Download standard logs - Edge Security Acceleration - Alibaba Cloud Documentation Center

Edge Security Acceleration (ESA) offers standard logs that are packaged on an hourly basis. You can download access logs of your website within the last 31 days to your local PC. Standard logs can help you optimize acceleration policies, monitor your website, detect potential risks, and learn user behavior.

Usage notes

Standard logs are collected from global ESA points of presence (POPs). You may need to wait for 6 to 8 hours before you can view such logs in the ESA console. Each line on the Standard Logs page represents a complete log package generated within the specified period of time. You can download your desired log package to your local PC.
The following types of standard logs are supported: Access Log and TCP/UDP Proxy Log. By default, standard logs are packaged on an hourly basis. If your website has no visitors within an hour, no log packages are generated during that time frame.
Standard logs are packaged in the .gz format by using gzip. They are named in the following format: websiteName_Year_Month_Day_startTime_endTime.xx.gz. Example: aliyundoc.com_2024_01_01_000000_010000.xx.gz.

Download a standard log

Log on to the ESA console.
In the left-side navigation pane, click Websites.
On the Websites page, find the website that you want to manage, and click the website name or View Details in the Actions column.
In the left-side navigation tree, choose Analytics and Logs > Standard Logs.
On the Standard Logs page, specify the start time, end time, and log category, and then click Search.
Find the desired log package and click Download in the Actions column.

Log fields

Access log fields

Field	Type	Description
ClientRequestID	string	The unique identifier of the request.
EdgeServerID	string	The unique identifier of the ESA POP that the client accesses.
EdgeServerIP	string	The IP address of the ESA POP.
EdgeStartTimestamp	Timestamp ISO8601	The timestamp when the ESA POP receives the request. Example: 2024-01-01T00:00:00+08:00.
ClientASN	string	The autonomous system number (ASN) parsed from the client IP address.
SiteName	string	The website name.
ClientIP	string	The IP address of the client that is used to establish a connection with the ESA POP.
ClientISP	string	The Internet service provider (ISP) information parsed from the client IP address.
ClientRegionCode	string	The ISO-3166-2 code parsed from the client IP address.
ClientSrcPort	int	The port used to establish a connection between the client and the ESA POP.
ClientCountryCode	string	The ISO-3166 Alpha-2 code parsed from the client IP address.
ClientRequestBytes	int	The request size. Unit: bytes.
ClientRequestHeaderRange	string	The Range request header. Example: bytes=0-100.
ClientRequestHost	string	The Host requested by the client.
ClientRequestMethod	string	The HTTP method used by the request.
ClientRequestProtocol	string	The protocol used by the request.
ClientRequestReferer	string	The Referer in the request.
ClientRequestURI	string	The request URI.
ClientRequestUserAgent	string	The User-Agent in the request.
EdgeCacheStatus	string	The cache status of the request.
EdgeResponseBodyBytes	int	The size of the response body that the ESA POP returns to the client. Unit: bytes.
EdgeResponseBytes	int	The size of the response that the ESA POP returns to the client. Unit: bytes.
EdgeResponseStatusCode	int	The status code that the ESA POP returns to the client.
EdgeTimeToFirstByteMs	int	The period of time that elapses from when the ESA POP receives the client request to when the ESA POP returns the first byte of the response to the client. Unit: ms.
ClientRequestScheme	string	The Scheme in the request.

TCP/UDP proxy logs

Field	Type	Description
BlockRuleID	string	The ID of the rule that is triggered to block requests. If this field is left empty, no requests are blocked.
ClientASN	string	The ASN parsed from the client IP address.
ClientBytes	int	The volume of data received from the client. Unit: bytes.
ClientCountryCode	string	The ISO-3166 Alpha-2 code parsed from the client IP address.
ClientIP	string	The IP address of the client that is used to establish a connection with the ESA POP.
ClientISP	string	The ISP information parsed from the client IP address.
ClientMatchedIpFirewall	string	The type of the matched IP access rule.
ClientPort	int	The port of the client.
ClientProto	string	The transmission protocol used by the client.
ConnectTimeStamp	Timestamp ISO8601	The timestamp when the client connected to the ESA POP. Example: 2024-01-01T00:00:00+08:00.
DisconnetTimeStamp	Timestamp ISO8601	The timestamp when the client disconnected from the ESA POP. Example: 2024-01-01T00:00:00+08:00.
DomainName	string	The domain name for which you add an application for TCP/UDP acceleration.
EdgeServerIP	string	The IP address of the ESA POP.
IpFirewall	bool	Indicates whether the IP access rule is enabled.
LogTimeStamp	Timestamp ISO8601	The timestamp when the log was generated. Example: 2024-01-01T00:00:00+08:00.
OriginBytes	int	The volume of data received from the origin server. Unit: bytes.
OriginIP	string	The IP address of the origin server.
OriginPort	int	The port of the origin server.
OriginProto	string	The transmission protocol used by the origin server.
ProxyProtocol	string	The version of the proxy protocol. Valid values: off, v1, and v2.
SessionID	string	The globally unique session ID.
Status	int	The status code that is returned when a session ends.
SiteName	string	The website name.