tencent cloud

PrevNext

Feedback

search by keyword

Recent Pages

Documentation
Tencent Cloud EdgeOne
    Documentation
    Download PDF

    Real-time log field Description

    Last updated: 2023-12-05 15:40:41
    Download PDF
      This article introduces the field explanation of site acceleration logs and L4 proxy logs in real-time logs.
      Note:
      When a field has no value:
      If the data type of the field is String and the field has no data, the field value is: "-".
      If the data type of the field is Integer and the field has no data, the field value is: -1.

      Site Acceleration Log

      Name
      Data Type
      Description
      LogTime
      Timestamp ISO8601
      Time when the log is generated
      RequestID
      String
      Unique ID of the client request
      ClientIP
      String
      Client IP
      ClientRegion
      String
      Country/region parsed from the client IP. Format standard: ISO-3166 alpha-2
      ClientState
      String
      The client IP parses out the country's lower-level administrative divisions. Currently only data within mainland China is supported. Format standard: ISO-3166 alpha-2
      ClientISP
      String
      ISP information resolved from client IP.
      Data within mainland China is recorded under the ISP's Chinese name.
      Global Availability Zones (excluding mainland China) data is recorded as Autonomous System Number (ASN)
      RequestTime
      Timestamp ISO8601
      Client request time, time zone: UTC +00:00
      RequestStatus
      Integer
      Status of the client request, if using Websocket protocol, EdgeOne will periodically print logs, this field can be used to determine the connection status. Value options:
      0:Not ended
      1:Request ended normally
      2:Ended abnormally
      RequestHost
      String
      Host of the client request
      RequestBytes
      Integer
      Size of the client request, unit: Byte
      RequestMethod
      String
      HTTP Method of the client request, value options:
      GET
      POST
      HHEAD
      PUT
      DELETE
      CONNECT
      OPTIONS
      TRACE
      PATCH
      RequestSSLProtocol
      String
      SSL (TLS) protocol used by the client, if the value is "-", there is no SSL handshake in the request; value options:
      TLS 1.0
      TLS 1.1
      TLS 1.2
      TLS 1.3
      ClientDeviceType
      String
      Device type of the client request, value options:
      TV
      Tablet
      Mobile
      Desktop
      Other
      RequestUrl
      String
      URL of the client request
      RequestUrlQueryString
      String
      Query parameter carried by the client request URL
      RequestUA
      String
      User-Agent information of the client request
      RequestRange
      String
      Range parameter information of the client request
      RequestReferer
      String
      Referer information of the client request
      RequestProtocol
      String
      Application layer protocol of the client request, value options:
      HTTP/1.0
      HTTP/1.1
      HTTP/2.0
      HTTP/3
      WebSocket
      RemotePort
      Integer
      Port for establishing a connection between the client and the node under the TCP protocol
      EdgeCacheStatus
      String
      Whether the client request hits the node cache, value options:
      hit: Resource provided by the node cache
      miss: Resource can be cached, but provided by the origin
      dynamic: Resource cannot be cached
      EdgeResponseStatusCode
      Integer
      Status code returned by the node response to the client
      EdgeResponseBytes
      Integer
      Size of the node response returned to the client, unit: Byte
      EdgeResponseBodyBytes
      Integer
      Body size of the node response returned to the client, unit: Byte
      EdgeResponseTime
      Integer
      Time consumed from the start of receiving the client request by EdgeOne to the end of the client receiving the server response; unit: ms
      EdgeInternalTime
      Integer
      Time consumed from the start of receiving the client request by EdgeOne to the first byte of the response to the client; unit: ms
      EdgeServerIP
      String
      EdgeOne server IP address obtained by DNS resolution of Host
      EdgeServerID
      String
      Unique identifier of the EdgeOne server accessed by the client
      EdgeSeverRegion
      String
      Country of the responding EdgeOne node IP, format standard reference: ISO-3166 alpha-2
      EdgeEndTime
      Timestamp ISO8601
      Time to complete the response to the client request
      OriginDNSResponseDuration
      Float
      The duration taken to receive the DNS resolution response from the origin server. If there is no return to the origin, it is recorded as -1, unit: ms
      OriginIP
      String
      Origin IP accessed by the origin-pull, if not origin-pull, record as "-"
      OriginRequestHeaderSendDuration
      Float
      The duration taken to send the request header to the origin server is usually 0. If there is no return to the origin, it is recorded as -1, unit: ms
      OriginSSLProtocol
      String
      SSL protocol version used for requesting the origin, if not origin-pull, record as "-"; value options:
      TLS 1.0
      TLS 1.1
      TLS 1.2
      TLS 1.3
      OriginTCPHandshakeDuration
      Float
      Time consumed to complete the TCP handshake when requesting the origin, if not origin-pull, record as "-1", unit: ms; Note: 0 when the connection is reused
      OriginTLSHandshakeDuration
      Float
      Time consumed to complete the TLS handshake when requesting the origin, if not origin-pull, record as "-1", unit: ms; Note: 0 when the connection is reused
      OriginResponseHeaderDuration
      Float
      Time consumed from sending the request header to the origin to receiving the response header from the origin, if not origin-pull, record as "-1", unit: ms
      OriginResponseStatusCode
      Integer
      Origin response status code, if not origin-pull, record as "-1"
      BotClassAttacker
      String
      Risk level of the client IP with attack behavior (such as DDoS, high-frequency malicious requests, site attacks, etc.) based on recent intelligence data, "-" corresponds to no historical data, other value options:
      high: corresponding to high risk
      medium: corresponding to medium risk
      low: corresponding to low risk
      BotClassProxy
      String
      Risk level of the client IP with suspicious proxy ports open and used as network proxies (including Proxy) based on recent intelligence data, "-" corresponds to no historical data, other value options:
      high: corresponding to high risk
      medium: corresponding to medium risk
      low: corresponding to low risk
      BotClassScanner
      String
      Based on recent intelligence data, the risk level of the client IP requesting scans for known vulnerabilities is as follows: "-" corresponds to no historical data, and other values are:
      high: corresponding to high risk
      medium: corresponding to medium risk
      low: corresponding to low risk
      BotClassAccountTakeOver
      String
      Based on recent intelligence data, the risk level of the client IP requesting malicious account cracking and initiating account takeover attacks is as follows: "-" corresponds to no historical data, and other values are:
      high: corresponding to high risk
      medium: corresponding to medium risk
      low: corresponding to low risk
      BotClassMaliciousBot
      String
      Based on recent intelligence data, the risk level of the client IP requesting malicious bots, hotlinking, and brute force cracking behaviors is as follows: "-" corresponds to no historical data, and other values are:
      high: corresponding to high risk
      medium: corresponding to medium risk
      low: corresponding to low risk
      Note：
      In the site acceleration log, using the WebSocket protocol for long connections, EdgeOne will periodically record logs and record a log at the end of the final request. You can identify requests by the RequestID field, and logs with the same RequestID represent the same connection; you can also determine the connection status at the time of log recording through the RequestStatus.

      L4 Proxy Log

      Name
      Data Type
      Description
      ServiceID
      String
      Unique identifier ID for L4 proxy service
      SessionID
      String
      Unique identifier ID for TCP connection or UDP session
      ConnectTimeStamp
      Timestamp ISO8601
      Connection establishment time; default UTC +0 timezone
      DisconnetTimeStamp
      Timestamp ISO8601
      Disconnection time; default UTC +0 timezone
      DisconnetReason
      String
      Disconnection reason;
      Format is "direction: reason"
      Direction values:
      up: origin direction
      down: Client direction
      Reason values:
      net_exception_peer_error: read/write peer returns error
      net_exception_peer_close: peer has closed connection
      create_peer_channel_exception: failed to create channel to next hop
      channel_eof_exception: channel has ended (at the end of the request, the node that ends the request sends channel_eof to the adjacent node to inform that the request has ended)
      net_exception_closed: connection is closed
      net_exception_timeout: read/write timeout
      ClientRealIP
      String
      Client real IP
      ClientRegion
      String
      2-letter country/region code of the client, in accordance with ISO-3166 alpha-2 standard
      EdgeIP
      String
      IP address of the accessed EdgeOne server
      ForwardProtocol
      String
      TCP/UDP forwarding protocol configured by the customer
      ForwardPort
      Integer
      Forwarding port configured by the customer
      SentBytes
      Integer
      Inbound traffic generated from the last log record time to this log record time, unit: Byte
      ReceivedBytes
      Integer
      Outbound traffic generated from the last log record time to this log record time, unit: Byte
      LogTimeStamp
      Timestamp ISO8601
      Log generation time; default UTC +0 timezone
      Note：
      In the case of TCP long connections, EdgeOne will periodically record logs and record the last log when the connection ends. You can determine whether the connection is disconnected by whether the DisconnetReason field is empty; you can also use the SessionID to identify the connection, and logs with the same SessionID record the behavior of the same connection.
      
      Contact Us

      Contact our sales team or business advisors to help your business.

      Contact Us
      Technical Support

      Open a ticket if you're looking for further assistance. Our Ticket is 7x24 avaliable.

      Submit a Ticket
      7x24 Phone Support
      Copyright © 2013-2024 Tencent Cloud. All Rights Reserved.
      Privacy PolicyLegalCookie Policy