access log

Overview

Prerequisites

• You have created a CLB instance.

• You have created a vServer group, added backend servers to the vServer group, and deployed applications on the backend servers.

• You have configured an HTTP listener or an HTTPS listener for the CLB instance.

• You have activated Simple Log Service.

Configure access logs

1. Log on to the CLB console.

2. In the left-side navigation pane, choose Logs > Access Log.

3. In the top navigation bar, select the region where the CLB instance is deployed.

4. If this is your first time using the feature, click Authorize. On the Authorize Access to Cloud Resources page, click Confirm.

   Note

   You only need to perform this authorization once.

   If you are a RAM user, the primary Alibaba Cloud account must first grant you the required permissions. For more information, see Authorize a RAM user to use the access log feature of CLB.

5. On the Access Log (Layer 7) page, find the target CLB instance, and click Configure in the Actions column.

6. In the Log Settings panel, set the Project and Logstore, and then click OK.

   • Project: A Project is a resource management unit in SLS used for resource isolation and control. We recommend using different Projects for different applications.

   • Logstore: A Logstore is the unit for collecting, storing, and querying log data in SLS. We recommend creating separate Logstores for different types of logs within the same application.

     • Select Logstore: This enables a preset analysis dashboard for the selected Logstore by default. If an index is already configured for the Logstore, the existing index configuration is overwritten.

   Note

   Ensure the Project is in the same region as the CLB instance and its name is globally unique.

   After you configure access logging for the load balancer, you can query and retrieve log information by using the following fields in SLS.

   Parameter	Description
   body_bytes_sent	The size of the HTTP body sent to the client, in bytes.
   client_ip	The client IP address.
   client_port	The port of the client that sent the request.
   host	The host is retrieved from the first available source in the following order: request parameters, the Host header, and the IP address of the backend server that processes the request.
   http_host	The content of the Host header in the request.
   http_referer	The Referer header of the HTTP request.
   http_user_agent	The User-Agent header of the HTTP request.
   http_x_forwarded_for	The X-Forwarded-For header of the HTTP request.
   http_x_real_ip	The X-Real-IP header of the HTTP request.
   read_request_time	The time that the load balancer takes to read the request. Unit: milliseconds.
   request_length	The length of the request, including the start line, HTTP header, and HTTP body.
   request_method	The request method.
   request_time	The time from when the load balancer receives the first byte of a request to when it sends the last byte of the response. Unit: seconds.
   request_uri	The URI of the request that is received by the load balancer.
   scheme	The request scheme. Valid values: http and https.
   server_protocol	The HTTP version of the request that is received by the load balancer, such as HTTP/1.0 or HTTP/1.1.
   slb_vport	The listener port of the load balancer.
   slbid	The ID of the load balancer instance.
   ssl_cipher	The cipher suite used to establish the SSL connection, such as ECDHE-RSA-AES128-GCM-SHA256.
   ssl_protocol	The protocol used to establish the SSL connection, such as TLSv1.2.
   status	The status code in the response from the load balancer.
   tcpinfo_rtt	The round-trip time (RTT) of the client's TCP connection. Unit: microseconds.
   time	The time when the log entry was recorded.
   upstream_addr	The IP address and port of the backend server.
   upstream_response_time	The time from when a connection to a backend server is established to when the connection is closed after a response is received. Unit: seconds.
   upstream_status	The response status code that the load balancer receives from the backend server.
   vip_addr	The virtual IP address (VIP).
   write_response_time	The time that the load balancer takes to write a response. Unit: milliseconds.

Query access logs

After you configure the access log feature, you can query logs in the SLS console.

1. Log on to the CLB console.

2. In the left-side navigation pane, choose Logs > Access Log.

3. In the top navigation bar, select the region where the CLB instance is deployed.

4. On the Access Log (Layer 7) page, find the target instance, and click View Logs in the Actions column. You are redirected to the SLS console.

5. After SLS is configured, you can view log entries for any client that has accessed the CLB instance.

6. Enter an SQL statement to query specific access logs.

   For example, run the following SQL statement to find the top 20 clients. The results can help you analyze traffic sources and inform business decisions.

   * | select http_user_agent, count(*) as pv group by http_user_agent order by pv desc limit 20

   For example, run the following SQL statement to query for access requests from a specific IP address range by filtering logs by source IP address and response status code.

   * | select * where client_ip like '172.17.%' and status=200

Identify abnormal requests

CLB access logs record all external requests that pass through the load balancer instance. If you find requests from unknown sources in the logs, you can use the following key fields to determine whether they are abnormal external requests and take appropriate protective measures.

* | select client_ip, request_method, request_uri, count(*) as cnt group by client_ip, request_method, request_uri order by cnt desc limit 50

Analyze access logs

You can use dashboards in SLS to analyze access logs. Dashboards provide rich data visualizations and insights.

1. On the SLS page, click the icon in the left-side navigation pane, and then click Dashboard.

2. Click the name of the dashboard that corresponds to the access logs of your CLB instance, such as slb_layer7_access_center_cn, to view the analysis report.

Disable access logs

You can disable the access log feature to stop collecting CLB access logs.

1. Log on to the CLB console.

2. In the left-side navigation pane, choose Logs > Access Log.

3. In the top navigation bar, select the region where the CLB instance is deployed.

4. On the Access Log (Layer 7) page, find the target instance, and then click Disable Logging in the Actions column.

5. In the dialog box that appears, click OK to disable access logging for the instance.

Related documents

• To learn more about Simple Log Service, see What is Simple Log Service?.

• If you suspect a backend server is unhealthy when using Layer 7 load balancing, see Use CLB access logs to quickly locate an unhealthy backend server.