Docs

Torch Log Service

DDoS log collection

Collect DDoS logs

This topic introduces an overview of DDoS log features and collection methods.

Features overview

DDoS (Distributed Denial of Service), short for Distributed Denial of Service. A DDoS attack leverages a large number of zombie hosts distributed across diverse geographic locations to send malicious packets to a target server simultaneously. Such attacks clog the target server’s bandwidth resources or exhaust its CPU resources. Ultimately, the attacked server crashes and can not provide normal services.

Volcengine DDoS Protection is a paid service designed to safeguard public IPs for internet businesses against large-scale DDoS attacks that cause service outages. Supports collecting log data from DDoS Protection websites and enables quick business status and protection effectiveness checks through TLS features such as query and analysis, monitoring and alerting, and data visualization for timely exception handling.

The related configuration is as follows:

Configuration	Description
Log type	Anti-DDoS logs.
Log storage location	After enabling the log feature in DDos, TLS automatically creates projects and log topics. For details on managing log resources, see Manage DDoS log resources. Project: adv_antiddos-project-<account_id>-<region> Log topic: adv_antiddos-log
Log storage period	The default value is 180 days.
Log shards	10 shards are preset. Auto split for log topic shards is enabled by default. When the write traffic increases rapidly, shards are split to meet data writing requirements.
Index settings	Indexes are automatically configured and can not be modified.
Log fields	For a detailed list of log fields, see DDoS log fields.

Collect DDoS logs

Usage limits and steps for enabling DDoS log collection in TLS can be found in View and analyze logs.

DDoS log fields

When performing log query and analysis, the involved log fields are divided into required fields and optional fields. Required fields are mandatory fields collected in DDoS Protection log. Optional fields are fields that can be optionally collected in DDoS protection log.

Required fields

Field	Description
Host	The Host field in the client request header. It refers to the accessed domain name.
MatchedHost	The matched Anti-DDoS access domain name. Identifies the triggered protection domain name. This takes effect when forwarding rules for wildcard domains are matched.
RemoteAddr	Client IP.
RemotePort	The port used by the client to initiate access.
Path	The requested relative path. Refers to the part of the requested URL that comes after the domain name and before the question mark (?), excluding the query string.
Method	The request method used by the client.
LogID	A unique identifier generated by DDoS protection for the client request.
Protocol	Access protocols, including HTTP and HTTPS.
XForwardedFor	The X-Forwarded_For (XFF) field in the client request header identifies the original IP address of the client connecting to the server through an HTTP proxy or load balancer.
ContentType	The content type of the request.
Referer	The Referer field in the client request header. Refers to the origin URL of the request. If the request does not include origin URL information, this field displays as an empty string.
UserAgent	The User-Agent field in the client request header contains information such as the client browser identifier and operating system identifier.
Uri	The URI requested by the client, including the parameter section.
Status	The HTTP status code returned by the DDoS protection to the client request. 2XX: Indicates the server has successfully received the request. 3XX: Indicates the client needs further action to complete the request, used for redirection. 4XX: Indicates possible client errors. 5XX: Indicates an error or exception occurred while processing the request on the server.
AttackType	Types of protection rules triggered by attack events. Block: denylist. Geo_block: geographic location blocking. Httpflood: CC attack.
MatchedInfo	The corresponding field value that matches the rule, such as the IP address in a denylist rule or the matched field in the advanced conditions of a CC rule.
UpStreamAddr	The IP address and port of the origin server, formatted as IP:Port.
UpStreamResponseTime	The time the origin server takes to respond to the high-security back-to-origin request, measured in seconds.
UpStreamStatus	The HTTP status code the origin server responds to the high-defense origin request. 2XX: Indicates the server has successfully received the request. 3XX: Indicates the client needs further action to complete the request, used for redirection. 4XX: Indicates possible client errors. 5XX: Indicates an error or exception occurred while processing the request on the server.
Time	The initiation time of the client request, represented according to the ISO 8601 standard. Format: yyyy-mm-ddThh:mm:ss+08:00.
ServerProtocol	Protocol version requested by the user.
RequestBodyType	Request body type, for example: application/x-www-form-urlencoded application/json
ResponseBodyType	Response body type, for example: application/json application/xml
AntiddosAddr	IP address of the Anti-DDoS instance.
ServerPort	Origin port being accessed.
RequestLength	Number of bytes in the request. Unit: Byte.
ActionType	Action taken in response to attack behavior. Observe: Observation. Block: Interception. Captcha: Human verification.

Optional fields

Field	Description
Cookie	Cookie field in the client request header. Refers to the cookie information from the source client.
RuleName	Name of the hit protection rule.
RuleDescription	Description of the hit protection rule.
SSLProtocol	TLS protocol version used by the request. Takes effect when the request protocol is HTTPS.
SSLCipher	The encryption suite requested for use. Takes effect when the request protocol is HTTPS.
TcpinfoRTT	The round-trip time for establishing a TCP connection between the client and the high-defense instance, measured in milliseconds.
UpsConnectTime	Time taken for the Anti‑DDoS instance to establish a TCP connection to the origin server. That is, the time elapsed from when the Anti‑DDoS instance starts connecting to the origin server until it begins sending the HTTP request. Unit: second.
UpsHeaderTime	Time taken for the Anti‑DDoS instance to receive the origin server response headers. That is, the time elapsed from when the Anti‑DDoS instance starts connecting to the origin server until it finishes receiving the origin server’s response headers. Unit: second.
BytesSent	The size of the packet sent by the Anti‑DDoS instance in response to the client request, which is the number of bytes sent to the client. Unit: Byte.
RequestTime	The duration for the Anti‑DDoS instance to respond to client requests, i.e., the time taken to process the request. The time from when the Anti‑DDoS instance receives the first byte of the client request to when it sends the last byte to the client. This includes the time taken for the Anti‑DDoS instance to access the origin server and for the origin server to respond. Unit: seconds.

Last updated: 2026.08.13 11:06:44