Access Logging

Scenarios

ELB logs HTTP, HTTPS, and TLS requests received by load balancers, including the time when the request was sent, client IP address, request path, and server response.

With Log Tank Service (LTS), you can view logs of requests to load balancers at Layer 7 and analyze response status codes to quickly locate unhealthy backend servers.

ELB displays operations data, such as access logs, on the LTS console. Do not transmit private or sensitive data through fields in access logs. Encrypt your sensitive data if necessary.

Notes and Constraints

• Access logging can be configured only for load balancers that have HTTP, HTTPS, or TLS listeners.
• The access logs do not contain requests whose return code is 400 Bad Request. This is because such requests do not comply with HTTP specification and cannot be processed properly.

Prerequisites

• You have created a load balancer that supports HTTP, HTTPS, or TLS. For details, see Creating a Dedicated Load Balancer.
• You have enabled LTS. For details, see Accessing LTS.
• You have created a backend server group, added backend servers to the group, and deployed services on the backend servers. For details, see Creating a Backend Server Group.

• You have added an HTTP, HTTPS, or TLS listener to the load balancer.

Flowchart

Figure 1 Process for locating an unhealthy backend server

Creating a Log Group

1. Log in to the management console.
2. In the upper left corner of the page, click and select the desired region and project.
3. Click in the upper left corner and choose Management & Governance > Log Tank Service.
4. In the navigation pane on the left, choose Log Management.
5. On the lower part of the displayed page, click Create Log Group. In the displayed dialog box, enter a name for the log group.
   Figure 2 Creating a log group
   
6. Confirm the settings and click OK.

Creating a Log Stream

1. On the LTS console, click on the left of the target log group.
2. Click Create Log Stream. In the displayed dialog box, enter a name for the log stream.
   Figure 3 Creating a log stream
   
3. Confirm the settings and click OK.

Configuring Access Logging

1. Click in the upper left corner to display Service List and choose Networking > Elastic Load Balance.
2. On the Load Balancers page, locate the load balancer and click its name.
3. Under Access Logs, click Configure Access Logging.
4. Enable access logging and select the log group and log stream you have created.
   Figure 4 Configuring access logging
   
5. Click OK.

Ensure that the log group is in the same region as the load balancer.

Viewing Access Logs

You can view details about access logs on the:

• ELB console: Click the name of the load balancer and click Access Logs to view logs.
• (Recommended) LTS console: Locate the target log group and click its name. On the displayed page, locate the target log stream and click Real-Time Logs tab.

The log format is as follows, which cannot be modified:

$msec $access_log_topic_id [$time_iso8601] $log_ver $remote_addr:$remote_port $status "$request_method $scheme://$host$router_request_uri $server_protocol" $request_length $bytes_sent $body_bytes_sent $request_time "$upstream_status" "$upstream_connect_time" "$upstream_header_time" "$upstream_response_time" "$upstream_addr" "$http_user_agent" "$http_referer" "$http_x_forwarded_for" $lb_name $listener_name $listener_id
$pool_name "$member_name" $tenant_id $eip_address:$eip_port "$upstream_addr_priv" $certificate_id $ssl_protocol $ssl_cipher $sni_domain_name $tcpinfo_rtt $self_defined_header

The following is a log example:

1644819836.370 eb11c5a9-93a7-4c48-80fc-03f61f638595 [2024-02-14T14:23:56+08:00] elb_01 192.168.1.1:888 200 "POST https://www.test.com/example/ HTTP/1.1" 1411 251 3 0.011 "200" "0.000" "0.011" "0.011" "192.168.1.2:8080" "okhttp/3.13.1" "-" "-" loadbalancer_295a7eee-9999-46ed-9fad-32a62ff0a687 listener_20679192-8888-4e62-a814-a2f870f62148 3333fd44fe3b42cbaa1dc2c641994d90 pool_89547549-6666-446e-9dbc-e3a551034c46 "-" f2bc165ad9b4483a9b17762da851bbbb 121.64.212.1:443 "10.1.1.2:8080" - TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 www.test.com 56704 -

Table 1 describes the fields in the log.

Log analysis

At 14:23:56 GMT+08:00 on Feb 14, 2024, the load balancer receives an HTTP/1.1 POST request from a client whose IP address and port number are 192.168.1.1 and 888, then routes the request to a backend server whose IP address and port number are 100.64.0.129 and 8080, and finally returns 200 OK to the client after receiving the status code from the backend server.

Analysis results

The backend server responds to the request normally.

Locating an Unhealthy Backend Server

The following is a log that records an exception:

1554944564.344 - [2024-04-11T09:02:44+08:00] elb 10.133.251.171:51527 500 "GET http://10.154.73.58/lrange/guestbook HTTP/1.1" 411 3726 3545 19.028 "500" "0.009" "19.028" "19.028" "172.17.0.82:3000" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.103 Safari/537.36" "http://10.154.73.58:5971/" "-" loadbalancer_ed0f790b-e194-4657-9f97-53426227099e listener_b21dd0a9-690a-4945-950e-b134095c6bd9 6b6aaf84d72b40fcb2d2b9b28f6a0b83

Log analysis

At 09:02:44 GMT+08:00 of April 11, 2024, the load balancer received a GET/HTTP/1.1 request from the client whose IP address and port number are 10.133.251.171 and 51527 respectively and then routed the request to a backend server that uses 172.17.0.82 and port 3000 to receive requests. The load balancer then received 500 Internal Server Error from the backend server and returned the status code to the client.

Analysis results

The backend server was unhealthy and failed to respond to the request.

172.17.0.82:3000 is the private IP address of the backend server.

Configuring Log Transfer

If you want to analyze access logs later, transfer the logs to OBS or Data Ingestion Service (DIS) for storage.

1. Log in to the management console.
2. In the upper left corner of the page, click and select the desired region and project.
3. Click in the upper left corner and Management & Governance > Log Tank Service.
4. In the navigation pane on the left, choose Log Transfer.
5. On the Log Transfer page, click Configure Log Transfer in the upper right corner.
   Figure 5 Configuring log transfer
   
6. Configure the parameters. For details, see the Log Tank Service User Guide.