Access Logging

Scenarios

The requests sent to DNS Resolver are logged in detail, such as the time when a request was sent, client IP address, request path, and server response.

Constraints

• LTS is a region-level service. Currently, you can enable and configure access logging for DNS in the following regions as needed: CN East-2, CN Southwest-Guiyang1, AP-Jakarta, AP-Singapore, AP-Manila, AF-Johannesburg, ME-Riyadh, LA-Santiago, TR-Istanbul, CN-Hong Kong, AP-Bangkok, AF-Cairo, LA-Sao Paulo1, and LA-Mexico City2.
• A private zone with recursive resolution proxy for subdomains, DNS Resolver, weight, or access logging enabled cannot be associated with a VPC that contains CloudDCN or CloudPond subnets. Otherwise, resolution will fail.
• To enable access logging, you need to interconnect DNS with LTS and create a log group and a log stream on the LTS console. For details, see the Log Tank Service User Guide.

Configuring LTS

1. Create a log group.
   1. Go to the Log Management page.
   2. Click in the upper left corner and select the desired region and project.
   3. Click Create Log Group. In the displayed dialog box, enter a name for the log group.

      Set Log Retention Duration as needed.

   4. Confirm the settings and click OK.

2. Create a log stream.
   1. On the LTS console, click on the left of the target log group.
   2. Click Create Log Stream. In the displayed dialog box, enter a name for the log stream.
   3. Select an enterprise project as needed.
   4. Confirm the settings and click OK.

Configuring Access Logging for DNS

1. Go to the Resolvers page.
2. Click in the upper left corner and select the desired region and project.
3. Click the Access Logs tab.
4. Click Configure Access Logging.

5. Configure the parameters, such as Log Group, Log Stream, and VPC, as prompted.
6. Click OK.

Viewing Access Logs

1. Go to the Resolvers page.
2. Click in the upper left corner and select the desired region and project.
3. Click the Access Logs tab.
4. In the access log list, locate the target access log and click View Log Details.

   On the displayed page, view the information about the log group and log stream.

5. Click the name of the log stream and view its details.

   The following is an example log. For details about the fields in the log, see Table 1. The log format cannot be modified.

   {
       "content": "2025-11-18 15:48:02.392 spark-api-knowledge.cn-huabei-1.xf-yun.com. A NOERROR UDP cnnorth4g CNAME_hb-kaicp.xf-gtm.com.|A_123.57.86.182|A_8.140.35.16|A_123.56.17.44|A_39.105.54.181|A_101.200.158.58|A_123.57.26.93 192.168.0.141 d3b08f84-12ef-411f-8eae-5c2726f42c14",
       "Answer": "CNAME_hb-kaicp.xf-gtm.com.|A_123.57.86.182|A_8.140.35.16|A_123.56.17.44|A_39.105.54.181|A_101.200.158.58|A_123.57.26.93",
       "Client": "192.168.0.141",
       "DNS-Region": "cnnorth4g",
       "Protocol": "UDP",
       "QueryName": "spark-api-knowledge.cn-huabei-1.xf-yun.com.",
       "QueryType": "A",
       "Rcode": "NOERROR",
       "Time": "2025-11-18 15:48:02.392",
       "VpcId": "d3b08f84-12ef-411f-8eae-5c2726f42c14",
       "_resource_id": "d3b08f84-12ef-411f-8eae-5c2726f42c14",
       "_resource_name": "d3b08f84-12ef-411f-8eae-5c2726f42c14",
       "_service_type": "DNS",
       "category": "LTS",
       "collectTime": 1763452083412
   }

   Table 1 Fields in a DNS Resolver access log

   Parameter	Description	Example Value
   content	DNS Resolver access logs	2025-11-18 15:48:02.392 spark-api-knowledge.cn-huabei-1.xf-yun.com. A NOERROR UDP cnnorth4g CNAME_hb-kaicp.xf-gtm.com.|A_123.57.86.182|A_8.140.35.16|A_123.56.17.44|A_39.105.54.181|A_101.200.158.58|A_123.57.26.93 192.168.0.141 d3b08f84-12ef-411f-8eae-5c2726f42c14
   Answer	Response information	CNAME_hb-kaicp.xf-gtm.com.|A_123.57.86.182|A_8.140.35.16|A_123.56.17.44|A_39.105.54.181|A_101.200.158.58|A_123.57.26.93
   Client	Client	192.168.0.141
   DNS-Region	Region	cnnorth4g
   Protocol	Protocol	UDP
   QueryName	Domain name to be resolved	spark-api-knowledge.cn-huabei-1.xf-yun.com.
   QueryType	Record set type	A
   Rcode	Response code	NOERROR
   Time	Time	2025-11-18 15:48:02.392
   VpcId	VPC ID	d3b08f84-12ef-411f-8eae-5c2726f42c14
   _resource_id	Resource ID	d3b08f84-12ef-411f-8eae-5c2726f42c14
   _resource_name	Resource name	d3b08f84-12ef-411f-8eae-5c2726f42c14
   _service_type	Service for which access logs are collected	DNS
   category	Log category	LTS
   collectTime	LTS log collection time	1763452083412

Configuring Log Transfer

If you want to analyze access logs later, transfer the logs to OBS for storage.

1. Go to the Log Transfer page.
2. Click in the upper left corner and select the desired region and project.

3. In the upper right corner of the Log Transfer page, click Configure Log Transfer.
   Figure 1 Configuring log transfer
   

4. Configure the parameters. For details, see the Log Tank Service User Guide.