Skip to main content

Access Logs

The Access Logs system provides downloadable log files containing detailed website access information in compressed format for analysis and monitoring purposes.

Log File Access​

Access logs are available as downloadable .gzip compressed files containing comprehensive request information.

![Figure Needed] Screenshot showing log download interface with available log files by date and time

Log Retention and Availability​

  • Retention Period: Logs are stored for 30 days
  • Update Frequency: New log files are available every hour
  • File Format: Compressed .gzip format for efficient storage and transfer

Bulk Log Retrieval​

For scenarios requiring large numbers of log files, API access is available for automated retrieval and processing.

API Integration​

  • Automated Download: Programmatic access to log files
  • Batch Processing: Efficient handling of multiple log files
  • Integration Support: Compatible with log analysis tools and systems

Log Entry Format​

Each log entry follows a standardized format providing comprehensive request information:

$remote_addr - - [$time_local] "$request" $status $request_time - $bytes_sent "$http_referer" "$http_user_agent" "-" "$session_id" "$HIT" "$server_addr" $ttfb

Field Definitions​

Client Information​

  • $remote_addr: Client IP address (e.g., 45.32.174.90)
  • $session_id: Unique client session identifier
  • $http_user_agent: Client browser and device information
    • Example: "Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/27.0.1453.116 Safari/537.36"

Request Details​

  • $time_local: Request completion timestamp in UTC+08 (e.g., 11/Jan/2017:18:38:57 +0800)
  • $request: HTTP method and complete URL
    • Example: GET http://image.example1.com/upload_files/images/360_270/20150410/eb252121-b392-4651-b938-117991cfb9b5.jpg
  • $http_referer: HTTP Referrer header from client request

Response Information​

  • $status: HTTP response code (e.g., 200, 403, 404)
  • $bytes_sent: Total bytes sent to client including headers and content
  • $request_time: Request processing duration in milliseconds (e.g., 955.123)

CDN-Specific Data​

  • $HIT: Cache status indicating whether content was served from cache
    • Values: HIT, MISS, REFRESH, BYPASS
  • $server_addr: CDN node IP address serving the request
  • $ttfb: Time to First Byte - time from request to first response byte

Cache Status Values​

Hit Status Indicators​

  • HIT: Content served from CDN cache
  • MISS: Content retrieved from origin server
  • REFRESH: Cached content refreshed from origin
  • BYPASS: Request bypassed cache (policy-based)

Log Analysis Use Cases​

Performance Analysis​

  • Response Time Monitoring: Track $request_time and $ttfb values
  • Cache Efficiency: Analyze $HIT status distribution
  • Geographic Performance: Correlate $server_addr with client locations

Security Monitoring​

  • Traffic Pattern Analysis: Identify unusual request patterns
  • IP Address Tracking: Monitor $remote_addr for security threats
  • Status Code Analysis: Track error rates and security events

Business Intelligence​

  • Content Popularity: Analyze most requested resources
  • User Behavior: Track session patterns and referrer data
  • Device Analytics: Parse user agent strings for device insights

Log Processing Tools​

  • ELK Stack: Elasticsearch, Logstash, and Kibana for comprehensive analysis
  • Splunk: Enterprise log analysis and monitoring
  • Custom Scripts: Parse logs using programming languages (Python, bash, etc.)
  • CDN Analytics Tools: Specialized CDN log analysis platforms