Configuring a Response Body Length in Logs

If WAF blocks or only logs an attack, the response details are displayed in the event list. If this function is not enabled and the length of the response body in logs is not configured, the response details are empty. If you enable the response details function and configure a specific length for the response body in logs, the response details will record the response body information up to the configured length. You can configure the response body length based on site requirements to make sure response bodies are recorded in event logs.

WAF logs response bodies by domain name. The default response body length is 2,048 bytes. You can configure a value ranging from 1 to 8,192 bytes.

This function is under open beta test (OBT). You can submit a service ticket to enable it.

Prerequisites

You have added your website to WAF.

Configuring a Response Body Length in Logs

Log in to the WAF console.
Click in the upper left corner and select a region or project.
(Optional) If you have enabled the enterprise project function, in the upper part of the navigation pane on the left, select your enterprise project from the Filter by enterprise project drop-down list. Then, WAF will display the related security data in the enterprise project on the page.
In the navigation pane on the left, click Website Settings.
On the Website Settings page, click the target website domain name.
In the Advanced Settings area, click next to Body Length in Logs (Bytes), set a response body length (ranging from 1 to 8,192 bytes), and click OK.

Figure 1 Configuring a response body length in logs

After the configuration is complete, WAF displays response body details based on the configured response body length on the details page for new event logs.

To view response body details, choose Events in the navigation pane on the left. In the event list, locate the target event and click Details in the Operation column, and click the Response Details tab.