Instant logs

Instant Logs provides real-time access log viewing in the ESA console with no additional setup. Use it to locate attacks, troubleshoot failures, and debug site connectivity.

Why use instant logs

Traditional CDN products rely on offline logs to identify and resolve issues, but offline logs have significant limitations:

Cross-region fault diagnosis: Single-node or high-latency network-wide logs make it difficult to pinpoint regional access issues.
Verifying phased releases: Offline logs cannot quickly filter requests specific to a phased release.
Real-time attack analysis: High-latency logs delay the creation of mitigation policies against new attack patterns.
Real-time business monitoring: Minute-level latency is insufficient for dynamic policy adjustments during promotional events.
Verifying new service onboarding: Log latency delays confirmation that a new site's delivery path is correct.

ESA Instant Logs provides real-time log viewing in the console, similar to tail -f in Linux/Unix.

Limits

A site can have only one active monitoring session at a time, lasting up to 60 minutes.
Instant logs store up to 40 records per session in chronological order. New records overwrite the oldest.
The following actions terminate your monitoring session. To resume, click Start Monitoring again.
- The session ends if you expand a log record, click Stop Monitoring, or click the Export button. Historical records remain on the page.
- Adding a filter, switching to another page, or refreshing the page terminates the session and clears all records.

Start monitoring instant logs

In the ESA console, select Websites, and in the Website column, click the target site.
In the left navigation pane, choose Analytics and Logs > Real-time Logs.
On the Instant Logs page, click Start Monitoring to begin collecting logs.
- Add a Traffic Filter to narrow log scope and identify anomalies.
- After monitoring stops, expand a log record to view fields, or click the Export button to download data as JSON.

Instant log fields

Field	Type	Description
BotTag	string	The traffic type of the client request. Examples: Chrome Java-sdk Android-app-browser Go-http-client
ClientASN	string	The autonomous system number (ASN) derived from the client IP address.
ClientCountryCode	string	The ISO 3166-1 alpha-2 country code derived from the client IP address.
ClientIP	string	The client IP address that connected to the ESA node.
ClientISP	string	The internet service provider (ISP) derived from the client IP address.
ClientRegionCode	string	The ISO 3166-2 region code derived from the client IP address.
ClientRequestBytes	int	The size of the client request, in bytes.
ClientRequestHeaderRange	string	The value of the `Range` field in the client request header. Example: `bytes=0-100`.
ClientRequestHost	string	The `Host` header of the client request.
ClientRequestID	string	The unique ID of the client request.
ClientRequestMethod	string	The `HTTP Method` of the client request.
ClientRequestPath	string	The path of the client request.
ClientRequestProtocol	string	The protocol of the client request.
ClientRequestQuery	string	The `Query` string of the client request.
ClientRequestReferer	string	The `Referer` header of the client request.
ClientRequestURI	string	The `URI` of the client request.
ClientRequestUserAgent	string	The `User-Agent` header of the client request.
ClientSrcPort	int	The source port used by the client to connect to the ESA node.
ClientSSLCipher	string	The SSL cipher suite used by the client.
ClientSSLProtocol	string	The SSL protocol version used by the client. A hyphen (`-`) indicates that SSL was not used.
ClientXRequestedWith	string	The `X-Requested-With` header sent by the client.
EdgeCacheStatus	string	The cache status of the client request.
EdgeEndTimestamp	Timestamp ISO8601	The timestamp when the ESA node finished sending the response to the client. Example: `2024-01-01T00:00:00+08:00`.
EdgeRequestHost	string	The `Host` header used for the ESA node's back-to-origin request.
EdgeResponseBodyBytes	int	The size of the response `body` that the ESA node returned to the client, in bytes.
EdgeResponseBytes	int	The total size of the response that the ESA node returned to the client, in bytes.
EdgeResponseCompressionAlgo	string	The compression algorithm of the response from the ESA node.
EdgeResponseCompressionRatio	float	The compression ratio of the response from the ESA node.
EdgeResponseContentType	string	The `Content-Type` header of the response from the ESA node.
EdgeResponseStatusCode	int	The status code that the ESA node returned to the client.
EdgeResponseTime	int	The total response time (ms) from when the ESA node receives a request until the client finishes receiving the response.
EdgeServerID	string	The unique ID of the ESA node that the client accessed.
EdgeServerIP	string	The IP address of the ESA node that the client accessed.
EdgeStartTimestamp	Timestamp ISO8601	The timestamp when the ESA node received the client request. Example: `2024-01-01T00:00:00+08:00`.
JA3Hash	string	The hash value of the client's JA3 fingerprint.
JA4Hash	string	The hash value of the client's JA4 fingerprint.
EdgeTimeToFirstByteMs	int	The time to first byte (TTFB) in milliseconds (ms), from when the ESA node receives a request to when the ESA node sends the first response byte.
OriginDNSResponseTimeMs	int	The origin server's DNS resolution time, in milliseconds (ms). If a back-to-origin request is not made, the value is `-1`.
OriginIP	string	The IP address of the origin server accessed during the back-to-origin request. If a back-to-origin request is not made, the value is a hyphen (`-`).
OriginResponseDurationMs	int	The origin server's time to first byte (TTFB), in milliseconds (ms). If a back-to-origin request is not made, the value is `-1`.
OriginResponseHeaderRange	string	The value of the Range header in the origin server's response. If a back-to-origin request is not made, the value is a hyphen (`-`).
OriginResponseHTTPExpires	string	The value of the Expires header in the origin server's response. If a back-to-origin request is not made, the value is a hyphen (`-`).
OriginResponseHTTPLastModified	string	The value of the Last-Modified header in the origin server's response. If a back-to-origin request is not made, the value is a hyphen (`-`).
OriginResponseStatusCode	int	The status code of the response from the origin server. If a back-to-origin request is not made, the value is `-1`.
OriginSSLProtocol	string	The SSL protocol version used for the back-to-origin request. If a back-to-origin request is not made, the value is a hyphen (`-`).
OriginTCPHandshakeDurationMs	int	The time to complete the TCP handshake for the back-to-origin connection, in milliseconds (ms). If a back-to-origin request is not made, the value is `-1`.
OriginTLSHandshakeDurationMs	int	The time to complete the TLS handshake for the back-to-origin connection, in milliseconds (ms). If a back-to-origin request is not made, the value is `-1`.
SecAction	string	The final mitigation action taken for this request.
SecActions	string	All mitigation actions taken for this request.
SecRuleID	string	The ID of the final mitigation rule triggered for this request.
SecRuleIDs	string	The IDs of all mitigation rules triggered for this request.
SecSource	string	The security module that triggered the final mitigation action.
SecSources	string	A list of all security modules that triggered mitigation actions for this request.
SiteName	string	The name of the site.
SmartRoutingStatus	string	Indicates whether smart routing was used. A value of `0` means not used, and `1` means used.
TlsHash	string	The MD5 hash value that represents the client's SSL/TLS fingerprint.
SampleInterval	float	The sampling rate for this log record. `Sample rate = (Number of sampled logs) / (Number of generated logs)`. For example, a rate of 0.5 means that one log was sampled for every two logs that were generated.

Custom request header fields

By default, instant logs record only the built-in fields listed in the preceding table. To also record specific request header fields (for example, User-Agent or Referer), call the CreateSiteCustomLog operation and use the RequestHeaders parameter to configure custom request header fields for the site log. After configuration, the custom fields appear in both instant logs and offline logs.

To configure custom request header fields, call the CreateSiteCustomLog operation and specify the fields to record in RequestHeaders:

aliyun esa CreateSiteCustomLog \
  --SiteId <site ID> \
  --RequestHeaders '["User-Agent", "Referer"]'

To check the currently configured custom request header fields, call the GetSiteCustomLog operation:

aliyun esa GetSiteCustomLog --SiteId <site ID>

Sample response:

{
  "ConfigId": 507209232529408,
  "IsExist": true,
  "LogCustomField": {
    "RequestHeaders": ["User-Agent"]
  }
}

Feature availability by edition

Free	Basic	Standard	Advanced	Enterprise
Not supported	Not supported	Supported	Supported	Supported