Billing-Web Application Firewall(WAF)-阿里云帮助中心

The Log Service for Web Application Firewall (WAF) supports Pro, Business, Enterprise, and Exclusive subscription instances and pay-as-you-go instances. The service is billed based on the log storage capacity that you purchase when you enable Log Service.

Billable item

The only billable item for the WAF Log Service is log storage capacity.

For subscription instances
When you enable the WAF Log Service, you select a specific log storage capacity in terabytes (TB). This capacity is billed on a subscription basis along with your instance.
For pay-as-you-go instances
You can set a log storage capacity from 1 TB to 100 TB. Setting a capacity greater than 0 enables the WAF Log Service. For specific per-TB pricing, see the Billing Management page. For more information, see Billing Management (Pay-as-you-go 2.0).

You can estimate the required log storage capacity based on your log settings and your website's average daily queries per second (QPS). For more information, see Choose a log storage capacity.

Billing duration

The billing duration for the WAF Log Service depends on how you enable it:

If you enable the WAF Log Service when you purchase a subscription instance, its billing duration matches the subscription period you select.
If you enable the WAF Log Service by upgrading an existing subscription instance, the billing duration is prorated to match the instance's remaining subscription period, calculated to the minute.
If you enable the WAF Log Service for a pay-as-you-go instance, the service is billed along with the instance.

Service expiration

When your WAF instance expires, the WAF Log Service also expires. When the service expires:

After the service expires, WAF stops writing log data to the dedicated Logstore.
After expiration, your WAF log data is retained for 7 days.
If you renew your WAF instance within this 7-day period, you can continue to use the WAF Log Service. If you do not renew the instance within this period, all stored WAF logs are automatically deleted.

Choose a log storage capacity

The required log storage capacity depends on the storage duration, custom field configuration, and storage type.

Setting	Description	Default setting
Storage duration	A longer storage duration requires more storage capacity.	By default, logs are stored for 180 days.
Custom field configuration	Required fields: These fields are always included in logs. Optional fields: You can choose to include these fields. Enabling more optional fields increases the required log storage capacity.	By default, all required fields and some optional fields are included.
Storage type	Storing full logs requires more storage capacity. Storing only attack logs.	By default, full logs are stored.

Assuming the default log settings, you can use the following table to estimate the required log storage capacity based on your website's average daily QPS.

Average daily QPS	Recommended capacity (TB)
≤ 80	3
81 to 120	5
121 to 260	10
261 to 350	15
351 to 500	20
501 to 1,200	50

Note You can change your log storage configuration with the log settings feature. For more information, see Modify log settings.