Docs

Torch Log Service

LLM Application Firewall Service log collection

Collect LLM Application Firewall Service logs

This document describes the features and collection methods related to large model application firewall logs.

Feature overview

The large language model (LLM) application firewall provides security protection services for large language model inference services, ensuring that the input and output content of the model is secure, available, and trustworthy.

The logging feature supports collecting access log data for protected resources added to the large model application firewall and, based on TLS, provides query and analysis, monitoring and alerting, and data visualization capabilities. This helps you quickly understand the status and protection effectiveness of large model applications, so that exceptions can be handled promptly.

The relevant configuration is as follows:

Configuration	Description
Log type	Large model application firewall access logs
Log storage location	When creating an instance in the large model application firewall console, the TLS feature is enabled, and the project and log topic are automatically created. For details on managing log resources, please refer to Manage LLM Application Firewall Service log resources. Project: llmshield-<large model application firewall instance ID> Log topic: llmshield-log
Log storage period	The default is 180 days.
Log shards	10 shards are preset. Auto split of log topic shards is enabled by default. When write traffic is high, shards are split to meet data write requirements.
Index settings	The index is configured automatically.
Log fields	For a detailed list of log fields, please refer to Large model application firewall log fields.

Collect large model application firewall logs

When creating a large model application firewall instance, the TLS feature is enabled, and the system automatically creates the project and log topic.

For usage restrictions, instance creation, and more details, please refer to View and analyze logs.

Large model application firewall log fields

Field	Description
TimestampMS	The timestamp information of the log, unit: milliseconds.
LogType	Type of log: SDK: In SDK access mode, logs of requests sent for inspection with actions of allow, observe, intercept, or desensitize. GENERATE: In SDK access mode, logs of requests with the action of secure answer generation. SESSION: Inspection request logs under traffic access mode. ACL: Request logs intercepted by access control policies under traffic access mode.
AppID	Asset ID information for access.
RequestID	Request ID initiated during invocation.
ClientIP	Client IP of the request.
ClientPort	Port number of the client initiating the request. Only applicable to traffic inspection mode.
Method	Request method. Only applicable to traffic inspection mode.
ServerProtocol	Server protocol version, such as HTTP/1.1, HTTP/2, and more. Only applicable to traffic inspection mode.
Scheme	Request protocol, including HTTP and HTTPS. Only applicable to traffic inspection mode.
Path	Request path. Only applicable to traffic inspection mode.
QueryArgs	Query parameters. Only applicable to traffic inspection mode.
Host	Domain information, which may be a wildcard domain. Only applicable to traffic inspection mode.
MatchedHost	Matched domain information, exact domain. Only applicable to traffic inspection mode.
ContentType	Content type of the HTTP request, such as application/json. Only applicable to traffic inspection mode.
Referer	Source of the request access. Only applicable to traffic inspection mode.
UserAgent	Client device information. Only applicable to traffic inspection mode.
XForwardedFor	Actual client IP address. Only applicable to traffic inspection mode.
Status	Request status code. Only applicable to traffic inspection mode.
Body	Body content of the HTTP request. Only applicable to traffic inspection mode.
ContentLength	Length of the HTTP request. Only applicable to traffic inspection mode.
Content	Details of the content sent for inspection.
Role	Source of the content sent for inspection, used to distinguish content attributes: User: Prompt content entered by the user Assistant: Model response content
Action	Execution action after policy is triggered. pass: Allow block: Block observe: Observe replace: Mask optimize: Safe proxy answer
DecisionResponse	Final execution action after policy is triggered.
DecisionCategory	Type of triggered policy.
DecisionLabelList	List of triggered detection category labels.
RuleIDList	List of triggered rule IDs.
GenerateContent	Content generated by the proxy answer interface.
MsgID	Message ID generated after SDK invocation.
Token	Number of billing units consumed by text content during a single inspection by the large model application firewall.
ImageToken	Number of billing units consumed by image content during a single inspection by the large model application firewall. One image consumes one ImageToken.

Last updated: 2026.02.13 17:22:31