Access logs are collected on an hourly basis and stored for 30 days. You can download the logs as need during the retention period.
Directions
1. Log in to the EdgeOne console. Click Log Service > Offline Logs on the left sidebar.
2. On the page that displays, select a site or the log file of a subdomain name. You can also filter logs by time.
3. Click Download in the Operation column.
Important
The access logs are collected on an hourly basis. If the selected domain name is not requested during the period, no logs are generated.
The access logs are compressed to a .gz file. Due to defects of the MacOS directory system, the .gz file may failed to be decompressed on MacOS by double-clicking it. In this case, you can run the following Terminal commands:
gunzip {your_file_name}.log.gz
EdgeOne nodes are distributed over the globe. To synchronize the time across time zones, logs are stored and queried in UTC+00:00 by default.
Generally, it takes around 30 hours to generate log data as it is collected from all EdgeOne nodes. The log data will be complete within 24 hours after being generated.
Field Description
Logs are stored in JSON format by default. The log fields are described as follows:
When a field is not specified:
For a string field, the field value is set to - if the field has no data.
For an integer field, the field value is set to -1 if the field has no data.
The client IP parses out the country's lower-level administrative divisions. Currently only data within mainland China is supported. Format: ISO 3166-2.
ClientISP
String
ISP information resolved from client IP.
Data within mainland China is recorded under the ISP's Chinese name.
The time that the client initiates a request, which is record in UTC +00:00 and defined in the ISO-8601 standard.
RequestStatus
int
Status of the client request. Values: 0 (not completed), 1 (completed successfully), 2 (completed abnormally)
RequestHost
String
Host of the client request
RequestBytes
int
Size of the client request, in bytes
RequestMethod
String
The HTTP method used by the client
RequestUrl
String
The URL for the client request
RequestUrlQueryString
String
The query string contained in the request URL
RequestUA
String
The User-Agent sent by the client
RequestRange
String
The Range parameter sent by the client
RequestReferer
String
The Referer parameter sent by the client
RequestProtocol
String
The application layer protocol used by the client. Values: HTTP/1.0, HTTP/1.1, HTTP/2.0, HTTP/3, WebSocket
RemotePort
int
The port that connects the client and node over the TCP protocol.
EdgeCacheStatus
String
Whether the client request results in a cache hit.
Hit: Resources are served by node cache.
Madam: Resources are served by the origin server and can be cached.
Dynamic: Resources cannot be cached.
other: Unidentifiable Cache Status.
EdgeResponseStatusCode
int
The status code that the node returns to the client
EdgeResponseBytes
int
Size of the response that the node returns to the client, in bytes
EdgeResponseTime
int
The amount of time elapsed between EdgeOne receiving a request from the client and waiting till the client receives the response from the server side. Unit: ms
EdgeInternalTime
int
The amount of time elapsed between EdgeOne receiving a request from the client and waiting till the client receives the response from the server side. Unit: ms
EdgeServerIP
String
IP address of the EdgeOne server, which can be resolved from the host using DNS.
EdgeServerID
String
The unique ID that identifies the EdgeOne server accessed by the client
SecurityAction
String
The rule action. Values: Monitor (observe), JSChallenge (JavaScript challenge), Deny (block), Allow (allow), BlockIP (block the IP), Redirect (redirect), ReturnCustomPage (return the custom page), ManagedChallenge (implement the managed challenge)
The time that the connection is established, which is recorded in UTC +0 and defined in the ISO-8601 standard.
DisconnetTimeStamp
String
The time that the connection is disconnected, which is recorded in UTC +0 and defined in the ISO-8601 standard.
DisconnetReason
String
Cause of disconnection
Format: [Direction: Reason].
Direction: up (origin)/down (client)
Reason:
Net_exception_peer_error: Read/write peer error
Net_exception_peer_close: Connection closed by the peer
Create_peer_channel_exception: Failed to create the channel to the next hop
Channel_eof_exception: Channel ended. When the quest ends, the related node sends channel_eof to neighbor nodes.
Net_exception_closed: Connection closed
Net_exception_timeout: Read/write timed out
ClientRealIP
String
Real client IP
ClientRegion
String
The 2-digit country/region code of the client in the ISO-3166 alpha-2 standard.
EdgeIP
String
IP address of the EdgeOne server accessed
ForwardProtocol
String
The TCP/UDP forwarding protocol configured by the client
ForwardPort
Int
The forwarding port configured by the client
SentBytes
Int
Outbound traffic produced when the log is generated, in bytes
ReceivedBytes
Int
Outbound traffic produced when the log is generated, in bytes
LogTimeStamp
String
The time that the log is generated, which is recorded in UTC +0 and defined in the ISO-8601 standard.
Notes
The traffic/bandwidth data (in bytes) recorded in the access log field "EdgeResponseBytes" may be different from the actual billing data for the following reasons:
Only application-layer data can be recorded in access logs. During actual data transfer, the traffic generated over the network is around 5-15% more than the application-layer traffic, including the following two parts:
Consumption by TCP/IP headers: in TCP/IP-based HTTP requests, each packet has a maximum size of 1,500 bytes and includes TCP and IP headers of 40 bytes, which generate traffic during transfer but cannot be counted by the application layer. The overhead of this part is around -4%.
TCP retransmission: During normal data transfer over the network, around 3% to 10% packets are lost on the internet, and the server will retransmit the lost ones. This type of traffic cannot be counted by the application layer, which accounts for 3% to 7% of the total traffic.
When smart acceleration is enabled, the traffic/bandwidth generated when the client sends a request to the EdgeOne node incurs charges. For more details, see Billing Overview.
