Help Center/ Cloud Firewall/ User Guide/ Log Audit/ Log Management/ Configuring Logs
Updated on 2025-10-13 GMT+08:00
View PDF

Configuring Logs

You can record attack event logs, access control logs, and traffic logs to LTS and use these logs to quickly and efficiently perform real-time decision analysis, device O&M, and service trend analysis.

LTS analyzes and processes a large number of logs. It enables you to process logs in real-time, efficiently, and securely.

  • On the Log Query page, you can check and export log data of the last seven days. For details, see Querying Logs.
  • LTS is billed by traffic and is billed separately from CFW. For details about LTS pricing, see LTS Pricing.

Configuring Logs

  1. Log in to the CFW console.
  2. Click in the upper left corner of the management console and select a region or project.
  3. (Optional) Switch to another firewall instance. Select a firewall from the drop-down list in the upper left corner of the page.
  4. In the navigation pane on the left, choose Log Audit > Log Management. Click Configure LTS Synchronization. Toggle on to enable the cloud log interconnection service.
  5. Create log groups and log streams.

    For details, see Creating Log Groups and Log Streams.

    To make it easier for you to view, you are advised to:

    • Add -cfw as the suffix when creating a log group.
    • When creating log streams, add the suffixes -attack, -access, and -flow to attack event logs, access control logs, and traffic logs.

  6. Select a created log group or log stream.

    Select a log group, enable log recording, and select a log stream.
    • The formats of attack logs, access logs, and traffic logs are different. You need to configure different log streams for them.
      • Attack logs: record attack alarm information, including the attack event type, protection rule, protection action, quintuple, and attack payload.
      • Access logs: record information about the traffic that matches the ACL policy, including the matching time, quintuple, response action, and the matched access control rule.
      • Traffic logs: record information about all traffic passing through the CFW, including the start time, end time, quintuple, number of bytes, and number of packets.

  7. Click OK.

    After the configuration is complete, if a message indicating insufficient permissions is displayed, grant the LTS FullAccess permission.

Parent Topic: Log Management