Configure log fields and delivery status
Web Application Firewall (WAF)After you enable Log Service, you can configure default log fields and customize field settings for individual protected objects. This topic describes how to use default field settings and object-level field settings to flexibly and centrally manage log field configurations for your protected objects.
Default field settings
Default field settings allow you to predefine the log fields for delivery. After the configuration is complete, the settings are automatically applied to all protected objects and log delivery tasks. In the navigation pane on the left, choose .Click Log Configuration on the page, and then go to the Default Field Settings tab to complete the following configurations.
Parameter | Description |
Required Fields | Required fields are always included in WAF logs. You cannot edit required fields. For details about the fields, see Required log fields. |
Optional Fields | Optional fields can be manually selected for inclusion in WAF logs. WAF only records the optional fields that you enable. For details about the fields, see Optional log fields. Note Enabling more optional fields increases log storage usage. If you have sufficient storage capacity, we recommend enabling more optional fields for comprehensive log analysis. |
Log Type | Storage type settings allow you to select log storage types and sampling ratios. The sampling ratio determines the percentage of generated log entries that are collected for storage and analysis. After selecting a storage type, you can set the sampling ratio between 1% and 100%. The three storage types are described as follows:
Note For comprehensive auditing and analysis, we recommend selecting all log storage types to record full logs. |
After you complete the default field settings, click Save. When the "The operation is successful." message appears, the configuration takes effect globally. To modify the default field settings, return to the Default Field Settings tab, update the settings, and save.
Delivery settings
Delivery settings allow you to configure fields and log storage types for individual protected objects. If you configure specific fields and log storage types for a protected object, these object-level settings take precedence over the default field settings.
If you subscribe to WAF 3.0 Enterprise or Ultimate (subscription) and have added hybrid cloud protected objects, you can also deliver logs through Kafka or SYSLOG.
Access the console
Log on to the Web Application Firewall 3.0 console. From the top menu bar, select the resource group and region (Chinese Mainland or Outside Chinese Mainland) for the WAF instance..
In the navigation pane on the left, choose .
Click Log Configuration in the upper-right corner. On the Log Configuration page, click Delivery Settings.
Configure SLS delivery status
On the Delivery Settings tab, you can enable or disable log delivery for protected objects. An enabled switch 
in the Status of Delivery to Simple Log Service column indicates that delivery is active.
You can perform bulk operations to Enable Delivery to Simple Log Service or Disable Delivery to Simple Log Service log delivery for multiple protected objects.
Configure SLS delivery fields
On the Delivery Settings tab, click Field Settings in the Field of Delivery to Simple Log Service column of the target protected object. Configure the settings as described in the field settings table. After you complete the SLS delivery field settings, click OK. When the The operation is successful. message appears, the settings are applied to the selected protected object.
Configure trace
After you enable trace, WAF operates as an independent node in your end-to-end observability system. The system automatically propagates or generates TraceIDs, connecting WAF security logs with backend application performance data.
Core benefits
Fault isolation: Quickly identify the specific point of failure and clearly distinguish between WAF blocks and backend service timeouts.
Performance analysis: Accurately quantify WAF processing latency and effectively troubleshoot network delays and performance bottlenecks.
Procedure
On the Delivery Settings tab, click Settings in the Tracing Analysis column of the target protected object.
Turn on the Tracing Analysis switch. If you have not activated Managed Service for OpenTelemetry, you cannot use this feature. Activate the service by following the instructions in Activation method.
Configure the following items.
Tracing Analysis Sample Rate: Set the ratio at which WAF delivers data to OpenTelemetry (0.1% to 100%). For production environments, we recommend setting this to 1% to 10% to control costs. When troubleshooting specific issues, you can increase this to 100%.
Cloud Monitor Workspace: Select a CloudMonitor 2.0 workspace that has been created in the China (Hangzhou) region.
The trace feature has the following limitations:
Cloud Monitor Workspace supports only the China (Hangzhou) region.
The storage region of WAF Log Service must be consistent with the CloudMonitor workspace, which means only the China (Hangzhou) region is supported.
Trace is not supported for protected objects configured as How it works with SDK integration (such as ALB, FC domains, or MSE).
Configure external delivery status
For protected objects in a hybrid cloud deployment, you can configure external delivery status to send logs from multiple sources to your unified log management platform for centralized monitoring, analysis, and management. WAF supports delivering hybrid cloud logs to Syslog and Kafka. For detailed instructions, see Create a delivery configuration.
Configure external delivery fields
For protected objects in a hybrid cloud deployment, you can configure external delivery fields to define the Optional Fields and Storage Type for log delivery. For detailed instructions, see Configure log fields for delivery.