Ces instructions de requête sont prédéfinies pour une utilisation avec Log Service pour WAF. Copiez n'importe quelle instruction dans une règle d'alerte ou un graphique de journal pour surveiller la métrique correspondante.
Cliquez sur une métrique pour consulter l'instruction de requête correspondante. Pour plus d'informations sur les métriques, consultez Métriques de surveillance courantes .
Structure des requêtes
Toutes les instructions partagent la même structure :
Commencez par
* |— une recherche générique qui sélectionne toutes les entrées de journal, suivie d'un bloc d'analyse SQL.Regroupez les résultats par
user_idethost(nom de domaine).Appliquez
WHERE countall > 120pour filtrer les noms de domaine ayant reçu moins de 120 requêtes dans la fenêtre, ce qui permet d'exclure les hôtes à faible trafic des résultats.Utilisez
countall / 60pour calculer le QPS moyen (requêtes par seconde).Renvoyez les 5 premiers noms de domaine classés selon la métrique cible.
Champs de journal spécifiques à WAF
Certaines requêtes filtrent sur des champs de journal WAF qui ne sont pas des champs HTTP standard :
| Champ | Description | Valeurs |
|---|---|---|
final_plugin |
Le module de protection WAF qui a pris la décision finale concernant la requête | cc (protection contre les attaques HTTP flood), acl (règles de contrôle d'accès), antifraud (contrôle des risques liés aux données) |
waf_action |
L'action entreprise par WAF | block |
Surveillance de la latence
request_time_msec
La durée écoulée entre l'envoi d'une requête par le client et la réception d'une réponse par celui-ci.
* |
SELECT
user_id,
host,
round(
round(request_time_cnt * 1.0000 / countall, 4) * 100,
2
) AS percent
FROM (
SELECT
user_id,
host,
count_if(request_time_msec > 500) AS request_time_cnt,
COUNT(*) AS countall
FROM log
GROUP BY
user_id,
host
)
GROUP BY
user_id,
host,
percentupstream_response_time
La durée écoulée entre le transfert d'une requête par WAF vers le serveur d'origine et le retour des données par ce dernier.
* |
SELECT
user_id,
host,
round(
round(
upstream_response_time_cnt * 1.0000 / countall,
4
) * 100,
2
) AS percent
FROM (
SELECT
user_id,
host,
count_if(upstream_response_time > 500) AS upstream_response_time_cnt,
COUNT(*) AS countall
FROM log
GROUP BY
user_id,
host
)
GROUP BY
user_id,
host,
percentSurveillance des codes d'état
Les requêtes suivantes renvoient une répartition complète des codes d'état par nom de domaine, classée selon le pourcentage du code d'état cible. Toutes les colonnes de taux calculées utilisent round(round(status_N * 1.0000 / countall, 4) * 100, 2) pour produire un pourcentage arrondi à deux décimales.
status:200
Le serveur a traité la requête et renvoyé les données demandées.
* |
SELECT
user_id,
host AS "Domain name",
Rate_200 AS "Percentage of 200 status code",
Rate_302 AS "Percentage of 302 status code",
Rate_404 AS "Percentage of 404 status code",
Rate_405 AS "Percentage of 405 status code",
Rate_444 AS "Percentage of 444 status code",
Rate_499 AS "Percentage of 499 status code",
Rate_500 AS "Percentage of 500 status code",
Rate_502 AS "Percentage of 502 status code",
Rate_503 AS "Percentage of 503 status code",
Rate_504 AS "Percentage of 504 status code",
countall / 60 AS "aveQPS",
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM (
SELECT
user_id,
host,
round(
round(status_200 * 1.0000 / countall, 4) * 100,
2
) AS Rate_200,
round(
round(status_302 * 1.0000 / countall, 4) * 100,
2
) AS Rate_302,
round(
round (status_404 * 1.0000 / countall, 4) * 100,
2
) AS Rate_404,
round(
round (status_405 * 1.0000 / countall, 4) * 100,
2
) AS Rate_405,
round(
round (status_444 * 1.0000 / countall, 4) * 100,
2
) AS Rate_444,
round(
round (status_499 * 1.0000 / countall, 4) * 100,
2
) AS Rate_499,
round(
round(status_500 * 1.0000 / countall, 4) * 100,
2
) AS Rate_500,
round(
round(status_502 * 1.0000 / countall, 4) * 100,
2
) AS Rate_502,
round(
round(status_503 * 1.0000 / countall, 4) * 100,
2
) AS Rate_503,
round(
round(status_504 * 1.0000 / countall, 4) * 100,
2
) AS Rate_504,
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM (
SELECT
user_id,
host,
count_if(status = 200) AS status_200,
count_if(status = 302) AS status_302,
count_if(status = 404) AS status_404,
count_if(status = 405) AS status_405,
count_if(status = 444) AS status_444,
count_if(status = 499) AS status_499,
count_if(status = 500) AS status_500,
count_if(status = 502) AS status_502,
count_if(status = 503) AS status_503,
count_if(status = 504) AS status_504,
COUNT(*) AS countall
FROM log
GROUP BY
user_id,
host
)
)
WHERE
countall > 120
ORDER BY
Rate_200 DESC
LIMIT
5status:404
Le serveur n'a pas trouvé les ressources demandées.
* |
SELECT
user_id,
host AS "Domain name",
Rate_200 AS "Percentage of 200 status code",
Rate_302 AS "Percentage of 302 status code",
Rate_404 AS "Percentage of 404 status code",
Rate_405 AS "Percentage of 405 status code",
Rate_500 AS "Percentage of 500 status code",
Rate_502 AS "Percentage of 502 status code",
Rate_503 AS "Percentage of 503 status code",
Rate_504 AS "Percentage of 504 status code",
countall / 60 AS "aveQPS",
status_200,
status_302,
status_404,
status_405,
status_500,
status_502,
status_503,
status_504,
countall
FROM (
SELECT
user_id,
host,
round(
round(status_200 * 1.0000 / countall, 4) * 100,
2
) AS Rate_200,
round(
round(status_302 * 1.0000 / countall, 4) * 100,
2
) AS Rate_302,
round(
round (status_404 * 1.0000 / countall, 4) * 100,
2
) AS Rate_404,
round(
round (status_405 * 1.0000 / countall, 4) * 100,
2
) AS Rate_405,
round(
round(status_500 * 1.0000 / countall, 4) * 100,
2
) AS Rate_500,
round(
round(status_502 * 1.0000 / countall, 4) * 100,
2
) AS Rate_502,
round(
round(status_503 * 1.0000 / countall, 4) * 100,
2
) AS Rate_503,
round(
round(status_504 * 1.0000 / countall, 4) * 100,
2
) AS Rate_504,
status_200,
status_302,
status_404,
status_405,
status_500,
status_502,
status_503,
status_504,
countall
FROM (
SELECT
user_id,
host,
count_if(status = 200) AS status_200,
count_if(status = 302) AS status_302,
count_if(status = 404) AS status_404,
count_if(status = 405) AS status_405,
count_if(status = 499) AS status_499,
count_if(status = 500) AS status_500,
count_if(status = 502) AS status_502,
count_if(status = 503) AS status_503,
count_if(status = 504) AS status_504,
COUNT(*) AS countall
FROM log
GROUP BY
user_id,
host
)
)
WHERE
countall > 120
ORDER BY
Rate_404 DESC
LIMIT
5status:499
Les données demandées ne sont pas renvoyées car la connexion a expiré et le client a fermé la connexion. Le serveur renvoie le code d'état 499 au client.
* |
SELECT
user_id,
host AS "Domain name",
Rate_200 AS "Percentage of 200 status code",
Rate_302 AS "Percentage of 302 status code",
Rate_404 AS "Percentage of 404 status code",
Rate_405 AS "Percentage of 405 status code",
Rate_444 AS "Percentage of 444 status code",
Rate_499 AS "Percentage of 499 status code",
Rate_500 AS "Percentage of 500 status code",
Rate_502 AS "Percentage of 502 status code",
Rate_503 AS "Percentage of 503 status code",
Rate_504 AS "Percentage of 504 status code",
countall / 60 AS "aveQPS",
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM(
SELECT
user_id,
host,
round(
round(status_200 * 1.0000 / countall, 4) * 100,
2
) AS Rate_200,
round(
round(status_302 * 1.0000 / countall, 4) * 100,
2
) AS Rate_302,
round(
round (status_404 * 1.0000 / countall, 4) * 100,
2
) AS Rate_404,
round(
round (status_405 * 1.0000 / countall, 4) * 100,
2
) AS Rate_405,
round(
round (status_444 * 1.0000 / countall, 4) * 100,
2
) AS Rate_444,
round(
round (status_499 * 1.0000 / countall, 4) * 100,
2
) AS Rate_499,
round(
round(status_500 * 1.0000 / countall, 4) * 100,
2
) AS Rate_500,
round(
round(status_502 * 1.0000 / countall, 4) * 100,
2
) AS Rate_502,
round(
round(status_503 * 1.0000 / countall, 4) * 100,
2
) AS Rate_503,
round(
round(status_504 * 1.0000 / countall, 4) * 100,
2
) AS Rate_504,
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM (
SELECT
user_id,
host,
count_if(status = 200) AS status_200,
count_if(status = 302) AS status_302,
count_if(status = 404) AS status_404,
count_if(status = 405) AS status_405,
count_if(status = 444) AS status_444,
count_if(status = 499) AS status_499,
count_if(status = 500) AS status_500,
count_if(status = 502) AS status_502,
count_if(status = 503) AS status_503,
count_if(status = 504) AS status_504,
COUNT(*) AS countall
FROM log
GROUP BY
user_id,
host
)
)
WHERE
countall > 120
ORDER BY
Rate_499 DESC
LIMIT
5status:500
Le serveur n'a pas pu traiter la requête en raison d'une erreur interne.
* |
SELECT
user_id,
host AS "Domain name",
Rate_200 AS "Percentage of 200 status code",
Rate_302 AS "Percentage of 302 status code",
Rate_404 AS "Percentage of 404 status code",
Rate_405 AS "Percentage of 405 status code",
Rate_444 AS "Percentage of 444 status code",
Rate_499 AS "Percentage of 499 status code",
Rate_500 AS "Percentage of 500 status code",
Rate_502 AS "Percentage of 502 status code",
Rate_503 AS "Percentage of 503 status code",
Rate_504 AS "Percentage of 504 status code",
countall / 60 AS "aveQPS",
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM(
SELECT
user_id,
host,
round(
round(status_200 * 1.0000 / countall, 4) * 100,
2
) AS Rate_200,
round(
round(status_302 * 1.0000 / countall, 4) * 100,
2
) AS Rate_302,
round(
round (status_404 * 1.0000 / countall, 4) * 100,
2
) AS Rate_404,
round(
round (status_405 * 1.0000 / countall, 4) * 100,
2
) AS Rate_405,
round(
round (status_444 * 1.0000 / countall, 4) * 100,
2
) AS Rate_444,
round(
round (status_499 * 1.0000 / countall, 4) * 100,
2
) AS Rate_499,
round(
round(status_500 * 1.0000 / countall, 4) * 100,
2
) AS Rate_500,
round(
round(status_502 * 1.0000 / countall, 4) * 100,
2
) AS Rate_502,
round(
round(status_503 * 1.0000 / countall, 4) * 100,
2
) AS Rate_503,
round(
round(status_504 * 1.0000 / countall, 4) * 100,
2
) AS Rate_504,
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM (
SELECT
user_id,
host,
count_if(status = 200) AS status_200,
count_if(status = 302) AS status_302,
count_if(status = 404) AS status_404,
count_if(status = 405) AS status_405,
count_if(status = 444) AS status_444,
count_if(status = 499) AS status_499,
count_if(status = 500) AS status_500,
count_if(status = 502) AS status_502,
count_if(status = 503) AS status_503,
count_if(status = 504) AS status_504,
COUNT(*) AS countall
FROM log
GROUP BY
user_id,
host
)
)
WHERE
countall > 120
ORDER BY
Rate_500 DESC
LIMIT
5status:502
Le serveur, utilisé comme passerelle ou proxy, a reçu une réponse invalide du serveur amont. Le serveur d'origine ne répond pas car le réseau de retour vers l'origine est instable ou l'adresse IP de retour vers l'origine est bloquée.
* |
SELECT
user_id,
host AS "Domain name",
Rate_200 AS "Percentage of 200 status code",
Rate_302 AS "Percentage of 302 status code",
Rate_404 AS "Percentage of 404 status code",
Rate_405 AS "Percentage of 405 status code",
Rate_444 AS "Percentage of 444 status code",
Rate_499 AS "Percentage of 499 status code",
Rate_500 AS "Percentage of 500 status code",
Rate_502 AS "Percentage of 502 status code",
Rate_503 AS "Percentage of 503 status code",
Rate_504 AS "Percentage of 504 status code",
countall / 60 AS "aveQPS",
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM(
SELECT
user_id,
host,
round(
round(status_200 * 1.0000 / countall, 4) * 100,
2
) AS Rate_200,
round(
round(status_302 * 1.0000 / countall, 4) * 100,
2
) AS Rate_302,
round(
round (status_404 * 1.0000 / countall, 4) * 100,
2
) AS Rate_404,
round(
round (status_405 * 1.0000 / countall, 4) * 100,
2
) AS Rate_405,
round(
round (status_444 * 1.0000 / countall, 4) * 100,
2
) AS Rate_444,
round(
round (status_499 * 1.0000 / countall, 4) * 100,
2
) AS Rate_499,
round(
round(status_500 * 1.0000 / countall, 4) * 100,
2
) AS Rate_500,
round(
round(status_502 * 1.0000 / countall, 4) * 100,
2
) AS Rate_502,
round(
round(status_503 * 1.0000 / countall, 4) * 100,
2
) AS Rate_503,
round(
round(status_504 * 1.0000 / countall, 4) * 100,
2
) AS Rate_504,
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM (
SELECT
user_id,
host,
count_if(status = 200) AS status_200,
count_if(status = 302) AS status_302,
count_if(status = 404) AS status_404,
count_if(status = 405) AS status_405,
count_if(status = 444) AS status_444,
count_if(status = 499) AS status_499,
count_if(status = 500) AS status_500,
count_if(status = 502) AS status_502,
count_if(status = 503) AS status_503,
count_if(status = 504) AS status_504,
COUNT(*) AS countall
FROM log
GROUP BY
user_id,
host
)
)
WHERE
countall > 120
ORDER BY
Rate_502 DESC
LIMIT
5status:503
Le service est indisponible car le serveur est surchargé ou en cours de maintenance.
* |
SELECT
user_id,
host AS "Domain name",
Rate_200 AS "Percentage of 200 status code",
Rate_302 AS "Percentage of 302 status code",
Rate_404 AS "Percentage of 404 status code",
Rate_405 AS "Percentage of 405 status code",
Rate_444 AS "Percentage of 444 status code",
Rate_499 AS "Percentage of 499 status code",
Rate_500 AS "Percentage of 500 status code",
Rate_502 AS "Percentage of 502 status code",
Rate_503 AS "Percentage of 503 status code",
Rate_504 AS "Percentage of 504 status code",
countall / 60 AS "aveQPS",
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM(
SELECT
user_id,
host,
round(
round(status_200 * 1.0000 / countall, 4) * 100,
2
) AS Rate_200,
round(
round(status_302 * 1.0000 / countall, 4) * 100,
2
) AS Rate_302,
round(
round (status_404 * 1.0000 / countall, 4) * 100,
2
) AS Rate_404,
round(
round (status_405 * 1.0000 / countall, 4) * 100,
2
) AS Rate_405,
round(
round (status_444 * 1.0000 / countall, 4) * 100,
2
) AS Rate_444,
round(
round (status_499 * 1.0000 / countall, 4) * 100,
2
) AS Rate_499,
round(
round(status_500 * 1.0000 / countall, 4) * 100,
2
) AS Rate_500,
round(
round(status_502 * 1.0000 / countall, 4) * 100,
2
) AS Rate_502,
round(
round(status_503 * 1.0000 / countall, 4) * 100,
2
) AS Rate_503,
round(
round(status_504 * 1.0000 / countall, 4) * 100,
2
) AS Rate_504,
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM (
SELECT
user_id,
host,
count_if(status = 200) AS status_200,
count_if(status = 302) AS status_302,
count_if(status = 404) AS status_404,
count_if(status = 405) AS status_405,
count_if(status = 444) AS status_444,
count_if(status = 499) AS status_499,
count_if(status = 500) AS status_500,
count_if(status = 502) AS status_502,
count_if(status = 503) AS status_503,
count_if(status = 504) AS status_504,
COUNT(*) AS countall
FROM log
GROUP BY
user_id,
host
)
)
WHERE
countall > 120
ORDER BY
Rate_503 DESC
LIMIT
5status:504
Le serveur, utilisé comme passerelle ou proxy, n'a pas reçu la requête du serveur amont dans les délais.
* |
SELECT
user_id,
host AS "Domain name",
Rate_200 AS "Percentage of 200 status code",
Rate_302 AS "Percentage of 302 status code",
Rate_404 AS "Percentage of 404 status code",
Rate_405 AS "Percentage of 405 status code",
Rate_444 AS "Percentage of 444 status code",
Rate_499 AS "Percentage of 499 status code",
Rate_500 AS "Percentage of 500 status code",
Rate_502 AS "Percentage of 502 status code",
Rate_503 AS "Percentage of 503 status code",
Rate_504 AS "Percentage of 504 status code",
countall / 60 AS "aveQPS",
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM(
SELECT
user_id,
host,
round(
round(status_200 * 1.0000 / countall, 4) * 100,
2
) AS Rate_200,
round(
round(status_302 * 1.0000 / countall, 4) * 100,
2
) AS Rate_302,
round(
round (status_404 * 1.0000 / countall, 4) * 100,
2
) AS Rate_404,
round(
round (status_405 * 1.0000 / countall, 4) * 100,
2
) AS Rate_405,
round(
round (status_444 * 1.0000 / countall, 4) * 100,
2
) AS Rate_444,
round(
round (status_499 * 1.0000 / countall, 4) * 100,
2
) AS Rate_499,
round(
round(status_500 * 1.0000 / countall, 4) * 100,
2
) AS Rate_500,
round(
round(status_502 * 1.0000 / countall, 4) * 100,
2
) AS Rate_502,
round(
round(status_503 * 1.0000 / countall, 4) * 100,
2
) AS Rate_503,
round(
round(status_504 * 1.0000 / countall, 4) * 100,
2
) AS Rate_504,
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM (
SELECT
user_id,
host,
count_if(status = 200) AS status_200,
count_if(status = 302) AS status_302,
count_if(status = 404) AS status_404,
count_if(status = 405) AS status_405,
count_if(status = 444) AS status_444,
count_if(status = 499) AS status_499,
count_if(status = 500) AS status_500,
count_if(status = 502) AS status_502,
count_if(status = 503) AS status_503,
count_if(status = 504) AS status_504,
COUNT(*) AS countall
FROM log
GROUP BY
user_id,
host
)
)
WHERE
countall > 120
ORDER BY
Rate_504 DESC
LIMIT
5Surveillance de la protection WAF
Les requêtes suivantes filtrent sur des champs spécifiques à WAF (final_plugin et waf_action) afin d'identifier les requêtes sur lesquelles WAF a intervenu. Utilisez-les pour surveiller le volume et le taux du trafic bloqué par nom de domaine.
status:302 or 200 and final_plugin:'cc'
La validation JavaScript CAPTCHA est déclenchée.
* |
SELECT
user_id,
host AS "Domain name",
Rate_200 AS "Percentage of 200 status code",
Rate_302 AS "Percentage of 302 status code",
Rate_404 AS "Percentage of 404 status code",
Rate_405 AS "Percentage of 405 status code",
Rate_444 AS "Percentage of 444 status code",
Rate_499 AS "Percentage of 499 status code",
Rate_500 AS "Percentage of 500 status code",
Rate_502 AS "Percentage of 502 status code",
Rate_503 AS "Percentage of 503 status code",
Rate_504 AS "Percentage of 504 status code",
countall / 60 AS "aveQPS",
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM (
SELECT
user_id,
host,
round(
round(status_200 * 1.0000 / countall, 4) * 100,
2
) AS Rate_200,
round(
round(status_302 * 1.0000 / countall, 4) * 100,
2
) AS Rate_302,
round(
round (status_404 * 1.0000 / countall, 4) * 100,
2
) AS Rate_404,
round(
round (status_405 * 1.0000 / countall, 4) * 100,
2
) AS Rate_405,
round(
round (status_444 * 1.0000 / countall, 4) * 100,
2
) AS Rate_444,
round(
round (status_499 * 1.0000 / countall, 4) * 100,
2
) AS Rate_499,
round(
round(status_500 * 1.0000 / countall, 4) * 100,
2
) AS Rate_500,
round(
round(status_502 * 1.0000 / countall, 4) * 100,
2
) AS Rate_502,
round(
round(status_503 * 1.0000 / countall, 4) * 100,
2
) AS Rate_503,
round(
round(status_504 * 1.0000 / countall, 4) * 100,
2
) AS Rate_504,
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM (
SELECT
user_id,
host,
count_if(
status = 200
AND final_plugin = 'cc'
) AS status_200,
count_if(
status = 302
AND final_plugin = 'cc'
) AS status_302,
count_if(status = 404) AS status_404,
count_if(status = 405) AS status_405,
count_if(status = 444) AS status_444,
count_if(status = 499) AS status_499,
count_if(status = 500) AS status_500,
count_if(status = 502) AS status_502,
count_if(status = 503) AS status_503,
count_if(status = 504) AS status_504,
COUNT(*) AS countall
FROM log
GROUP BY
user_id,
host
)
)
WHERE
countall > 120
ORDER BY
Rate_200 DESC
LIMIT
5status:200 and final_plugin:'antifraud'
La requête est bloquée par les règles de contrôle des risques liés aux données.
* |
SELECT
user_id,
host AS "Domain name",
Rate_200 AS "Percentage of 200 status code",
Rate_302 AS "Percentage of 302 status code",
Rate_404 AS "Percentage of 404 status code",
Rate_405 AS "Percentage of 405 status code",
Rate_444 AS "Percentage of 444 status code",
Rate_499 AS "Percentage of 499 status code",
Rate_500 AS "Percentage of 500 status code",
Rate_502 AS "Percentage of 502 status code",
Rate_503 AS "Percentage of 503 status code",
Rate_504 AS "Percentage of 504 status code",
countall / 60 AS "aveQPS",
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM (
SELECT
user_id,
host,
round(
round(status_200 * 1.0000 / countall, 4) * 100,
2
) AS Rate_200,
round(
round(status_302 * 1.0000 / countall, 4) * 100,
2
) AS Rate_302,
round(
round (status_404 * 1.0000 / countall, 4) * 100,
2
) AS Rate_404,
round(
round (status_405 * 1.0000 / countall, 4) * 100,
2
) AS Rate_405,
round(
round (status_444 * 1.0000 / countall, 4) * 100,
2
) AS Rate_444,
round(
round (status_499 * 1.0000 / countall, 4) * 100,
2
) AS Rate_499,
round(
round(status_500 * 1.0000 / countall, 4) * 100,
2
) AS Rate_500,
round(
round(status_502 * 1.0000 / countall, 4) * 100,
2
) AS Rate_502,
round(
round(status_503 * 1.0000 / countall, 4) * 100,
2
) AS Rate_503,
round(
round(status_504 * 1.0000 / countall, 4) * 100,
2
) AS Rate_504,
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM (
SELECT
user_id,
host,
count_if(
status = 200
AND final_plugin = 'antifraud'
) AS status_200,
count_if(status = 302) AS status_302,
count_if(status = 404) AS status_404,
count_if(status = 405) AS status_405,
count_if(status = 444) AS status_444,
count_if(status = 499) AS status_499,
count_if(status = 500) AS status_500,
count_if(status = 502) AS status_502,
count_if(status = 503) AS status_503,
count_if(status = 504) AS status_504,
COUNT(*) AS countall
FROM log
GROUP BY
user_id,
host
)
)
WHERE
countall > 120
ORDER BY
Rate_200 DESC
LIMIT
5status:405 and waf_action:'block'
La requête est bloquée par le moteur de règles de protection.
Cette requête compte les réponses avec le statut 405 où waf_action = 'block', ce qui indique que le moteur de règles de protection a explicitement bloqué la requête.
* |
SELECT
user_id,
host AS "Domain name",
Rate_200 AS "Percentage of 200 status code",
Rate_302 AS "Percentage of 302 status code",
Rate_404 AS "Percentage of 404 status code",
Rate_405 AS "Percentage of 405 status code",
Rate_444 AS "Percentage of 444 status code",
Rate_499 AS "Percentage of 499 status code",
Rate_500 AS "Percentage of 500 status code",
Rate_502 AS "Percentage of 502 status code",
Rate_503 AS "Percentage of 503 status code",
Rate_504 AS "Percentage of 504 status code",
countall / 60 AS "aveQPS",
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM(
SELECT
user_id,
host,
round(
round(status_200 * 1.0000 / countall, 4) * 100,
2
) AS Rate_200,
round(
round(status_302 * 1.0000 / countall, 4) * 100,
2
) AS Rate_302,
round(
round (status_404 * 1.0000 / countall, 4) * 100,
2
) AS Rate_404,
round(
round (status_405 * 1.0000 / countall, 4) * 100,
2
) AS Rate_405,
round(
round (status_444 * 1.0000 / countall, 4) * 100,
2
) AS Rate_444,
round(
round (status_499 * 1.0000 / countall, 4) * 100,
2
) AS Rate_499,
round(
round(status_500 * 1.0000 / countall, 4) * 100,
2
) AS Rate_500,
round(
round(status_502 * 1.0000 / countall, 4) * 100,
2
) AS Rate_502,
round(
round(status_503 * 1.0000 / countall, 4) * 100,
2
) AS Rate_503,
round(
round(status_504 * 1.0000 / countall, 4) * 100,
2
) AS Rate_504,
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM (
SELECT
user_id,
host,
count_if(status = 200) AS status_200,
count_if(status = 302) AS status_302,
count_if(status = 404) AS status_404,
count_if(
status = 405
AND waf_action = 'block'
) AS status_405,
count_if(status = 444) AS status_444,
count_if(status = 499) AS status_499,
count_if(status = 500) AS status_500,
count_if(status = 502) AS status_502,
count_if(status = 503) AS status_503,
count_if(status = 504) AS status_504,
COUNT(*) AS countall
FROM log
GROUP BY
user_id,
host
)
)
WHERE
countall > 120
ORDER BY
Rate_405 DESC
LIMIT
5status:405 and final_plugin:'acl'
La requête est bloquée par la liste de blocage ou des règles de contrôle d'accès personnalisées.
Cette requête compte les réponses avec le statut 405 où final_plugin = 'acl', ce qui indique qu'une règle de liste de contrôle d'accès (ACL), telle qu'une liste de blocage ou une règle de contrôle d'accès personnalisée, a bloqué la requête.
* |
SELECT
user_id,
host AS "Domain name",
Rate_200 AS "Percentage of 200 status code",
Rate_302 AS "Percentage of 302 status code",
Rate_404 AS "Percentage of 404 status code",
Rate_405 AS "Percentage of 405 status code",
Rate_444 AS "Percentage of 444 status code",
Rate_499 AS "Percentage of 499 status code",
Rate_500 AS "Percentage of 500 status code",
Rate_502 AS "Percentage of 502 status code",
Rate_503 AS "Percentage of 503 status code",
Rate_504 AS "Percentage of 504 status code",
countall / 60 AS "aveQPS",
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM(
SELECT
user_id,
host,
round(
round(status_200 * 1.0000 / countall, 4) * 100,
2
) AS Rate_200,
round(
round(status_302 * 1.0000 / countall, 4) * 100,
2
) AS Rate_302,
round(
round (status_404 * 1.0000 / countall, 4) * 100,
2
) AS Rate_404,
round(
round (status_405 * 1.0000 / countall, 4) * 100,
2
) AS Rate_405,
round(
round (status_444 * 1.0000 / countall, 4) * 100,
2
) AS Rate_444,
round(
round (status_499 * 1.0000 / countall, 4) * 100,
2
) AS Rate_499,
round(
round(status_500 * 1.0000 / countall, 4) * 100,
2
) AS Rate_500,
round(
round(status_502 * 1.0000 / countall, 4) * 100,
2
) AS Rate_502,
round(
round(status_503 * 1.0000 / countall, 4) * 100,
2
) AS Rate_503,
round(
round(status_504 * 1.0000 / countall, 4) * 100,
2
) AS Rate_504,
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM (
SELECT
user_id,
host,
count_if(status = 200) AS status_200,
count_if(status = 302) AS status_302,
count_if(status = 404) AS status_404,
count_if(
status = 405
AND final_plugin = 'acl'
) AS status_405,
count_if(status = 444) AS status_444,
count_if(status = 499) AS status_499,
count_if(status = 500) AS status_500,
count_if(status = 502) AS status_502,
count_if(status = 503) AS status_503,
count_if(status = 504) AS status_504,
COUNT(*) AS countall
FROM log
GROUP BY
user_id,
host
)
)
WHERE
countall > 120
ORDER BY
Rate_405 DESC
LIMIT
5status:444
La requête est bloquée par les règles de protection contre les attaques HTTP flood.
* |
SELECT
user_id,
host AS "Domain name",
Rate_200 AS "Percentage of 200 status code",
Rate_302 AS "Percentage of 302 status code",
Rate_404 AS "Percentage of 404 status code",
Rate_405 AS "Percentage of 405 status code",
Rate_444 AS "Percentage of 444 status code",
Rate_499 AS "Percentage of 499 status code",
Rate_500 AS "Percentage of 500 status code",
Rate_502 AS "Percentage of 502 status code",
Rate_503 AS "Percentage of 503 status code",
Rate_504 AS "Percentage of 504 status code",
countall / 60 AS "aveQPS",
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM(
SELECT
user_id,
host,
round(
round(status_200 * 1.0000 / countall, 4) * 100,
2
) AS Rate_200,
round(
round(status_302 * 1.0000 / countall, 4) * 100,
2
) AS Rate_302,
round(
round (status_404 * 1.0000 / countall, 4) * 100,
2
) AS Rate_404,
round(
round (status_405 * 1.0000 / countall, 4) * 100,
2
) AS Rate_405,
round(
round (status_444 * 1.0000 / countall, 4) * 100,
2
) AS Rate_444,
round(
round (status_499 * 1.0000 / countall, 4) * 100,
2
) AS Rate_499,
round(
round(status_500 * 1.0000 / countall, 4) * 100,
2
) AS Rate_500,
round(
round(status_502 * 1.0000 / countall, 4) * 100,
2
) AS Rate_502,
round(
round(status_503 * 1.0000 / countall, 4) * 100,
2
) AS Rate_503,
round(
round(status_504 * 1.0000 / countall, 4) * 100,
2
) AS Rate_504,
status_200,
status_302,
status_404,
status_405,
status_444,
status_499,
status_500,
status_502,
status_503,
status_504,
countall
FROM (
SELECT
user_id,
host,
count_if(status = 200) AS status_200,
count_if(status = 302) AS status_302,
count_if(status = 404) AS status_404,
count_if(status = 405) AS status_405,
count_if(status = 444) AS status_444,
count_if(status = 499) AS status_499,
count_if(status = 500) AS status_500,
count_if(status = 502) AS status_502,
count_if(status = 503) AS status_503,
count_if(status = 504) AS status_504,
COUNT(*) AS countall
FROM log
GROUP BY
user_id,
host
)
)
WHERE
countall > 120
ORDER BY
Rate_444 DESC
LIMIT
5Étapes suivantes
Métriques de surveillance courantes — descriptions de toutes les métriques disponibles dans Log Service pour WAF