Observability
  • Log Service
    • Overview
    • Real-time Logs
      • Real-time Logs Overview
      • Push to Tencent Cloud CLS
      • Push to AWS S3-Compatible COS
      • Push to HTTP Server
    • Offline Logs
    • Related References
      • Field description
        • L7 Access Logs
        • L4 Proxy Logs
      • Real-Time Log Push Filter Conditions
      • Custom Log Push Fields
  • Data Analysis
    • Overview
    • Traffic Analysis
    • Cache Analysis
    • Security Analysis
      • Site Security Overview
      • Web Security Analysis
    • L4 Proxy
    • DNS Resolution
    • Related References
      • How to use filter condition
      • How to Modify Query Time Range
      • How to Export Statistical Data and Reports

Traffic Analysis

Overview

EdgeOne Service analyzes L7 (application layer) access log data to provide you with multi-dimensional, visualized traffic analysis, including time trend curves of traffic, requests, and other indicators, as well as country/region distribution and TOP rankings.

Supported Capabilities

Traffic analysis supports data statistics for traffic, requests, and bandwidth. You can switch between different core indicator data areas by clicking on them.
Note:
Temporarily not supported to switch to the "Unique IP count" indicator.




1. Data Filtering and Selection

Supports selecting the time range for data query, for details, please refer to How to Modify the Query Time Range.
Supports filtering by site, Hosts, country/region, status code, URL, and other dimensions, for details, please refer to How to Use Filter Conditions.

2. Core Indicators

Total Traffic:
EdgeOne responded: The sum of all traffic transmitted from EdgeOne to the client, i.e., downstream traffic.
Client request: The sum of traffic received by EdgeOne from client requests, i.e., upstream traffic.
Total Requests: The number of requests EdgeOne receives from clients.
Peak Bandwidth:
EdgeOne response: The peak of all bandwidth transmitted from EdgeOne to the client, i.e., downstream bandwidth peak.
Client request: The peak of bandwidth received by EdgeOne from client requests, i.e., upstream bandwidth peak.
Number of independent IPs: The number of requests obtained by deduplicating client IP addresses, which can reflect the number of IP addresses accessing the business.
Note:
The calculation method of the bandwidth peak indicator will vary depending on the time granularity.
1-minute granularity: Total traffic within 1 minute * 8 / 60 seconds.
5-minute granularity: Total traffic within 5 minutes * 8 / 300 seconds.
Hourly basis: The maximum value among all 5-minute granularity bandwidth peak points.
Daily basis: The maximum value among all 5-minute granularity bandwidth peak points.

3. Time Trend Chart

Under the "All" tab, the time trend curve of the currently selected core indicator is displayed.
Under the "Status Code" tab, the time trend bar chart of the currently selected core indicator, divided by status code, is displayed.
Note:
When the core indicator is selected as the bandwidth peak, the status code tab data is not supported.

4. Status Code Distribution

Displays the distribution of the currently selected core indicator in the status code dimension. By default, only the Top 4 are displayed, and other status codes are classified as "Others".
Note:
1. The status code used here is the one responded by EdgeOne nodes to the client.
2. When the core indicator is selected as the bandwidth peak, the status code distribution is not supported.

5. Country/Region Distribution

Displays the distribution of the currently selected core indicator in the country/region.
Note:
1. The data here is based on the country/region of the client, which may differ from the billing data. The regional distribution of billing data is based on the actual service user's EdgeOne node location.
2. Due to the delay and algorithm influence, the country/region distribution is for reference only, and it is suggested to refer to the actual log analytics results.

6. TOP Rankings

The TOP ranking dimensions supported by traffic analysis are as follows:
Hosts: Subdomains requested by the client.
URLs: Specific resource paths requested by the client.
Resource Type: Resource types requested by the client, such as ".png", ".json", etc.
Client IP Address: The specific source IP address of the client request.
Referers: The Referer information of the client request.
Client Device Type:
Device Type: The hardware device type used by the client request, with values:
TV: Television.
Tablet: Tablet computer.
Mobile: Mobile phone.
Desktop: Computer.
Other: Others.
Browser: The browser type used by the client request.
Operating System: The operating system type used by the client request.
Note:
1. TOP Client IP Address ranking only supports the following filter options: Host, Country/Region, HTTP version, TLS version, HTTP/HTTPS.
2. Due to the delay and algorithm influence, the TOP ranking data is for reference only, and it is suggested to refer to the actual log analytics results.
3. When the core indicator is selected as "Bandwidth Peak", the TOP ranking is not supported.

Analysis Examples

Scenario 1: Troubleshooting URLs with access errors

Scenario Example

After adding www.example.com to the EdgeOne Service through Add acceleration domain name, many end-users report that they cannot open the webpage. To analyze the cause of the problem and its impact, you can perform the following operations in the Data Analysis > Traffic Analysis page.

Directions

1. Log in to the EdgeOne console, click on the Site List in the left menu bar, and click on the site you are concerned about in the Site List to enter the Site Details page.
2. In the Site Details page, click on Data Analysis > Traffic Analysis to enter the Traffic Analysis page.
3. In the Traffic Analysis page, click Add Filter, add the filter condition Host=www.example.com, and click OK.



4. View the status code distribution, observe the proportion of abnormal status codes, and find that there are abnormal status codes "404".



5. View the time-based trend of status codes, such as a higher proportion of "404" during certain periods, which can be traced back to a higher number of business access failures during that time, requiring special attention.



6. Add filter conditions status code=404, and by viewing the TOP URL, you can get the specific URLs with access exceptions. In the next step, you can go to the origin to troubleshoot whether there is a problem with this URL.

Scenario 2: Monitoring the traffic trend of all sites under the account

Scenario Example

After adding multiple sites and running them stably on EdgeOne for a period of time, you want to regularly inspect the traffic trends of all sites in the console. You can follow the steps below.

Directions

1. Log in to the EdgeOne console, and in the left menu bar, click on Data Analysis > Traffic Analysis to enter the multi-site aggregated traffic analysis page.
2. View the time trend chart, observe whether the traffic and requests have a sudden increase or decrease, and judge whether the overall business is running smoothly.
3. Click on Compare Data to compare the traffic curves of the same time period in the last two days, and observe whether the business has a sudden increase or decrease in day-to-day comparison.