Log fields
This topic describes all the fields contained in Anti-DDoS Native mitigation logs.
All log fields of Anti-DDoS Native are divided into the following types by function:
Event fields: the fields related to the traffic scrubbing, blackhole filtering, and diversion protection events that occur on protected assets, including information such as the time and status of each event.
Traffic scrubbing fields: the fields related to the traffic scrubbing process, including the traffic data that different mitigation policies deny or allow during traffic scrubbing.
Event fields
Name | Description | Example value |
data_type | The data type. Valid values:
| Regional_SC_Mitigation |
event_time | The time when the event occurred, in timestamp format. Unit: seconds. | 1624434027 |
event_type | The event type. Valid values:
| mitigation_begin |
instance_id | The ID of the Anti-DDoS Native instance. | ddosbgp-cn-n6w203qg**** |
ip | The IP address of the protected asset. | 39.XX.XX.23 |
kbps_in | The inbound traffic bandwidth. Unit: kbps. | 1000 |
new_con | The number of new connections. | 1000 |
pps_in | The inbound packet forwarding rate. Unit: pps. | 1000 |
qps | The number of queries per second. Unit: qps. | 1000 |
scrubbing_center | The region of the traffic scrubbing center. Valid values:
| us_west |
subnet | The CIDR block associated with the event in diversion protection mode. | 1.XX.XX.1/24 |
uid | The Alibaba Cloud account ID. | 170457416359**** |
Traffic scrubbing fields
Name | Description | Example value |
time | The statistical time of the traffic scrubbing record, in timestamp format. Unit: seconds. | 1624434027 |
destination_ip | The destination IP address. | 123.XX.XX.169 |
port | The destination port. Valid values:
| 80 |
total_traffic_in_bps | The rate at which the traffic scrubbing device receives traffic. Unit: bps (bits per second). | 8000 |
total_traffic_drop_bps | The rate of traffic dropped during traffic scrubbing. Unit: bps (bits per second). | 800 |
total_traffic_in_pps | The packet forwarding rate of all types of inbound packets. Unit: pps. | 1000 |
total_traffic_drop_pps | The packet forwarding rate of all types of dropped packets. Unit: pps. | 1000 |
pps_types_in_tcp_pps | The packet forwarding rate of inbound TCP packets. Unit: pps. | 100 |
pps_types_in_udp_pps | The packet forwarding rate of inbound UDP packets. Unit: pps. | 1000 |
pps_types_in_icmp_pps | The packet forwarding rate of inbound ICMP packets. Unit: pps. | 1000 |
pps_types_in_syn_pps | The packet forwarding rate of inbound SYN packets. Unit: pps. | 1000 |
pps_types_in_ack_pps | The packet forwarding rate of inbound ACK packets. Unit: pps. | 1000 |
pps_types_in_synack_pps | The packet forwarding rate of inbound SYN-ACK packets. Unit: pps. | 1000 |
pps_types_in_finrst_pps | The packet forwarding rate of inbound FIN or RST packets. Unit: pps. | 1000 |
pps_types_in_dns_pps | The packet forwarding rate of inbound DNS packets. Unit: pps. | 1000 |
pps_types_drop_tcp_pps | The packet forwarding rate of dropped TCP packets. Unit: pps. | 1000 |
pps_types_drop_udp_pps | The packet forwarding rate of dropped UDP packets. Unit: pps. | 1000 |
pps_types_drop_icmp_pps | The packet forwarding rate of dropped ICMP packets. Unit: pps. | 1100 |
pps_types_drop_syn_pps | The packet forwarding rate of dropped SYN packets. Unit: pps. | 1000 |
pps_types_drop_ack_pps | The packet forwarding rate of dropped ACK packets. Unit: pps. | 1000 |
pps_types_drop_synack_pps | The packet forwarding rate of dropped SYN-ACK packets. Unit: pps. | 1000 |
pps_types_finrst | The packet forwarding rate of dropped FIN-RST packets. Unit: pps. | 1000 |
pps_types_dns | The packet forwarding rate of dropped DNS packets. Unit: pps. | 1000 |
policy_packet_checking_acct_pps | The packet forwarding rate of packets allowed by the packet checking policy (default). Unit: pps. | 1000 |
policy_packet_checking_drop_pps | The packet forwarding rate of packets denied by the packet checking policy (default). Unit: pps. | 1000 |
policy_dns_retransmission_authentication_drop_pps | The packet forwarding rate of packets denied by the domain-name-based first-packet-dropping policy (default). Unit: pps. | 1000 |
policy_dns_retransmission_authentication_acct_pps | The packet forwarding rate of packets allowed by the domain-name-based first-packet-dropping policy (default). Unit: pps. | 100 |
policy_source_ip_authentication_succeed_pps | The packet forwarding rate of packets that passed the check of the source IP address-based authentication policy (default). Unit: pps. | 1000 |
policy_source_ip_authentication_checked_pps | The packet forwarding rate of packets being checked by the source IP address-based authentication policy (default). Unit: pps. | 1000 |
policy_source_ip_authentication_acct_pps | The packet forwarding rate of packets allowed by the source IP address-based authentication policy (default). Unit: pps. | 1000 |
policy_source_ip_authentication_drop_pps | The packet forwarding rate of packets denied by the source IP address-based authentication policy (default). Unit: pps. | 1000 |
policy_source_ip_authentication_rebound_check_pps | The packet forwarding rate of packets undergoing rebound verification by the source IP address-based authentication policy (default). Unit: pps. | 1000 |
policy_source_ip_rate_limitation_drop_syn_pps | The packet forwarding rate of SYN packets denied by the source IP rate limiting policy (default). Unit: pps. | 1000 |
policy_source_ip_rate_limitation_drop_con_max_pps | The packet forwarding rate of packets denied because they exceeded the maximum number of connections specified by the source IP address-based concurrent connection rate limiting policy (default). Unit: pps. | 1000 |
policy_source_ip_rate_limitation_drop_con_rate_pps | The packet forwarding rate of packets denied because they exceeded the connection rate specified by the source IP address-based concurrent connection rate limiting policy (default). Unit: pps. | 1000 |
policy_source_ip_rate_limitation_drop_udp_rate_pps | The packet forwarding rate of packets denied by the source IP address-based UDP rate limiting policy (default). Unit: pps. | 1000 |
policy_source_ip_rate_limitation_drop_tcpack_rate_pps | The packet forwarding rate of packets denied by the source IP address-based ACK rate limiting policy (default). Unit: pps. | 1000 |
policy_source_ip_rate_limitation_drop_tcpsynack_rate_pps | The packet forwarding rate of packets denied by the source IP address-based SYN-ACK rate limiting policy (default). Unit: pps. | 1000 |
policy_destination_ip_rate_limitation_drop_syn_rate | The packet forwarding rate of SYN packets denied by the destination IP rate limiting policy (default). Unit: pps. | 1000 |
policy_destination_ip_rate_limitation_drop_udp_rate | The rate of UDP packets denied by the destination IP rate limiting policy (default). Unit: pps. | 1000 |
policy_destination_ip_rate_limitation_drop_ack_rate | The rate of ACK packets denied by the destination IP rate limiting policy (default). Unit: pps. | 1000 |
policy_destination_ip_rate_limitation_drop_icmp_rate | The rate of ICMP packets denied by the destination IP rate limiting policy (default). Unit: pps. | 1000 |
policy_destination_ip_rate_limitation_drop_other_rate | The packet forwarding rate of other types of packets (excluding UDP, ICMP, TCP-SYN, TCP-SYN-ACK, and TCP-ACK packets) denied by the destination IP rate limiting policy (default). Unit: pps. | 1000 |
policy_destination_ip_rate_limitation_drop_synack_rate | The packet forwarding rate of SYN-ACK packets denied by the destination IP rate limiting policy (default). Unit: pps. | 1000 |
policy_layer_4_filter_l4_filiter_drop_pps | The packet forwarding rate of packets denied by all fingerprint filtering policies (customized in Mitigation Settings). Unit: pps. | 1000 |
policy_layer_4_filter_l4_filiter_acct_num | The packet forwarding rate of packets allowed by the fingerprint filtering policy module (customized in Mitigation Settings). Unit: pps. | 1000 |
policy_layer_4_filter_l4_filite_drop_rule_1_pps | The packet forwarding rate of packets denied by the fingerprint filtering policy ranked 1 (customized in Mitigation Settings). Unit: pps. | 1000 |
policy_layer_4_filter_l4_filite_drop_rule_2_pps | The packet forwarding rate of packets denied by the fingerprint filtering policy ranked 2 (customized in Mitigation Settings). Unit: pps. | 1000 |
policy_layer_4_filter_l4_filite_drop_rule_3_pps | The packet forwarding rate of packets denied by the fingerprint filtering policy ranked 3 (customized in Mitigation Settings). Unit: pps. | 1000 |
policy_layer_4_filter_l4_filite_drop_rule_4_pps | The packet forwarding rate of packets denied by the fingerprint filtering policy ranked 4 (customized in Mitigation Settings). Unit: pps. | 1000 |
policy_layer_4_filter_l4_filite_drop_rule_5_pps | The packet forwarding rate of packets denied by the fingerprint filtering policy ranked 5 (customized in Mitigation Settings) . Unit: pps. | 1000 |
policy_layer_4_filter_l4_filite_drop_rule_6_pps | The packet forwarding rate of packets denied by the fingerprint filtering policy ranked 6 (customized in Mitigation Settings). Unit: pps. | 1000 |
policy_layer_4_filter_l4_filite_drop_rule_7_pps | The packet forwarding rate of packets denied by the fingerprint filtering policy ranked 7 (customized in Mitigation Settings). Unit: pps. | 1000 |
policy_layer_4_filter_l4_filite_drop_rule_8_pps | The packet forwarding rate of packets denied by the fingerprint filtering policy ranked 8 (customized in Mitigation Settings). Unit: pps. | 1000 |
policy_dns_domain_authentication_succ_domain_pps | The packet forwarding rate of packets that passed the check of the domain-based authentication policy (default). Unit: pps. | 1000 |
policy_dns_domain_authentication_fail_domain_pps | The packet forwarding rate of packets that failed the check of the domain-based authentication policy (default). Unit: pps. | 1000 |
policy_dns_domain_authentication_drop_pps | The packet forwarding rate of all packets denied by the domain-based authentication policy (default). Unit: pps. | 1000 |
policy_dns_domain_authentication_rebound_check_pps | The packet forwarding rate of packets redirected for verification by the domain-based authentication policy (default). Unit: pps. | 1000 |
policy_dns_domain_authentication_acct_pps | The packet forwarding rate of all packets allowed by the domain-based authentication policy (default). Unit: pps. | 1000 |
policy_syn_cookie_succ_check_pps | The packet forwarding rate of packets that passed the check of the SYN cookie-based policy (default). Unit: pps. | 1000 |
policy_syn_cookie_fail_check_pps | The packet forwarding rate of packets that failed the check of the SYN cookie-based policy (default). Unit: pps. | 1000 |
policy_syn_cookie_drop_pps | The packet forwarding rate of packets denied by the SYN cookie-based policy (default). Unit: pps. | 1000 |
policy_syn_cookie_rebound_check_pps | The packet forwarding rate of packets undergoing rebound verification by the SYN cookie-based policy (default). Unit: pps. | 1000 |
policy_syn_cookie_acct_pps | The packet forwarding rate of packets allowed by the SYN cookie-based policy (default). Unit: pps. | 1000 |
policy_udp_defense_drop_pps | The packet forwarding rate of packets denied by the UDP protection policy (default). Unit: pps. | 1000 |
policy_udp_defense_in_pps | The packet forwarding rate of inbound packets that match the UDP protection policy (default), that is, the number of UDP packets that enter protection detection per second. Unit: pps. | 1000 |
policy_dns_ipdomain_rate_limitation_drop_over_rate_limitation_pps | The rate of packets dropped because the IP address or domain name triggered a rate limit, among the traffic that matches the DNS protection policy (default). Unit: pps. | 1000 |
policy_antiothertcp_session_cre_num_syn_pps | The packet forwarding rate of packets in the sessions that the TCP protection policy created through SYN messages. Unit: pps. | 1000 |
policy_antiothertcp_session_cre_num_ack_pps | The packet forwarding rate of packets in the sessions that the TCP protection policy created through ACK messages. Unit: pps. | 1000 |
policy_antiothertcp_succ_auth_num_syn_pps | The packet forwarding rate of packets that passed authentication after the TCP protection policy established a session with SYN. Unit: pps. | 1000 |
policy_antiothertcp_succ_auth_num_ack_pps | The packet forwarding rate of packets that passed authentication after the TCP protection policy established a session with ACK. Unit: pps. | 1000 |
policy_antiothertcp_drop_pps | The packet forwarding rate of packets denied by the other TCP protection policies (default). Unit: pps. | 1000 |
policy_antiothertcp_acct_pps | The packet forwarding rate of packets allowed by the other TCP protection policies (default). Unit: pps. | 1000 |
policy_antitcp_in_pps | The total rate of the TCP packets that match the TCP protection policy. Unit: pps. | 1000 |
policy_antitcp_drop_tcp_pps | The packet forwarding rate of all TCP packets denied by the TCP protection policy (default). Unit: pps. | 1000 |
policy_antitcp_drop_ack_pps | The packet forwarding rate of ACK packets denied by the TCP protection policy (default). Unit: pps. | 1000 |
policy_antitcp_drop_pushack_pps | The packet forwarding rate of PUSHACK packets denied by the TCP protection policy (default). Unit: pps. | 1000 |
policy_retransmission_authentication_acct_pps | The packet forwarding rate of packets allowed by the first-packet-dropping policy (default). Unit: pps. | 1000 |
policy_retransmission_authentication_drop_pps | The packet forwarding rate of packets denied by the first-packet-dropping policy (default). Unit: pps. | 1000 |