A log analysis dashboard charts log query and analysis results. Log Service for WAF provides three built-in dashboards for common business and security scenarios: Operation Center, Access Center, and Security Center. These dashboards let you quickly view key business and security data for your website by simply adjusting the time range, without writing a query statement.
Background information
A dashboard in Log Service provides real-time data analytics. You can use a dashboard to view multiple charts generated from query and analysis results. After you enable Log Service for WAF and enable log collection, you can use the three built-in log analysis dashboards to view business and security data for your website.
|
Dashboard |
Description |
|
Operation Center |
Displays traffic protection data and an attack overview for your website. |
|
Access Center |
Displays access metrics, trends, and request distribution for your website. |
|
Security Center |
Displays attack metrics, attack trends, and the distribution of attack sources for your website. |
For details about the charts in the built-in WAF dashboards, see Charts supported by the built-in WAF dashboards.
You can also create additional log analysis dashboards for specific business scenarios and add custom charts based on frequently used queries. To learn more, see visualization overview.
Prerequisites
You must enable Log Service for WAF. For more information, see Quick start for Log Service for WAF.
Procedure
-
Log on to the Web Application Firewall (WAF) console. In the top menu bar, select the resource group and region for your WAF instance: Chinese Mainland or Outside Chinese Mainland.
-
In the left navigation pane, choose .
-
From the domain name drop-down list, select a domain name and turn on the Status switch.
The domain name drop-down list contains only WAF-protected domain names. If you need to add a domain name to WAF, see Quick start: Add your first website.
-
Click the Log Analysis tab.
-
On the Operation Center, Access Center, or Security Center tab, select a dashboard. Then, set a time range to view the charts.
For more information about the chart types supported by different dashboards, see Charts supported by the built-in dashboards.
For more information about common dashboard operations, see What to do next.
Related operations
|
Actions |
Applicable to |
Description |
|
Set the time selector |
dashboards, charts |
Each dashboard contains multiple charts generated from raw log data within a specific time period. You can use a time selector to set the time range for chart data. Time selectors include the following types:
|
|
Create a subscription |
dashboard |
You can create a subscription for a dashboard to automatically send its reports to specified recipients by email or DingTalk group message on a schedule. In the upper-right corner of the dashboard, click Subscribe and complete the Create Subscription wizard to subscribe to the current dashboard. For more information, see Subscribe to a dashboard. |
|
Drill down into chart data |
chart |
Some charts on a dashboard have drill-down configured by default to provide more detailed statistics across additional dimensions. In the chart area, hover over the For a chart that supports drill-down, you can click an underlined number to view the underlying data. For example, click a number in the Attacked Hosts chart on the Security Center dashboard to quickly view the attacked domain names and the number of attacks. Note
You can also switch to the Raw Logs tab to view related raw logs. For more information, see Add interaction events to a dashboard to implement drill-down analysis. |
|
Download chart or chart data |
chart |
In the chart area, hover over the |
|
Preview the query statement |
chart |
In the chart area, hover over the |
icon in the upper-right corner and click Select Time Range. In the Time panel, you can set a time range for that chart.
icon, drill-down is configured for the chart.
icon to preview the query statement for the current chart.WAF built-in dashboard charts
WAF Log Service includes three pre-configured dashboards: Operations Center, Access Center, and Security Center. These dashboards display information on your website's traffic operations, access patterns, and security threats, respectively. Each dashboard provides a different set of charts, as described below:
-
Operation Center: Provides an overview of attacks and traffic protection for your website. The following table describes the charts on this dashboard.
Chart name
Type
Default
Description
Value
User request
Single-value chart
Compared to the previous day
The number of page views (PVs) and unique visitors (UVs).
48.3 thousand
Peak traffic
Single-value chart
Compared to the previous day
Peak inbound, outbound, and attack traffic, measured in KB/s.
4.6
Valid request ratio
Single-value chart
Compared to the previous hour
Percentage of valid requests in all WAF-analyzed traffic.
98.41%
Valid traffic
Single-value chart
Compared to the previous hour
Volume of valid inbound and outbound traffic that WAF forwards to the origin server, measured in MB.
10.7
Request trend
Line chart
1 week (relative)
Trends in request count, valid request ratio, and inbound/outbound bandwidth. Bandwidth is measured in KB/s.
None
Attack statistics
Single-value chart, world map, and China map
Compared to the previous hour
Total attack count, attack traffic volume (in KB), and their geographic distribution.
None
Attacker list
Table
1 hour (relative)
Lists the IP addresses of attackers.
None
Top 100 Attacked Websites
Table
1 hour (relative)
The 100 most-attacked website domains.
None
-
Access Center: Displays access metrics, trends, and request distribution for your website. The following table details the charts available in this center.
Name
Type
Default time range
Description
Example
PV
Single-value chart
1 hour (relative)
The total number of requests (Page Views).
100,000
UV
Single-value chart
1 hour (relative)
The total number of unique visitors.
100
Inbound traffic
Single-value chart
1 hour (relative)
The total volume of inbound traffic to your website, in MB.
300 MB
Peak inbound traffic
Single-value chart
Today (aligned time)
The peak rate of inbound traffic to your website, in KB/s.
0.5 KB/s
Peak outbound traffic
Single-value chart
Today (aligned time)
The peak rate of outbound traffic from your website, in KB/s.
1.3 KB/s
Traffic and Bandwidth Trend
Area chart
Today (aligned time)
Shows the trend of inbound and outbound traffic rates for your website, in KB/s.
N/A
PV/UV Trends
Line chart
Today (aligned time)
Shows PV and UV trends, measured by count.
N/A
Access Status Distribution
Streamgraph
Today (aligned time)
Shows the trend of request response statuses (e.g., HTTP 200, 304, 400), measured in counts per hour.
N/A
Access Source
World map
1 hour (relative)
The geographic distribution of requests by country.
N/A
Inbound Traffic Source (World)
World map
1 hour (relative)
The geographic distribution of inbound traffic by country.
N/A
Inbound Traffic Source (China)
China map
1 hour (relative)
The geographic distribution of inbound traffic by province in the Chinese mainland.
N/A
Access Heatmap
Amap
1 hour (relative)
Displays a heatmap of the geographic origin of requests.
N/A
Source Network Provider
Pie chart
1 hour (relative)
Shows the distribution of requests by Internet Service Provider (ISP), such as China Telecom, China Unicom, China Mobile, and CERNET.
N/A
Referer
Table
1 hour (relative)
Lists the top 100 referers by request count, showing the referer URL, host, and number of occurrences for each.
N/A
Mobile Client Type Distribution
Pie chart
1 hour (relative)
Breaks down requests by mobile client type.
N/A
PC Client Type Distribution
Pie chart
1 hour (relative)
Breaks down requests by PC client type.
N/A
Request Content Type Distribution
Pie chart
1 hour (relative)
Shows the distribution of requests by content type (e.g., HTML, form, JSON, and streaming data).
N/A
Accessed Domain Names
Treemap
1 hour (relative)
Lists the top 30 most frequently accessed domain names.
N/A
Top Clients
Table
1 hour (relative)
Lists the top 100 clients by request count, providing details such as client IP address, region, city, network, HTTP method distribution, inbound traffic, and counts for access errors and attacks.
N/A
Slowest Response URLs
Table
1 hour (relative)
Lists the top 100 URLs with the longest response times, showing the domain name, URL, average response time, and request count for each.
N/A
-
Security Center: Displays attack metrics, trends, and the distribution of attack sources for your website. The following table describes the charts on this dashboard.
Chart name
Type
Default time range
Description
Example
Peak attack traffic
Single-value chart
1 hour (relative)
The peak rate of attack traffic. Unit: Bps.
100 Bps
Attacked hosts
Single-value chart
Today (aligned time)
The number of attacked hosts.
3
Attack source countries
Single-value chart
Today (aligned time)
The number of source countries for attacks.
2
Attack traffic
Single-value chart
1 hour (relative)
The total volume of attack traffic. Unit: B.
1 B
Unique attackers
Single-value chart
1 hour (relative)
The number of unique attackers.
40
Attack type distribution
Streamgraph
Today (aligned time)
The distribution of attacks by type.
None
Intercepted attacks
Single-value chart
1 hour (relative)
The total number of attack requests that WAF intercepted.
100
HTTP flood attack interception
Single-value chart
1 hour (relative)
The number of HTTP flood attacks that WAF intercepted.
10
Web application attack interception
Single-value chart
1 hour (relative)
The number of web application attacks that WAF intercepted.
80
Access control event
Single-value chart
1 hour (relative)
The number of requests blocked by custom access control list (ACL) policies.
10
HTTP flood attacks (World)
World map
1 hour (relative)
The geographic distribution of HTTP flood attacks by country.
None
HTTP flood attacks (China)
China map
1 hour (relative)
The geographic distribution of HTTP flood attacks by province in China.
None
Web application attacks (World)
World map
1 hour (relative)
The geographic distribution of web application attacks by country.
None
Web application attacks (China)
China map
1 hour (relative)
The geographic distribution of web application attacks by province in China.
None
Access control blocks (World)
World map
1 hour (relative)
The geographic distribution, by country, of requests blocked by custom access control list (ACL) policies.
None
Access control blocks (China)
China map
1 hour (relative)
The geographic distribution, by province in China, of requests blocked by custom access control list (ACL) policies.
None
Attacked hosts
Treemap chart
1 hour (relative)
A ranking of the most frequently attacked domain names.
None
HTTP flood protection policy distribution
Pie chart
1 hour (relative)
A breakdown of triggered HTTP flood protection policies.
None
Web application attack type distribution
Pie chart
1 hour (relative)
The distribution of web application attack types.
None
Top attackers
Table
1 hour (relative)
Lists the top 100 attackers with their IP addresses, provinces, and carriers, along with the attack counts and traffic volume for each attack type.
None
Attacker referer
Table
1 hour (relative)
Lists the Referer URL, Referer host, and number of occurrences for attack requests.
None
For details, see Chart overview.