Help Center/ Cloud Firewall/ User Guide/ Viewing CFW Protection Logs/ Log Management/ Configuring Logs
Updated on 2024-11-04 GMT+08:00
View PDF

Configuring Logs

You can record attack event logs, access control logs, and traffic logs to Log Tank Service (LTS) and use these logs to quickly and efficiently perform real-time decision analysis, device O&M, and service trend analysis.

LTS analyzes and processes a large number of logs. It enables you to process logs in real-time, efficiently, and securely.

  • On the Log Query page, you can check and export log data of the last seven days. For details, see Querying Logs.
  • LTS is billed by traffic and is billed separately from WAF. For details about LTS pricing, see LTS Pricing.

Configuring Logs

  1. Log in to the management console.
  2. Click in the upper left corner of the management console and select a region or project.
  3. In the navigation pane on the left, click and choose Security & Compliance > Cloud Firewall. The Dashboard page will be displayed.
  4. (Optional) If the current account has only one firewall instance, the firewall details page is displayed. If there are multiple firewall instances, click View in the Operation column of a firewall to go to its details page.
  5. In the navigation pane on the left, choose Log Audit > Log Management. The Log Management page is displayed. Toggle on to enable the cloud log interconnection service.
  6. Create log groups and log streams. For details, see Creating Log Groups and Log Streams.

    To make it easier for you to view, you are advised to:

    • Add -cfw as the suffix when creating a log group.
    • When creating log streams, add the suffixes -attack, -access, and -flow to attack event logs, access control logs, and traffic logs.

  7. Select a created log group or log stream. Click OK.

    • The formats of attack logs, access logs, and traffic logs are different. You need to configure different log streams for them.
    • Attack logs: record attack alarm information, including the attack event type, protection rule, protection action, quintuple, and attack payload.

      Access logs: record information about the traffic that matches the ACL policy, including the matching time, quintuple, response action, and the matched access control rule.

      Traffic logs: record information about all traffic passing through the CFW, including the start time, end time, quintuple, number of bytes, and number of packets.

Parent Topic: Log Management