Access Logging

Scenarios

DNS logs the requests sent to resolvers, such as the time when a request was sent, client IP address, request path, and server response.

Constraints

LTS is a region-level service. DNS access logging can only be enabled in CN Southwest-Guiyang1 and CN-Hong Kong.

To enable access logging, you need to interconnect DNS with LTS and create a log group and a log stream on the LTS console. For details, see the Log Tank Service User Guide.

Configuring LTS

1. Create a log group.
   1. Log in to the management console.
   2. Click on the upper left to select the desired region and project.
   3. In the upper left corner of the page, click and choose Management & Governance > Log Tank Service.
   4. In the navigation pane on the left, choose Log Management.
   5. Click Create Log Group. In the displayed dialog box, enter a name for the log group.

      Set Log Retention Duration as needed.

   6. Confirm the settings and click OK.

2. Create a log stream.
   1. On the LTS console, click on the left of the target log group.
   2. Click Create Log Stream. In the displayed dialog box, enter a name for the log stream.
   3. Select an enterprise project as needed.
   4. Confirm the settings and click OK.

Configuring Access Logging

1. Go to the Resolvers page.
2. Click on the upper left and select the desired region and project.
3. Click the Access Logs tab.
4. Click Configure Access Logging.

5. Configure the parameters, such as Log Group, Log Stream, and VPC, as prompted.
6. Click OK.

Viewing Access Logs

1. Go to the Resolvers page.
2. Click on the upper left and select the desired region and project.
3. Click the Access Logs tab.
4. In the access log list, locate the target access log and click View Log Details.

   On the displayed page, view the information about the log group and log stream.

5. Click the name of the log stream and view its details.

   The following is an example log. For details about the fields in the log, see Table 1. The log format cannot be modified.

   {
       "content": "2024-07-02 09:28:00.304 baidu.com. A NOERROR TCP cnsouthwest2d _ 192.168.0.138 c1e159ce-ac25-4908-8e31-8ff73ad2f57d",
       "_resource_id": "c1e159ce-ac25-4908-8e31-8ff73ad2f57d",
       "_resource_name": "c1e159ce-ac25-4908-8e31-8ff73ad2f57d",
       "_service_type": "DNS",
       "category": "LTS",
       "collectTime": 1719883683977
   }

   Table 1 Fields in a DNS resolver access log

   Field	Description	Value Description	Example Value
   content	DNS resolver access logs	String	2024-07-02 09:28:00.304 baidu.com. A NOERROR TCP cnsouthwest2d _ 192.168.0.138 c1e159ce-ac25-4908-8e31-8ff73ad2f57d
   _resource_id	Resource ID	UUID	95c2b814-99dc-939a-e811-ae84c61ea9ee
   _resource_name	Resource name	Name of the resource specified by the resource ID	95c2b814-99dc-939a-e811-ae84c61ea9ee
   _service_type	Service for which access logs are collected	Fixed value: DNS	DNS
   category	Log category	Fixed value: LTS	LTS
   collectTime	LTS log collection time	Integer	1704158708902

Configuring Log Transfer

If you want to analyze access logs later, transfer the logs to OBS for storage.

1. Log in to the management console.
2. Click on the upper left to select the desired region and project.
3. In the upper left corner of the page, click and choose Management & Governance >Log Tank Service.

4. In the navigation pane on the left, choose Log Transfer.
5. In the upper right corner of the Log Transfer page, click Configure Log Transfer.
   Figure 1 Configuring log transfer
   

6. Configure the parameters. For details, see the Log Tank Service User Guide.