Analyzing Huawei Cloud ELB Logs on LTS

Solution Overview

When distributing external traffic, ELB logs details of HTTP and HTTPS requests, such as URIs, client IP addresses and ports, and status codes.

You can use ELB access logs for auditing or search for logs by time and keyword. You can also obtain external access statistics by running SQL aggregation queries. For example, you can check the number of requests with 404 responses within a certain day, or analyze the unique visitors (UVs) or page views (PVs) within a week.

Planning Resources

You have purchased and used a Huawei Cloud load balancer.

Restrictions

ELB access logs only record layer 7 requests sent to the dedicated and shared load balancers. Layer 4 shared load balancing is not logged.

Analyzing Huawei Cloud ELB Logs on LTS

1. Ingest ELB access logs to LTS. For details, see Access Logging.
2. Click in the upper left corner and choose Management & Governance > Log Tank Service.
3. On the Log Management page, click a log stream name. On the log stream details page displayed, click in the upper right corner. Go to the Cloud Structuring Parsing tab page, retain the default setting (enabled) of Auto Configuration and Analysis, click Structuring Template, select the ELB system template, and click Save. For details about quick analysis, see Quick analysis.
   Figure 1 Selecting the ELB structuring template
   

4. On the log stream details page, click the Log Analysis tab and run SQL queries and analysis. For details about how to visualize query results, see Setting Cloud Structuring Parsing.
   • To count the PVs within a week, run the following SQL statement:

     select count(*) as pv

   • To count the UVs within a week, run the following SQL statement:

     select count(distinct remote_port) as uv

   • Statistics on 2xx/3xx/4xx/5xx (return codes) returned by all URIs in one day are collected to show the service execution result. The SQL query and analysis statements are as follows:

     select host, router_request_uri as url, count(*) as pv, 
     sum(case when status >= 200 and status < 300 then 1 else 0 end )  as "2xx times", 
     sum(case when status >= 300 and status < 400 then 1 else 0 end )  as "3xx times", 
     sum(case when status >= 400 and status < 500 then 1 else 0 end )  as "4xx times", 
     sum(case when status >= 500 and status < 600 then 1 else 0 end )  as "5xx times" 
     group by host, router_request_uri
     order by pv desc 
     limit 100

     The query results can be displayed in a table, or bar, line, pie, or number chart. For details, see Statistical Charts.