Log Audit
After you enable Cloud Firewall, the system automatically records traffic logs, event logs, and console operation logs. These logs are visualized on the Log Audit page to help you trace attack sources and review traffic. This feature is free and supports querying logs from the last seven days, which is sufficient for immediate security monitoring and incident response needs.
By default, the Log Audit feature stores logs for 7 days. To extend the log retention period, meet compliance and audit requirements, or export raw log data, you must enable the log analysis feature. For more information, see Log Analysis Overview.
Log types
The Log Audit feature supports the following log types:
Flow Logs: Includes Traffic Logs and Event Logs generated by all enabled border firewalls.
Traffic Logs: Records details of all network traffic passing through Cloud Firewall, including source and destination IP addresses, source and destination ports, transport protocols, and traffic volume.
Event Logs: Records potential security threats or anomalous traffic that Cloud Firewall identifies. These logs are categorized by protection module, such as IPS, Threat Intelligence, and TLS Inspection. Each log provides key information for tracing and analyzing security events, including attack time, threat type, source and destination IP addresses, application type, severity, and the action taken.
Proxy Logs: If an explicit proxy firewall is configured, this log contains the Outbound Access Log and Event Log for traffic that passes through the firewall.
Outbound Access Log: Records details of network traffic passing through the proxy firewall, including the proxy instance, request ID, source and destination IDs, source and destination ports, domain name, URL, and status code.
Event Logs: Records potential security threat events that pass through the proxy firewall and trigger AI Security Guardrail and TLS Inspection policies.
Operation Logs: Records all user actions in the Cloud Firewall console, such as rule configuration changes, system setting adjustments, and other administrative interventions. You can use operation logs to audit user behavior and ensure that system changes are traceable.
Query audit logs
Log on to the Cloud Firewall console.
In the left-side navigation pane, choose .
Navigate to the tab for the log type that you want to query.
Flow Logs
Set the filter conditions and time range, and then click Search to view the logs. The following table describes some of the key fields.
Field
Description
Rule Module/Rule Name/Rule ID
Displays the name of the access control policy or attack protection rule that the traffic matched. An empty field indicates that no rule was matched.
Application Protocol Detection Status
The application identification status of the traffic when it matches an access control policy. Valid values:
Identified
Blocked by Policy
TCP Connection Failed
Payload Not Received
Analyzing
Not Identified in Strict Mode
Not Identified in Loose Mode
Stateless: Indicates traffic was processed without deep packet inspection (DPI).
Pre-match Access Control Policy Status and Pre-match Access Control Policy
Cloud Firewall matches traffic against access control policies by priority. If Cloud Firewall cannot identify the application or domain name, the Pre-match Access Control Policy Status field indicates the unidentified status and the Pre-match Access Control Policy field shows the policy name.
Valid values for Pre-match Access Control Policy Status:
Application Unidentified: Cloud Firewall cannot identify the application for the traffic.
Domain Name Unidentified: Cloud Firewall cannot identify the domain name for the traffic.
Normal: Cloud Firewall can identify both the application and the domain name for the traffic.
Actions
For events blocked by virtual patching and basic IPS protection, you can click Actions in the Obtain Attack Sample column to generate an attack sample from the last 7 days and view detailed data. The generated sample is retained for one month.
Proxy Logs
Set the filter conditions and time range, and then click Search to view the logs. The following table describes some of the key fields.
Field
Description
Account UID/Proxy Instance
The ID of the explicit proxy firewall instance and the UID of the Alibaba Cloud account that owns it.
Region
The deployment region of the explicit proxy firewall instance.
Application Name
The application type that triggers the log, such as Windows Update.
Security Detection Module
The type of policy matched, such as Access Control, Threat Intelligence, or AI Security Guardrail.
Actions
Click the Actions button in the Details column to view detailed Request and Response information.
Operation Logs
Set the filter conditions and time range, and then click Search to view the logs. The following table describes some of the key fields.
Field
Description
Risk Level
The system-assigned severity of the event. If you confirm that the event is a normal business operation, you can ignore the alert.
Operator
The user account that performed the action, including a main account and a RAM user.
Log Content
The specific action that the user performed.