Docs

Torch Log Service

CFW log collection

Collect CFW logs

This topic describes the features related to CFW logs and methods for collecting logs.

Features overview

VolcEngine Cloud Firewall (CFW) is a cloud-native network security product that provides protection for cloud edge boundaries. It offers internet boundary defense, VPC edge protection, unified security access control between cloud and on-premises environments, traffic visibility, and log auditing. CFW is an essential and foundational network security facility for migrating your business to the cloud.

The log management feature collects attack and access log data from cloud firewall resources. It provides query and analysis, monitoring and alerting, and data visualization functions through TLS, helping you quickly understand the status of request services and protection effectiveness for timely exception handling.

Access control logs: Cloud Firewall supports 180 days of rule hit log recording. It records all logs that match access control policies to assist with auditing and post-incident investigation and traceability.

Traffic logs: Cloud Firewall supports detailed logging of all traffic for up to 180 days, automatically collecting and storing logs for inbound and outbound internet traffic to support security analysis.

The related configuration is as follows:

Configuration	Description
Log type	CFW access control logs. CFW traffic logs.
Log storage location	After enabling log management in CFW, TLS automatically creates log projects and log topics. For details on managing log resources, see Manage CFW log resources. Project: fw-project-<account_id>-<region_id> Log topic: fw-log
Log storage period	The default value is 180 days.
Log shards	One shard is preset. Auto split for log topic shards is enabled by default. When the write traffic increases rapidly, shards are split to meet data writing requirements.
Index settings	Indexes are automatically configured and can not be modified.
Log fields	For a detailed list of log fields, see CFW log fields.

Collect CFW logs

For usage limitations and steps on enabling CFW log collection to TLS, see View and analyze logs.

CFW log fields

Cloud Firewall provides detailed network traffic logs and access control logs. The logs contain multiple fields. You can select the relevant log fields as needed for query and analysis.

Log fields	Description
timestamp	Log generation timestamp.
log_type	Log type. Possible values: session: Internet boundary traffic log. acl: Internet boundary access control log. ips: Internet boundary intrusion prevention log. vpc_session: VPC boundary traffic log. vpc_acl: VPC boundary access control log. vpc_ips: VPC boundary intrusion prevention log. nat_session: NAT boundary traffic log. nat_acl: NAT boundary access control log. nat_ips: NAT boundary intrusion prevention log.
begin_time_us	Session start timestamp.
end_time_us	Session end timestamp.
duration	Session duration. Unit: second.
src_ip	Source IP.
src_port	Source port.
dst_ip	Target IP.
dst_port	Target port.
protocol	Protocol type. Values: TCP, UDP, ICMP.
host	The requested domain.
dir_flag	Internet boundary traffic direction. Values: in: Inbound. Indicates traffic from external internet resources or other intranet ECS instances accessing your ECS server. out: Outbound. Indicates traffic initiated by your ECS server to access external internet resources or other intranet ECS instances. intranet: Intranet. Indicates that your ECS server accesses other ECS instances within the intranet.
in_pkts	Number of inbound packets.
in_bytes	Inbound packet size (unit: Byte).
out_pkts	Number of outbound packets.
out_bytes	Outgoing packet size (unit: Byte).
ip_severity	IP threat level. Values: 0: Unknown 3: Low risk 4: Medium risk 5: High risk
host_severity	Host threat level. Values: 0: Unknown 3: Low risk 4: Medium risk 5: High risk
rule_id	ID of the matched rule.
prio_id	Priority rule ID when matched.
hit_time_us	Timestamp when the rule is matched.
action	Action type. Options: accept: allow deny: block monitor: observe
vpc_firewall_id	VPC boundary firewall ID.
src_vpc	Source VPC ID (only for VPC boundary firewall).
dst_vpc	Destination VPC ID (only for VPC boundary firewall).
nat_firewall_id	NAT boundary firewall ID.
ips_threat_name	Name of the matched intrusion prevention rule (Chinese).
ips_threat_name_en	Name of the matched intrusion prevention rule (English).
ips_threat_type	Type of the matched intrusion prevention rule (Chinese).
ips_threat_type_en	Type of the matched intrusion prevention rule (English).
ips_module	Triggered intrusion prevention module: BasicDefense: Basic protection VirtualPatch: Virtual patch ThreatIntelligence: Threat intelligence IntelligentDefense: Intelligent defense
ips_risk_level	Risk Level: 1: Low risk 2: Medium risk 3: High risk 4: Critical
ips_rule_sid	ID of the matched intrusion prevention rule.
payload	Payload triggered by intrusion prevention rules.

Last updated: 2026.06.16 14:04:24