,
2
) AS Rate_200,
round(
round(status_302 * 1.0000 / countall, 4) * 100,
2
) AS Rate_302,
round(
round (status_404 * 1.0000 / countall, 4) * 100,
2
) AS Rate_404,
round(
round (status_405 * 1.0000 / countall, 4) * 100,
2
) AS Rate_405,
round(
round (status_444 * 1.0000 / countall, 4) * 100,
2
) AS Rate_444,
round(
round (status_499 * 1.0000 / countall, 4) * 100,
2
) AS Rate_499,
round(
round(status_500 * 1.0000 / countall, 4) * 100,
2
) AS Rate_500,
round(
round(status_502 * 1.0000 / countall, 4) * 100,
2
) AS Rate_502,
round(
round(status_503 * 1.0000 / countall, 4) * 100,
2
) AS Rate_503,
round(
round(status_504 * 1.0000 / countall, 4) * 100,
2
) AS Rate_504,
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM (
SELECT
user_id,
host,
count_if(status = 200) AS status_200,
count_if(status = 302) AS status_302,
count_if(status = 404) AS status_404,
count_if(status = 405) AS status_405,
count_if(status = 444) AS status_444,
count_if(status = 499) AS status_499,
count_if(status = 500) AS status_500,
count_if(status = 502) AS status_502,
count_if(status = 503) AS status_503,
count_if(status = 504) AS status_504,
COUNT(*) AS countall
FROM log
GROUP BY
user_id,
host
)
)
WHERE
countall > 120
ORDER BY
Rate_503 DESC
LIMIT
5status:504
El servidor actúa como puerta de enlace o proxy y no recibe la solicitud del servidor ascendente a tiempo.
* |
SELECT
user_id,
host AS "Domain name",
Rate_200 AS "Percentage of 200 status code",
Rate_302 AS "Percentage of 302 status code",
Rate_404 AS "Percentage of 404 status code",
Rate_405 AS "Percentage of 405 status code",
Rate_444 AS "Percentage of 444 status code",
Rate_499 AS "Percentage of 499 status code",
Rate_500 AS "Percentage of 500 status code",
Rate_502 AS "Percentage of 502 status code",
Rate_503 AS "Percentage of 503 status code",
Rate_504 AS "Percentage of 504 status code",
countall / 60 AS "aveQPS",
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM(
SELECT
user_id,
host,
round(
round(status_200 * 1.0000 / countall, 4) * 100,
2
) AS Rate_200,
round(
round(status_302 * 1.0000 / countall, 4) * 100,
2
) AS Rate_302,
round(
round (status_404 * 1.0000 / countall, 4) * 100,
2
) AS Rate_404,
round(
round (status_405 * 1.0000 / countall, 4) * 100,
2
) AS Rate_405,
round(
round (status_444 * 1.0000 / countall, 4) * 100,
2
) AS Rate_444,
round(
round (status_499 * 1.0000 / countall, 4) * 100,
2
) AS Rate_499,
round(
round(status_500 * 1.0000 / countall, 4) * 100,
2
) AS Rate_500,
round(
round(status_502 * 1.0000 / countall, 4) * 100,
2
) AS Rate_502,
round(
round(status_503 * 1.0000 / countall, 4) * 100,
2
) AS Rate_503,
round(
round(status_504 * 1.0000 / countall, 4) * 100,
2
) AS Rate_504,
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM (
SELECT
user_id,
host,
count_if(status = 200) AS status_200,
count_if(status = 302) AS status_302,
count_if(status = 404) AS status_404,
count_if(status = 405) AS status_405,
count_if(status = 444) AS status_444,
count_if(status = 499) AS status_499,
count_if(status = 500) AS status_500,
count_if(status = 502) AS status_502,
count_if(status = 503) AS status_503,
count_if(status = 504) AS status_504,
COUNT(*) AS countall
FROM log
GROUP BY
user_id,
host
)
)
WHERE
countall > 120
ORDER BY
Rate_504 DESC
LIMIT
5Monitoreo de protección de WAF
Las siguientes consultas filtran campos específicos de WAF (final_plugin y waf_action) para identificar las solicitudes sobre las que actuó WAF. Úselas para monitorear el volumen y la tasa de tráfico bloqueado por nombre de dominio.
status:302 or 200 and final_plugin:'cc'
Se activa la validación CAPTCHA de JavaScript.
* |
SELECT
user_id,
host AS "Domain name",
Rate_200 AS "Percentage of 200 status code",
Rate_302 AS "Percentage of 302 status code",
Rate_404 AS "Percentage of 404 status code",
Rate_405 AS "Percentage of 405 status code",
Rate_444 AS "Percentage of 444 status code",
Rate_499 AS "Percentage of 499 status code",
Rate_500 AS "Percentage of 500 status code",
Rate_502 AS "Percentage of 502 status code",
Rate_503 AS "Percentage of 503 status code",
Rate_504 AS "Percentage of 504 status code",
countall / 60 AS "aveQPS",
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM (
SELECT
user_id,
host,
round(
round(status_200 * 1.0000 / countall, 4) * 100,
2
) AS Rate_200,
round(
round(status_302 * 1.0000 / countall, 4) * 100,
2
) AS Rate_302,
round(
round (status_404 * 1.0000 / countall, 4) * 100,
2
) AS Rate_404,
round(
round (status_405 * 1.0000 / countall, 4) * 100,
2
) AS Rate_405,
round(
round (status_444 * 1.0000 / countall, 4) * 100,
2
) AS Rate_444,
round(
round (status_499 * 1.0000 / countall, 4) * 100,
2
) AS Rate_499,
round(
round(status_500 * 1.0000 / countall, 4) * 100,
2
) AS Rate_500,
round(
round(status_502 * 1.0000 / countall, 4) * 100,
2
) AS Rate_502,
round(
round(status_503 * 1.0000 / countall, 4) * 100,
2
) AS Rate_503,
round(
round(status_504 * 1.0000 / countall, 4) * 100,
2
) AS Rate_504,
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM (
SELECT
user_id,
host,
count_if(
status = 200
AND final_plugin = 'cc'
) AS status_200,
count_if(
status = 302
AND final_plugin = 'cc'
) AS status_302,
count_if(status = 404) AS status_404,
count_if(status = 405) AS status_405,
count_if(status = 444) AS status_444,
count_if(status = 499) AS status_499,
count_if(status = 500) AS status_500,
count_if(status = 502) AS status_502,
count_if(status = 503) AS status_503,
count_if(status = 504) AS status_504,
COUNT(*) AS countall
FROM log
GROUP BY
user_id,
host
)
)
WHERE
countall > 120
ORDER BY
Rate_200 DESC
LIMIT
5status:200 and final_plugin:'antifraud'
Las reglas de control de riesgos de datos bloquearon la solicitud.
* |
SELECT
user_id,
host AS "Domain name",
Rate_200 AS "Percentage of 200 status code",
Rate_302 AS "Percentage of 302 status code",
Rate_404 AS "Percentage of 404 status code",
Rate_405 AS "Percentage of 405 status code",
Rate_444 AS "Percentage of 444 status code",
Rate_499 AS "Percentage of 499 status code",
Rate_500 AS "Percentage of 500 status code",
Rate_502 AS "Percentage of 502 status code",
Rate_503 AS "Percentage of 503 status code",
Rate_504 AS "Percentage of 504 status code",
countall / 60 AS "aveQPS",
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM (
SELECT
user_id,
host,
round(
round(status_200 * 1.0000 / countall, 4) * 100,
2
) AS Rate_200,
round(
round(status_302 * 1.0000 / countall, 4) * 100,
2
) AS Rate_302,
round(
round (status_404 * 1.0000 / countall, 4) * 100,
2
) AS Rate_404,
round(
round (status_405 * 1.0000 / countall, 4) * 100,
2
) AS Rate_405,
round(
round (status_444 * 1.0000 / countall, 4) * 100,
2
) AS Rate_444,
round(
round (status_499 * 1.0000 / countall, 4) * 100,
2
) AS Rate_499,
round(
round(status_500 * 1.0000 / countall, 4) * 100,
2
) AS Rate_500,
round(
round(status_502 * 1.0000 / countall, 4) * 100,
2
) AS Rate_502,
round(
round(status_503 * 1.0000 / countall, 4) * 100,
2
) AS Rate_503,
round(
round(status_504 * 1.0000 / countall, 4) * 100,
2
) AS Rate_504,
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM (
SELECT
user_id,
host,
count_if(
status = 200
AND final_plugin = 'antifraud'
) AS status_200,
count_if(status = 302) AS status_302,
count_if(status = 404) AS status_404,
count_if(status = 405) AS status_405,
count_if(status = 444) AS status_444,
count_if(status = 499) AS status_499,
count_if(status = 500) AS status_500,
count_if(status = 502) AS status_502,
count_if(status = 503) AS status_503,
count_if(status = 504) AS status_504,
COUNT(*) AS countall
FROM log
GROUP BY
user_id,
host
)
)
WHERE
countall > 120
ORDER BY
Rate_200 DESC
LIMIT
5status:405 and waf_action:'block'
Protection Rules Engine bloqueó la solicitud.
Esta consulta cuenta las respuestas con estado 405 donde waf_action = 'block', lo cual indica que Protection Rules Engine bloqueó explícitamente la solicitud.
* |
SELECT
user_id,
host AS "Domain name",
Rate_200 AS "Percentage of 200 status code",
Rate_302 AS "Percentage of 302 status code",
Rate_404 AS "Percentage of 404 status code",
Rate_405 AS "Percentage of 405 status code",
Rate_444 AS "Percentage of 444 status code",
Rate_499 AS "Percentage of 499 status code",
Rate_500 AS "Percentage of 500 status code",
Rate_502 AS "Percentage of 502 status code",
Rate_503 AS "Percentage of 503 status code",
Rate_504 AS "Percentage of 504 status code",
countall / 60 AS "aveQPS",
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM(
SELECT
user_id,
host,
round(
round(status_200 * 1.0000 / countall, 4) * 100,
2
) AS Rate_200,
round(
round(status_302 * 1.0000 / countall, 4) * 100,
2
) AS Rate_302,
round(
round (status_404 * 1.0000 / countall, 4) * 100,
2
) AS Rate_404,
round(
round (status_405 * 1.0000 / countall, 4) * 100,
2
) AS Rate_405,
round(
round (status_444 * 1.0000 / countall, 4) * 100,
2
) AS Rate_444,
round(
round (status_499 * 1.0000 / countall, 4) * 100,
2
) AS Rate_499,
round(
round(status_500 * 1.0000 / countall, 4) * 100,
2
) AS Rate_500,
round(
round(status_502 * 1.0000 / countall, 4) * 100,
2
) AS Rate_502,
round(
round(status_503 * 1.0000 / countall, 4) * 100,
2
) AS Rate_503,
round(
round(status_504 * 1.0000 / countall, 4) * 100,
2
) AS Rate_504,
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM (
SELECT
user_id,
host,
count_if(status = 200) AS status_200,
count_if(status = 302) AS status_302,
count_if(status = 404) AS status_404,
count_if(
status = 405
AND waf_action = 'block'
) AS status_405,
count_if(status = 444) AS status_444,
count_if(status = 499) AS status_499,
count_if(status = 500) AS status_500,
count_if(status = 502) AS status_502,
count_if(status = 503) AS status_503,
count_if(status = 504) AS status_504,
COUNT(*) AS countall
FROM log
GROUP BY
user_id,
host
)
)
WHERE
countall > 120
ORDER BY
Rate_405 DESC
LIMIT
5status:405 and final_plugin:'acl'
La lista negra o las reglas personalizadas de control de acceso bloquearon la solicitud.
Esta consulta cuenta las respuestas con estado 405 donde final_plugin = 'acl', lo cual indica que una regla de lista de control de acceso (ACL), como una lista negra o una regla personalizada de control de acceso, bloqueó la solicitud.
* |
SELECT
user_id,
host AS "Domain name",
Rate_200 AS "Percentage of 200 status code",
Rate_302 AS "Percentage of 302 status code",
Rate_404 AS "Percentage of 404 status code",
Rate_405 AS "Percentage of 405 status code",
Rate_444 AS "Percentage of 444 status code",
Rate_499 AS "Percentage of 499 status code",
Rate_500 AS "Percentage of 500 status code",
Rate_502 AS "Percentage of 502 status code",
Rate_503 AS "Percentage of 503 status code",
Rate_504 AS "Percentage of 504 status code",
countall / 60 AS "aveQPS",
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM(
SELECT
user_id,
host,
round(
round(status_200 * 1.0000 / countall, 4) * 100,
2
) AS Rate_200,
round(
round(status_302 * 1.0000 / countall, 4) * 100,
2
) AS Rate_302,
round(
round (status_404 * 1.0000 / countall, 4) * 100,
2
) AS Rate_404,
round(
round (status_405 * 1.0000 / countall, 4) * 100,
2
) AS Rate_405,
round(
round (status_444 * 1.0000 / countall, 4) * 100,
2
) AS Rate_444,
round(
round (status_499 * 1.0000 / countall, 4) * 100,
2
) AS Rate_499,
round(
round(status_500 * 1.0000 / countall, 4) * 100,
2
) AS Rate_500,
round(
round(status_502 * 1.0000 / countall, 4) * 100,
2
) AS Rate_502,
round(
round(status_503 * 1.0000 / countall, 4) * 100,
2
) AS Rate_503,
round(
round(status_504 * 1.0000 / countall, 4) * 100,
2
) AS Rate_504,
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM (
SELECT
user_id,
host,
count_if(status = 200) AS status_200,
count_if(status = 302) AS status_302,
count_if(status = 404) AS status_404,
count_if(
status = 405
AND final_plugin = 'acl'
) AS status_405,
count_if(status = 444) AS status_444,
count_if(status = 499) AS status_499,
count_if(status = 500) AS status_500,
count_if(status = 502) AS status_502,
count_if(status = 503) AS status_503,
count_if(status = 504) AS status_504,
COUNT(*) AS countall
FROM log
GROUP BY
user_id,
host
)
)
WHERE
countall > 120
ORDER BY
Rate_405 DESC
LIMIT
5status:444
Las reglas de protección contra inundación HTTP bloquearon la solicitud.
* |
SELECT
user_id,
host AS "Domain name",
Rate_200 AS "Percentage of 200 status code",
Rate_302 AS "Percentage of 302 status code",
Rate_404 AS "Percentage of 404 status code",
Rate_405 AS "Percentage of 405 status code",
Rate_444 AS "Percentage of 444 status code",
Rate_499 AS "Percentage of 499 status code",
Rate_500 AS "Percentage of 500 status code",
Rate_502 AS "Percentage of 502 status code",
Rate_503 AS "Percentage of 503 status code",
Rate_504 AS "Percentage of 504 status code",
countall / 60 AS "aveQPS",
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM(
SELECT
user_id,
host,
round(
round(status_200 * 1.0000 / countall, 4) * 100,
2
) AS Rate_200,
round(
round(status_302 * 1.0000 / countall, 4) * 100,
2
) AS Rate_302,
round(
round (status_404 * 1.0000 / countall, 4) * 100,
2
) AS Rate_404,
round(
round (status_405 * 1.0000 / countall, 4) * 100,
2
) AS Rate_405,
round(
round (status_444 * 1.0000 / countall, 4) * 100,
2
) AS Rate_444,
round(
round (status_499 * 1.0000 / countall, 4) * 100,
2
) AS Rate_499,
round(
round(status_500 * 1.0000 / countall, 4) * 100,
2
) AS Rate_500,
round(
round(status_502 * 1.0000 / countall, 4) * 100,
2
) AS Rate_502,
round(
round(status_503 * 1.0000 / countall, 4) * 100,
2
) AS Rate_503,
round(
round(status_504 * 1.0000 / countall, 4) * 100,
2
) AS Rate_504,
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM (
SELECT
user_id,
host,
count_if(status = 200) AS status_200,
count_if(status = 302) AS status_302,
count_if(status = 404) AS status_404,
count_if(status = 405) AS status_405,
count_if(status = 444) AS status_444,
count_if(status = 499) AS status_499,
count_if(status = 500) AS status_500,
count_if(status = 502) AS status_502,
count_if(status = 503) AS status_503,
count_if(status = 504) AS status_504,
COUNT(*) AS countall
FROM log
GROUP BY
user_id,
host
)
)
WHERE
countall > 120
ORDER BY
Rate_444 DESC
LIMIT
5Pasos siguientes
Common monitoring metrics: descripciones de todas las métricas disponibles en Log Service for WAF.