Configuring Logs

Updated on 2024-11-04 GMT+08:00

View PDF

You can record attack event logs, access control logs, and traffic logs to Log Tank Service (LTS) and use these logs to quickly and efficiently perform real-time decision analysis, device O&M, and service trend analysis.

LTS analyzes and processes a large number of logs. It enables you to process logs in real-time, efficiently, and securely.

NOTICE:

On the Log Query page, you can check and export log data of the last seven days. For details, see Querying Logs.
LTS is billed by traffic and is billed separately from WAF. For details about LTS pricing, see LTS Pricing.

Configuring Logs

Log in to the management console.
Click in the upper left corner of the management console and select a region or project.
In the navigation pane on the left, click and choose Security & Compliance > Cloud Firewall. The Dashboard page will be displayed.
(Optional) If the current account has only one firewall instance, the firewall details page is displayed. If there are multiple firewall instances, click View in the Operation column of a firewall to go to its details page.
In the navigation pane on the left, choose Log Audit > Log Management. The Log Management page is displayed. Toggle on to enable the cloud log interconnection service.
Create log groups and log streams. For details, see Creating Log Groups and Log Streams.
NOTE:
To make it easier for you to view, you are advised to:
- Add -cfw as the suffix when creating a log group.
- When creating log streams, add the suffixes -attack, -access, and -flow to attack event logs, access control logs, and traffic logs.
Select a created log group or log stream. Click OK.
NOTE:
- The formats of attack logs, access logs, and traffic logs are different. You need to configure different log streams for them.
- Attack logs: record attack alarm information, including the attack event type, protection rule, protection action, quintuple, and attack payload.
  Access logs: record information about the traffic that matches the ACL policy, including the matching time, quintuple, response action, and the matched access control rule.
  
  Traffic logs: record information about all traffic passing through the CFW, including the start time, end time, quintuple, number of bytes, and number of packets.

Parent Topic: Log Management

Previous topic: Log Management

Next topic: Changing the Log Storage Duration

Feedback

Was this page helpful?

Helpful Not helpful

Provide feedback

Thank you very much for your feedback. We will continue working to improve the documentation.

The system is busy. Please try again later.

Which of the following issues have you encountered?

Content is inconsistent with the product UI

Unclear descriptions

Lack of examples or code

Incorrect steps

Can't find what I need

Lack of best practices

Feedback (optional)

0/500

Select at least one type of issue, and enter your comments or suggestions.

Enter a maximum of 500 characters.

Submit Cancel