Docs

Torch Log Service

WAF log collection

Collect WAF logs

This topic describes the features related to WAF logs and methods for collecting logs.

Features overview

VolcanoEngine Web Application Firewall (WAF) effectively detects malicious patterns in web traffic, cleans and filters the traffic, and returns only normal, secure traffic to the server. It protects the security of your website and data.

The new log management feature supports collecting web attack and access log data from protected resources added to WAF. Based on Volcengine TLS, it offers query and analysis, monitoring and alerting, and data visualization features. These capabilities help you quickly understand the status and protection effectiveness of web request traffic, allowing you to handle exceptions promptly.

The related configuration is as follows:

Configuration	Description
Log type	Web attack and access logs.
Log storage location	After log management is enabled in WAF, TLS will automatically create a log project and log topic. For details on managing log resources, see Manage WAF log resources. Project: tls-waf-project-<account_id>-<region_id> Log topic: waf-log
Log storage period	The default value is 180 days.
Log shards	One shard is preset. Auto split for log topic shards is enabled by default. When the write traffic increases rapidly, shards are split to meet data writing requirements.
Index settings	Configure indexes are automatically configured.
Log fields	For a detailed list of log fields, see WAF log fields.

Collect WAF logs

To view usage restrictions and steps for enabling WAF log collection to TLS, see Viewing and analyzing logs.

WAF log fields

WAF log fields include required and optional fields. Required fields are always included by default, while optional fields depend on your settings. The following describes each field and provides examples.

Required log fields

Field	Description
ActionType	Actions, including: Pass: Allow Permit: Exception Observe: Monitor Block: Block HumanVerify: Human verification HumanVerifyBlock: Human verification - Block JS: JS Challenge JSBlock: JS Challenge - Intercept Pow: Proof of Work PowBlock: Proof of Work - Intercept Drop: Discard AnswerOpt: Answer Optimization
APIID	API asset ID.
APIName	API asset name.
APIStatus	API status, including: pending: API is ready to be discovered. discovering: API is in the discovering state. discovered: API is in the discovered state. managed: API is in the managed state. ignored: API is in the ignored state. discarded: API is in the discarded state.
AttackType	Attack type, including: black: Blocked list geo_black: Geographic location blocking httpflood: CC attack web_vulnerability: Web vulnerability attack bot: custom bot rules bot_frequency: Bot frequency limit bot_repeat: Bot statistics protection bot_dytoken: Bot dynamic token bot_sequence: Bot behavior map route_abnormal: API route exception param_abnormal: API parameter exception api_discarded: API discarded assets api_sensitive: API sensitive information sensitive_info: sensitive information leak
ClientIP	Client IP address.
ClientPort	Port used by the client to initiate access.
ContentType	Requested content type.
EventLevel	Attack event levels, including: 0: Low risk 1: Medium risk 2: High risk
HitInfo	Secondary rule type after matching a protection policy type.
HitField	The statistical object type and corresponding key value for the matched rule, formatted as <statistical object>: <key>. For example: COOKIE: uid HEADER: User-Agent AGRGS: Param1 CLIENTIP (counts based on client IP, no key value)
Host	The Host field in the client request header, i.e., the actual domain accessed by the client.
MatchedHost	The matched WAF access domain. For example, if the access domain is .test.com and the actual visited domain is a.test.com, this field records .test.com.
MatchedInfo	The field value matched by the rule, such as sensitive information (ID number, phone number, etc.) or specific strings for vulnerability rules.
Method	The HTTP request method sent by the client.
Path	The requested relative path refers to the part of the requested URL that follows the domain name and precedes the question mark (?), excluding the query string.
Plugin	Protection strategy type. acl: Access control dlp: Prevent sensitive information leakage api_policy: API protection bot_policy: Bot management cc_policy: cc protection Web policy: Vulnerability protection
PolicyID	Protection rule ID.
QueryArgs	The query string in the client request, specifically the part of the requested URL after the question mark (?).
RequestBodyType	Request body type, such as application/x-www-form-urlencoded or application/json.
ResponseBodyType	Response body type, such as application/json or application/xml.
Referer	The Referer field in the client request header indicates the source URL of the request. If the request does not have a source URL, this field will display as empty.
Scheme	The protocol of the HTTP request, including HTTP and HTTPS.
ServerProtocol	The protocol and version number returned by the origin server in response to the WAF's request.
SensitiveTags	Sensitive information tags.
Status	HTTP status code returned by WAF to client requests, including: 200: Request succeeded 4XX: Request failed
Time	Time when the client request was initiated. Displayed in UTC+8 time zone, format: yyyy-MM-dd HH:mm:ss.
TraceID	Unique identifier generated by WAF for the client request.
UpStreamAddr	IP address and port of the origin server. Format: IP:Port. Records are separated by commas.
UpStreamResponseTime	The time taken by the origin server to respond to a WAF origin request.
UpStreamStatus	The HTTP status code returned by the origin server for a WAF origin request, including custom status codes.
UserAgent	The User-Agent field in the client request header contains information such as the client browser identifier and operating system identifier.
VerificationStatus	Verification result for actions including JS challenge, proof of work, and CAPTCHA. trigger: trigger verification timeout: trigger after timeout ok: verification succeeded pass: verification allowed failed: verification failed block: block after failure skip: observe after failure
XForwardedFor	The X-Forwarded-For (XFF) field in the client request header helps identify the original IP address of a client connecting to a web server through HTTP proxy or load balancing.

Optional log fields

Field	Description
Cookie	The Cookie field in the client request header indicates the Cookie information from the client source.
RequestBody	Request body content.
ResponseBody	Response body content. When the Content-Encoding type is gzip or deflate, WAF logs return the response body content in Base64 encoding. For other Content-Encoding types, the original content is returned.
RuleDescription	Description of the triggered rule. This field currently applies only to access control blacklist rules. For other rule conditions, its value is empty.
RuleName	Name of the matched rule This field currently applies only to access control blacklist rules. For other rule conditions, its value is empty.

Last updated: 2026.08.13 11:08:36