Help Center/ Cloud Firewall/ API Reference/ API/ Log Analysis/ Querying Slow Query Log Statistics
Updated on 2025-08-12 GMT+08:00

Querying Slow Query Log Statistics

Function

This API is used to obtain the top N statistics in access logs, such as the rules with the most hits.

Calling Method

For details, see Calling APIs.

URI

GET /v1/{project_id}/cfw/logs/access-top

Table 1 Path Parameters

Parameter

Mandatory

Type

Description

project_id

Yes

String

Definition

Project ID, which is used to specify the project that an asset belongs to. You can query the assets of a project by project ID. You can obtain the project ID from the API or console. For details, see Obtaining a Project ID.

Constraints

N/A

Range

32-bit UUID.

Default Value

N/A

Table 2 Query Parameters

Parameter

Mandatory

Type

Description

fw_instance_id

Yes

String

Definition

Firewall ID. It is a unique ID generated after a firewall instance is created. You can obtain the firewall ID by referring to Obtaining a Firewall ID.

Constraints

N/A

Range

32-bit UUID.

Default Value

N/A

range

No

Integer

Definition

Time range.

Constraints

N/A

Range

0 (last hour), 1 (last day), or 2 (last seven days)

Default Value

N/A

direction

No

String

Definition

Session direction.

Constraints

N/A

Range

in2out (outbound) or out2in (inbound)

Default Value

N/A

start_time

No

Long

Definition

Start time.

Constraints

N/A

Range

Milliseconds-level timestamp.

Default Value

N/A

end_time

No

Long

Definition

End time.

Constraints

N/A

Range

Milliseconds-level timestamp.

Default Value

N/A

vgw_id

No

Array of strings

Definition

VGW ID

Constraints

N/A

Range

32-bit UUID.

Default Value

N/A

log_type

No

String

Definition

Log type.

Constraints

N/A

Range

internet (north-south logs), nat (NAT logs), vpc (east-west logs), or vgw (VGW logs)

Default Value

N/A

item

Yes

String

Definition

Aggregation type.

Constraints

N/A

Range

strategy_hit_info: policy hit trend

strategy_dashboard: policy hit overview

top_deny_rule: blocking rules with the most hits

dst_ip: top blocked destination IP addresses

src_ip: top blocked source IP addresses

dst_port: top blocked ports

dst_region: top blocked destination regions

src_region: top blocked source regions

Default Value

N/A

rule_id

No

Array of strings

Definition

Rule group ID list.

Constraints

N/A

Range

32-bit UUID.

Default Value

N/A

Request Parameters

None

Response Parameters

Status code: 200

Table 3 Response body parameters

Parameter

Type

Description

data

AccessTopVO object

Table 4 AccessTopVO

Parameter

Type

Description

deny_count

Long

Definition

Block count.

Range

N/A

deny_top_one_acl_id

String

Definition

ID of a blocking policy that is frequently hit.

Range

N/A

deny_top_one_acl_name

String

Definition

ID of a blocking policy that is frequently hit.

Range

N/A

hit_count

Long

Definition

Number of hits.

Range

N/A

in2out_deny_dst_ip_list

Array of AccessTopMemberVO objects

Definition

List of top blocked destination IP addresses in the outbound direction.

Range

N/A

in2out_deny_dst_port_list

Array of AccessTopMemberVO objects

Definition

List of top blocked ports in the outbound direction.

Range

N/A

in2out_deny_dst_region_list

Array of AccessTopMemberVO objects

Definition

List of top blocked destination regions in the outbound direction.

Range

N/A

in2out_deny_src_ip_list

Array of AccessTopMemberVO objects

Definition

List of top blocked source IP addresses in the outbound direction.

Range

N/A

out2in_deny_dst_ip_list

Array of AccessTopMemberVO objects

Definition

List of top blocked destination IP addresses in the inbound direction.

Range

N/A

out2in_deny_dst_port_list

Array of AccessTopMemberVO objects

Definition

List of top blocked destination ports in the inbound direction.

Range

N/A

out2in_deny_src_ip_list

Array of AccessTopMemberVO objects

Definition

List of top blocked source IP addresses in the inbound direction.

Range

N/A

out2in_deny_src_port_list

Array of AccessTopMemberVO objects

Definition

List of top blocked source ports in the inbound direction.

Range

N/A

out2in_deny_src_region_list

Array of AccessTopMemberVO objects

Definition

List of top blocked source regions in the inbound direction.

Range

N/A

permit_count

Long

Definition

Allow count.

Range

N/A

permit_top_one_acl_id

String

Definition

ID of an allow policy that is frequently hit.

Range

N/A

permit_top_one_acl_name

String

Definition

Name of an allow policy that is frequently hit.

Range

N/A

records

Array of AccessTopStatisticsVO objects

Definition

Hit trend.

Range

N/A

top_deny_rule_list

Array of AccessTopMemberVO objects

Definition

Top blocking rule list.

Range

N/A

Table 5 AccessTopStatisticsVO

Parameter

Type

Description

agg_time

Long

Definition

Aggregation time.

Range

N/A

deny_access_top_counts

Long

Definition

Number of blocked objects.

Range

N/A

permit_access_top_counts

Long

Definition

Number of allowed objects.

Range

N/A

total_access_top_counts

Long

Definition

Number of hits.

Range

N/A

Table 6 AccessTopMemberVO

Parameter

Type

Description

count

String

Definition

Number of times.

Range

N/A

item

String

Definition

Item.

Range

N/A

name

String

Definition

Item name.

Range

N/A

Status code: 400

Table 7 Response body parameters

Parameter

Type

Description

error_code

String

Definition

Error code.

Range

N/A

error_msg

String

Definition

Error message.

Range

N/A

Example Requests

Query the policy overview of the firewall whose project ID is a16df7cf1d094befa6bbc72cbf51e93a and firewall ID is c598d612-8112-465c-bffd-863d4ce85a50 in the last hour.

https://{Endpoint}/v1/a16df7cf1d094befa6bbc72cbf51e93a/cfw/logs/access-top?fw_instance_id=a7df0f6c-da03-4511-ad0b-b17b589ff0ec&item=strategy_dashboard&range=0

Example Responses

Status code: 200

OK

{
  "data" : {
    "deny_count" : 27,
    "deny_top_one_acl_id" : "1ceb7988-b11b-4f1e-b7f1-1a807e9e89f3",
    "deny_top_one_acl_name" : "deny",
    "hit_count" : 4404,
    "permit_count" : 4377,
    "permit_top_one_acl_id" : "d1de06f0-dfe1-46e5-a50d-81a423b157a8",
    "permit_top_one_acl_name" : "23333"
  }
}

Status code: 400

Bad Request

{
  "error_code" : "CFW.00200007",
  "error_msg" : "Incorrect time range."
}

SDK Sample Code

The SDK sample code is as follows.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
package com.huaweicloud.sdk.test;

import com.huaweicloud.sdk.core.auth.ICredential;
import com.huaweicloud.sdk.core.auth.BasicCredentials;
import com.huaweicloud.sdk.core.exception.ConnectionException;
import com.huaweicloud.sdk.core.exception.RequestTimeoutException;
import com.huaweicloud.sdk.core.exception.ServiceResponseException;
import com.huaweicloud.sdk.cfw.v1.region.CfwRegion;
import com.huaweicloud.sdk.cfw.v1.*;
import com.huaweicloud.sdk.cfw.v1.model.*;


public class ShowAccessTopSolution {

    public static void main(String[] args) {
        // The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security.
        // In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment
        String ak = System.getenv("CLOUD_SDK_AK");
        String sk = System.getenv("CLOUD_SDK_SK");
        String projectId = "{project_id}";

        ICredential auth = new BasicCredentials()
                .withProjectId(projectId)
                .withAk(ak)
                .withSk(sk);

        CfwClient client = CfwClient.newBuilder()
                .withCredential(auth)
                .withRegion(CfwRegion.valueOf("<YOUR REGION>"))
                .build();
        ShowAccessTopRequest request = new ShowAccessTopRequest();
        try {
            ShowAccessTopResponse response = client.showAccessTop(request);
            System.out.println(response.toString());
        } catch (ConnectionException e) {
            e.printStackTrace();
        } catch (RequestTimeoutException e) {
            e.printStackTrace();
        } catch (ServiceResponseException e) {
            e.printStackTrace();
            System.out.println(e.getHttpStatusCode());
            System.out.println(e.getRequestId());
            System.out.println(e.getErrorCode());
            System.out.println(e.getErrorMsg());
        }
    }
}
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
# coding: utf-8

import os
from huaweicloudsdkcore.auth.credentials import BasicCredentials
from huaweicloudsdkcfw.v1.region.cfw_region import CfwRegion
from huaweicloudsdkcore.exceptions import exceptions
from huaweicloudsdkcfw.v1 import *

if __name__ == "__main__":
    # The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security.
    # In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment
    ak = os.environ["CLOUD_SDK_AK"]
    sk = os.environ["CLOUD_SDK_SK"]
    projectId = "{project_id}"

    credentials = BasicCredentials(ak, sk, projectId)

    client = CfwClient.new_builder() \
        .with_credentials(credentials) \
        .with_region(CfwRegion.value_of("<YOUR REGION>")) \
        .build()

    try:
        request = ShowAccessTopRequest()
        response = client.show_access_top(request)
        print(response)
    except exceptions.ClientRequestException as e:
        print(e.status_code)
        print(e.request_id)
        print(e.error_code)
        print(e.error_msg)
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
package main

import (
	"fmt"
	"github.com/huaweicloud/huaweicloud-sdk-go-v3/core/auth/basic"
    cfw "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/cfw/v1"
	"github.com/huaweicloud/huaweicloud-sdk-go-v3/services/cfw/v1/model"
    region "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/cfw/v1/region"
)

func main() {
    // The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security.
    // In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment
    ak := os.Getenv("CLOUD_SDK_AK")
    sk := os.Getenv("CLOUD_SDK_SK")
    projectId := "{project_id}"

    auth := basic.NewCredentialsBuilder().
        WithAk(ak).
        WithSk(sk).
        WithProjectId(projectId).
        Build()

    client := cfw.NewCfwClient(
        cfw.CfwClientBuilder().
            WithRegion(region.ValueOf("<YOUR REGION>")).
            WithCredential(auth).
            Build())

    request := &model.ShowAccessTopRequest{}
	response, err := client.ShowAccessTop(request)
	if err == nil {
        fmt.Printf("%+v\n", response)
    } else {
        fmt.Println(err)
    }
}

For SDK sample code of more programming languages, see the Sample Code tab in API Explorer. SDK sample code can be automatically generated.

Status Codes

Status Code

Description

200

OK

400

Bad Request

Error Codes

See Error Codes.