Edge Security Acceleration:Configure real-time log delivery

Limitations

• For the same domain name and log type, you can select only one SLS delivery region for each collection region. For example, if the collection region is Chinese Mainland, the EdgeRoutine logs for example.com cannot be delivered to both China (Hangzhou) and China (Beijing). You can associate the domain name with only one delivery project for that collection region.

Note

However, you can deliver access logs for example.com to China (Hangzhou) and EdgeRoutine logs to China (Beijing) because they are different log types.

• A specific log type can have only one delivery project per SLS delivery region. For example, if delivery project A delivers EdgeRoutine logs for example.com to China (Hangzhou), you cannot create delivery project B to deliver EdgeRoutine logs for aliyundoc.com to the same region. This is because a delivery project for EdgeRoutine logs already exists in China (Hangzhou).

  To resolve this, add the EdgeRoutine log delivery for aliyundoc.com to Project A.

• All delivery projects for the same log type share the same field settings. A field modification in one project applies to all other projects of the same type. For example, if the domain field is selected by default for an access log and you clear it in one delivery project, the field is also removed from all other delivery projects for access logs.

Activate real-time log delivery

Log on to the DCDN console. In the left-side navigation pane, choose Logs > Real-time Logs, and follow the on-screen instructions to activate the service.

Activating this service creates two billable items: real-time log collection and Simple Log Service (SLS). If you have not yet activated SLS, first click Go to Activate, and then click Activate Now.

Enable real-time log delivery

1. Log on to the DCDN console.

2. In the left-side navigation pane, click Logs > Real-time Logs.

3. Click Create Delivery Project.

4. Create a real-time log delivery project.

   1. In the Create Real-time Log Delivery Project dialog box, configure the following settings:

      Parameter	Description
      Project Name	A unique name for the delivery project. The name can be up to 24 characters long and can contain letters, digits, and underscores (_).
      Log Type	The type of logs to deliver. The following types are supported: Access Log WAF Interception Log EdgeRoutine Log
      Log Field	The fields included in the real-time logs. For field names and descriptions, see Real-time log collection fields.
      Sampling Rate	The percentage of real-time log delivery requests received. Valid values: 20%, 40%, 60%, 80%, and 100%. Note The number of delivered log entries is approximately the total number of log entries multiplied by the sampling rate. To receive all log delivery requests, set the sampling rate to 100%.

   2. Click Next. Select a collection region and an SLS delivery region.

      Important

      • After you create a delivery project, you cannot change the collection region or SLS delivery region. To modify them, you must delete the project and create a new one. For more information, see Disable real-time log delivery.

      • The first time you create a project, you must authorize DCDN to access SLS to ensure successful log delivery.

      After you grant the authorization, the AliyunServiceRoleForDCDNRealTimeLogDelivery service-linked role is displayed, confirming that DCDN can access SLS.

      Collected logs can be delivered only to specific SLS regions for storage. The following table shows the mapping between collection regions and their corresponding delivery regions.

      DCDN collection region	SLS delivery region
      Chinese Mainland	China (Hangzhou) China (Shanghai) China (Qingdao) China (Beijing) China (Zhangjiakou) China (Shenzhen)
      Outside Chinese Mainland	Singapore, US (Silicon Valley), Germany (Frankfurt)

      Traffic from all regions outside the Chinese mainland, including Europe, the US, and other regions, is collected and delivered through the Outside Chinese Mainland option. When you select Outside Chinese Mainland as the collection region, select the SLS delivery region from the available options: Singapore, US (Silicon Valley), or Germany (Frankfurt).

   3. Click Next and select the domain names for log delivery.

      From the Available Domains list, select the target domain names and move them to the Selected Domain list. You can add up to 100 domain names at once. If you need to add more than 10, we recommend doing so in batches.

5. Click Next to complete the project creation.

   After the delivery project is created, real-time log delivery takes effect immediately. The system automatically collects logs for the specified domain names in the selected region and delivers them to SLS.

Disable real-time log delivery

You can disable real-time log delivery by removing specific domain names from a delivery project, or by deleting the project entirely.