Cloud Firewall:Modify log storage configurations

Configure collected log types

The log analysis feature collects traffic logs of your assets, retrieves and analyzes the collected logs in real time, and displays the results on a dashboard. This allows you to quickly analyze the access patterns and potential attacks of the assets and take effective attack prevention measures.

Supported log types

Cloud Firewall can collect the following types of traffic logs:

• Internet traffic logs

  • Attack event logs: logs of traffic that hits intrusion prevention rules created for the Internet firewall.

  • Access control logs: logs of traffic that hits access control policies created for the Internet firewall.

  • Other traffic logs: logs of other traffic that passes through the Internet firewall.

• VPC traffic logs

  • Attack event logs: logs of traffic that hits intrusion prevention rules created for virtual private cloud (VPC) firewalls.

  • Access control logs: logs of traffic that hits access control policies created for VPC firewalls.

  • Other traffic logs: logs of other traffic that passes through VPC firewalls.

• DNS traffic logs: logs of all traffic that passes through Domain Name System (DNS) firewalls.

• IPv6 traffic logs: logs of traffic that hits IPv6 access control policies created for the Internet firewall.

• NAT traffic logs: logs of all traffic that passes through NAT firewalls.

By default, the switches of all log types are turned on. You can turn off the switches based on your business requirements.

Turn on or turn off a log delivery switch

1. Log on to the Cloud Firewall console.

2. In the left-side navigation pane, choose Log Monitoring > Log Analysis.

3. In the upper-right corner of the page, click Log Delivery to turn on or turn off the switch of a specific log type.

   

Change the log storage region

By default, logs collected by the log analysis feature are stored in the Singapore region. If your services are not deployed in the Singapore region, issues such as additional costs for cross-region log delivery and data connection failures may occur. To avoid such issues, you can change the log storage region to the region where your services are deployed or a region close to the region where your services are deployed.

1. Log on to the Cloud Firewall console.

2. In the left-side navigation pane, choose Log Monitoring > Log Analysis.

3. In the upper-right corner of the page, click Region for Log Delivery to change the region to which logs are delivered.

   

Change the log storage duration

By default, logs are stored for 180 days. Logs that are stored longer than the log storage duration are automatically deleted and cannot be restored. You can change the log storage duration based on the log storage capacity and your business requirements. You can set the log storage duration to 7 to 730 days. If you use Cloud Firewall that uses the pay-as-you-go billing method and you want to restore a larger amount of logs, you can modify the log storage duration in the Simple Log Service console.

1. Log on to the Cloud Firewall console.

2. In the left-side navigation pane, choose Log Monitoring > Log Analysis.

3. In the upper-right corner of the page, click Log Storage Period. In the dialog box that appears, specify a value and click Save.

   

Manage log storage capacity

No limits are imposed on log storage capacity for Cloud Firewall that uses the pay-as-you-go billing method.

If the log storage capacity is exhausted, new logs cannot be written to the dedicated Logstore and the log data is incomplete. To avoid this issue, we recommend that you monitor the usage of log storage on a regular basis.

1. Log on to the Cloud Firewall console.

2. In the left-side navigation pane, choose Log Monitoring > Log Analysis.

3. In the upper-right corner of the Logs page, view the log storage usage.

   The log storage usage that is displayed is not updated in real time and is delayed for 2 hours. We recommend that you increase the log storage capacity or delete logs to release the used storage before the capacity is exhausted.

   

4. Optional. If the capacity is about to be exhausted, increase the log storage capacity or delete existing logs to release the used storage.

   Warning

   You cannot restore logs after the logs are deleted. Proceed with caution.

   • Increase the log storage capacity: In the upper-right corner of the Logs page, click Upgrade Storage. On the page that appears, specify a larger log storage capacity and complete the payment.

     Note

     The fee for additional log storage capacity is USD 80 per 1,000 GB-month. The subscription duration of the log storage capacity varies based on the subscription duration of Cloud Firewall. You cannot modify the subscription duration.

   • Delete existing logs: In the upper-right corner of the Logs page, click Delete All Logs. In the dialog box that appears, click OK. The deletion requires approximately 1 to 2 hours to complete.

     Note

     After you enable the log analysis feature, you can clear the log storage four times. Each time you renew your subscription to Cloud Firewall, the quota to clear the log storage is reset to four times.