After you enable the Log Service for WAF feature, you can modify log settings, such as the storage period, log fields, and log type, on the Log Settings page. The log types are Full Logs and Block Logs. To better utilize your log storage capacity, we recommend that you modify log settings based on your business protection and analysis requirements and classified protection requirements.

Background information

Log settings take effect for all domain names for which log collection is enabled. For more information about how to enable log collection for a domain name, see Get started with the Log Service for WAF feature.

Prerequisites

The Log Service for WAF feature is enabled. For more information, see Get started with the Log Service for WAF feature.

Procedure

  1. Log on to the WAF console. In the top navigation bar, select the resource group and the region to which your WAF instance belongs. The region can be Chinese Mainland or Outside Chinese Mainland.
  2. In the left-side navigation pane, choose Log Management > Log Service.
  3. In the upper-right corner of the Log Service page, click Log Settings. Configure the following parameters and click Save.
    Parameter Description
    Storage Period The storage period of logs. Unit: days. Default value: 180. Valid values: 15 to 360.
    Custom Field Configuration The log fields that are supported by WAF and included in logs.

    WAF log fields can be categorized into Required Fields and Optional Fields. Required fields must be included in WAF logs and cannot be modified. You can include optional fields in WAF logs based on your business requirements. For more information about WAF log fields, see Log fields supported by WAF.

    To include optional fields in WAF logs, perform the following operations: In the Optional Fields section, select the optional fields in the Available Fields section and click the rightwards arrow to add the selected fields to the Selected Fields section.

    Log Type The type of log that you want to store. Valid values:
    • Full Logs: All logs are stored, including the logs that are generated when WAF allows and blocks requests.
    • Block Logs: Only the logs that are generated when WAF blocks requests are stored.

Result

After you modify the log settings, the Log Service for WAF feature stores logs based on the settings that you configure.