By analyzing access logs, you can view utilization and performance of your websites, applications, content, and hardware/software resources. They can also help you analyze or debug new or errant functionality. Response times, resource usage, traffic, trending, geographic patterns, errors and a wealth of available information can be derived from the access logs generated by the CDN edge servers. The volume of log data generated by high request-rate properties can be extremely large, so you'll want to plan carefully and consider the resources required to retrieve and analyze the data.
Lumen provides two methods for delivery of log information. Typically, logs are delivered from the edge to you within five minutes.
These can commonly appear inside URL query strings or HTML parts sent through the log streaming system:
-- “/example?key=value&hello=world” becomes “/example?key=value\u0026hello=world”
-- “<b>hello world!<\b>” becomes “\u003cb\u003ehello world! \u003c\b\u003e”
The following fields are included in the default configuration for log delivery:
|date||<date>||2017-07-09||Date transaction completed|
|time||<time>||23:27:35:142||Time transaction completed, HH is the hour in 24-hour format|
IPv6: xxxx:xxxx:xxxx:xxxx: xxxx:xxxx:xxxx:xxxx
|IPv4 or IPv6 address of the requesting client, in dot notation|
|cs-method||<string>||get||Method (e.g., get, head) in client request|
|cs-uri||<string>||/test||Path fragment of URI|
|status||<integer>||200||HTTP status code returned to the client, expressed as a single integer
Note: legacy name of this field was 'sc status'.
|sc-bytes||<integer>||1953||Number of bytes returned in response to request (including headers), expressed as a single integer|
|time-taken||<float>||0.106||Time taken for transaction to complete (in seconds)
|cs(Referer)||<string>||-||Contents of referrer request header|
|cs(User-Agent)||<string>||urlgrabber/3.1.0 yum/3.2.22||Contents of user agent request header|
|cs(Cookie)||<string>||-||Content of all cookie headers presented
|x-disid||<integer>||2037223||ID of distributor delivering request|
|x-headersize||<integer>||301||Size of response header in bytes|
||Indicates whether the object was served from cache or filled. The status will be either 0 (miss) or 1 (hit)
Note: legacy name of this field was 'cache'
|cs(Range)||<string>||"bytes=0-123456"||Contents of the range header
Note: legacy name of the field was 'x-range'
|x-tcwait||<integer>||567||Time (ms) spent waiting for the client to be ready—i.e. data was available to be sent, but the socket to the client was full|
|x-tcpinfo_rtt||<integer>||678||Smoothed RTT in usecs|
|x-tcpinfo_rttvar||<integer>||789||RTT variance in usecs|
|x-tcpinfo_snd_cwnd||<integer>||890||Send congestion window|
|x-tcpinfo_rcv_space||<integer>||901||Advertised recv window|
|x-tdwait||<float>||0.222||Time (ms) spent waiting for the upstream to send data
|sc(Content Type)||<string>||"what did I just get"||Contents of the content-type header
|cs-version||<string>||"HTTP/1.0"||The HTTP version (e.g., HTTP/1.1, h2)|
The following fields are optional. They're not included in the default configuration, but you can request that Lumen include them in your configuration:
||"http"||The scheme that the client request was made for, commonly http or https.|
|cs-host||<string>||"hello.world.com"||The host of the client's request.|
|c-asn||<integer>||432||The client ASN as determined from a lookup of the client IP in an online GeoIP database. If unable to determine the value, the system will return zero.|
|c-city||<string>||"Denver"||The client city as determined from a lookup of the client IP in an online GeoIP database. The city name is provided in all lower case. If unable to determine the value, the system will return "unknown".|
|c-state||<string>||"CO"||The client state as determined from a lookup of the client IP in an online GeoIP database. The state is provided in an all lower-case full state name and is used for other regional identifies outside of the United States for example, provinces and territories. If unable to determine the value, the system will return "unknown".|
|c-cc||<string>||"US"||The client country code as determined from a lookup of the client IP in an online GeoIP database. This field follows the ISO 3166-1 alpha-2 standard for two letter country codes. If unable to determine the value, the system will return an empty string.|
|x-extras||<JSON key value>||"freeform-key":||A freeform set of key value pairs of extra information that can be custom defined. All additional keys must be unique.
Note: This field can ONLY be enabled for JSON format.
The following fields have been deprecated. Lumen will only provide these to you if you were previously configured to receive these fields:
||All logs will contain the default value of -.
||-||All logs will contain the default value of -.|
||0||All logs will contain the default value of 0.|
CDN Log Streaming is a billable service and can be activated by the Lumen Service Activations team once we receive your signed order. Log collection and delivery can be enabled for one or more (or all) primary aliases under a given account as determined by you upon initial configuration.
If your peak volume is >50,000 requests/second, you need special approval before activating Log Streaming so we can scale the solution to meet your needs. Contact your Lumen representative and they will work with our internal teams to review your needs.
Log Streaming delivery format is directly tied to the JSON message format. File Delivery format is directly tied to the W3C message format.