Advanced Traffic Inspection (Tracking) Logs

What Are Advanced Traffic Inspection (Tracking) Logs?

Advanced Traffic Inspection (Tracking) Logs are the live content of the tracking table created by the Advanced Traffic Inspection action assigned to a vService. The action counts the traffic over the defined period according to the specified keys (by default Client IP); this view shows, row by row, the statistics collected for each key currently tracked in the table.

Each row represents a unique combination of the selected tracking keys (Fields to Track). Each selected key appears as a separate column in the table; for example, if the Source (Client) IP Address, Source (Client) Port and Request Path + Query keys are selected, each row shows a unique combination of these three. Next to these key columns are the counters produced by that combination over the period (HTTP Requests, HTTP Errors, Incoming Data, Outgoing Data, Total Connections, Current Connections). In this way, how much traffic each source generates, the error rate and the connection density are seen at a glance.

This view is the live counterpart of the data used to detect abnormal traffic patterns (DDoS, brute-force, excessive requests) and to trigger actions such as blocking, redirecting or CAPTCHA with Tracking Condition.

Live

Instant counters

Live statistics of each tracked key

Key-Based

IP · UA · Host

Configurable tracking keys

Counters

Requests · data · connections

Metrics collected over the period

Condition Feed

Tracking Condition

Triggers actions on abnormal traffic

HTTP + TCP

Two protocols

Different metrics by protocol

Manageable

Remove from Table

Records can be cleared from the table

Advanced Traffic Inspection (Tracking) Logs are not a recorded history log; they are the current content of the tracking table. Records drop from the table when the period defined in the action expires. The Last Event and Expiry Date information is kept separately for each record (row).

Supported vService Types

HTTP

L7 TCP

Network

How to Enable?

This view does not require a separate enabling; it becomes usable automatically when an Advanced Traffic Inspection action is defined on the vService. The keys the action will track (Fields to Track) and the tracking period (Tracking Period) are determined in the action's own configuration. The maximum number of keys the table can hold is determined by the Max. Table Size field in the same configuration; its default value is 10,000.

Appearance in the drop-down menu

This record source appears in the source list in the Logs & Tracking tab together with the action's name and tracking period, in the <action name> (TRACKING, <period>) format (e.g. bot-tracking (TRACKING, 5m)).

Viewing

1. Left Monitor Panel is opened.
2. Load Balancer vServices is selected from the category tabs at the top left.
3. The vServices defined on TR7 are listed.
4. The vService to be monitored is clicked; the screen opens with the Dashboard tab that carries the vService's name.
5. On the screen that opens, the Logs & Tracking tab is clicked and the (TRACKING, …) entry of the related Advanced Traffic Inspection action is selected.

Advanced Traffic Inspection (Tracking) Logs Listing Screen

When the related tracking source is selected, the current content of the tracking table is listed as a table. The list is fetched once when the screen opens and is not refreshed automatically.

Advanced Traffic Inspection (Tracking) Logs Listing Screen

There are two groups of columns in the table: a key column for each selected Fields to Track key, and the counter columns accumulated by that combination. Below, as an example, the columns of a configuration in which the Source (Client) IP Address, Source (Client) Port and Request Path + Query keys are selected are given:

Column	Description
Last Event	The date and time the key combination was last processed (last event).
Expiry Date	The date on which the record will drop from the tracking table: it is calculated by adding the tracking period to the last event. Since the key combination is refreshed with each new event, this date also moves forward; the record drops only if no event arrives at all during the period.
Source (Client) IP Address (key)	Tracking key; client IP address.
Source (Client) Port (key)	Tracking key; client port.
Request Path + Query (key)	Tracking key; request path and query.
HTTP Requests	The number of HTTP requests received during the period.
HTTP Errors	The number of HTTP errors that occurred during the period.
Incoming Data (B)	The amount of data received during the tracking period. Although the label says bytes, the value is written converted to a readable unit (e.g. 1KB).
Outgoing Data (B)	The amount of data sent during the tracking period. Although the label says bytes, the value is written converted to a readable unit.
Total Connections	The number of connections established during the tracking period. Despite its name, it is not a cumulative total.
Current Connections	The number of currently open connections. It is the only counter that does not depend on the period.

The following column is hidden by default and is added from the column selector:

Column	Description
Source	The name of the TR7 device that holds the record (in cluster setups). It is always present in the preview panel.

INFO

In the list, these columns appear with abbreviated headings: the keys as ↓IP, ↓Port, ↓PathQ; the counters as ↓Request, ↓Request.error, ↓Data / ↑Data, ↓Connection, ↓Connection.current. In the preview panel, they are shown with their full names and their values together with the tracking period (e.g. 2 / 10 minute(s)). The only exception is Current Connections: since it is an instantaneous value, it does not take a period suffix.

INFO

The key columns vary according to the configured Fields to Track values; the three keys above are only an example. The counter columns, on the other hand, vary by protocol: in L7 TCP vServices, the HTTP Requests and HTTP Errors columns are not present; only the data and connection counters are shown.

The items in the toolbar are arranged from left to right in the following order; the last two items (Page Information and Page Size) are located in the information strip below the table.

Columns

Which columns are shown in the table is selected. In the same panel, columns are reordered by dragging and alignment is selected per column; the row height is fitted to the page with the Fit rows to the page button, and the column layout is reset to default with the Reset button. The layout is stored per user.

Logs Type

Determines the source to be viewed. The (TRACKING, …) entry of the related Advanced Traffic Inspection action is selected.

Filter

The Filter button is used to filter the list according to specific criteria. The filter criteria are the tracking keys selected in the action (e.g. ↓IP, ↓Port, ↓PathQ in this configuration).

Export

The table is exported as Excel, CSV or PDF by clicking the Export button. In the window that opens, the Filename, Format and Data Source, together with the Columns to be exported, are determined; the remaining fields are displayed according to the format: CSV Separator for CSV, Excel Sheet Name for Excel, and Page Orientation and Page Size for PDF.

Refresh

The current content of the tracking table is fetched by clicking the Refresh button. Since the list is not refreshed automatically, the current state is obtained with this button. While fetching is in progress, the button stays inactive and shows a spinning icon.

Remove from Table

When one or more rows are selected and the Remove from Table button is clicked, the records accumulated by the related keys are removed from the tracking table. The operation asks for confirmation and cannot be undone; the button is inactive while no row is selected. The trash can in the header of the preview panel does the same job but does not ask for confirmation. The same operation is also available in the right-click menu.

Search

Used to search all information in the table.

RegExp Search

Used to search all information in the table with a regular expression (RegExp).

Column Based Search

Used to perform a column-based search on the information in the table.

Page Information

Contains information about the total number of fetched records and the range of records displayed in the list: Showing N-M of T records and the number of selected rows (N selected, or Nothing selected when there is no selection).

Page Size

The maximum number of records to be displayed on the page is selected. The default is 100; the options are 50, 100, 250 and All. The selection is not stored.

Line Limit is not present in this source

The Line Limit box, which limits the number of records to be scanned, is displayed only in file-based log sources; since the tracking table is read live, it is not present in the toolbar.

Right-Click Menu

When a row is right-clicked, a menu with a single operation opens. The operation applies only to the right-clicked record; a selection made in the list does not affect the menu.

Operation	What it does
Remove from Table	Removes the right-clicked record from the tracking table; like Remove from Table in the toolbar, it asks for Are you sure? confirmation. It is not displayed in the menu while the operation is in progress.

Preview of the Selected Log

When any row in the list is clicked, the preview panel of that record opens. The panel shows the key combination and the counters with their full names one below the other; the counter values are given together with the tracking period (e.g. 2 / 10 minutes).

Preview of the Selected Log

Operations are performed on the record with the icon at the top right of the header:

Operation	What it does
Remove from Table	Removes the record from the tracking table; the counters accumulated by the key combination are reset. Unlike the toolbar and right-click paths, it deletes without asking for confirmation.

Information	Description
Source	The name of the TR7 device that holds the record (in cluster setups).
Last Event	The date and time the key combination was last processed.
Expiry Date	The date on which the record will drop from the tracking table.
Source (Client) IP Address	Tracking key; client IP address.
Source (Client) Port	Tracking key; client port.
Request Path + Query	Tracking key; request path and query.
HTTP Requests	The number of HTTP requests received during the period.
HTTP Errors	The number of HTTP errors that occurred during the period.
Incoming Data (B)	The amount of received data.
Outgoing Data (B)	The amount of sent data.
Total Connections	The total number of connections.
Current Connections	The number of currently open connections.