HTTP Logs

What Are HTTP Logs?

HTTP Logs are the standard access log that keeps every HTTP request coming to a vService and the returned response as single-line records. Each record represents one request/response transaction and contains the client information, the requested host and path, the HTTP method, the returned status code, the Backend Service that produced the response, the TLS version and the amount of transferred data.

HTTP Logs are the core visibility layer that gives instant answers to the questions "who requested what, when, and which response did they receive?" about the traffic on a vService. They are the first source consulted to monitor traffic, catch errors (4xx / 5xx), see the most requested content and examine security events.

When a Log profile is assigned, these records can also be forwarded to external log systems (syslog / SIEM) in standard formats (Apache, CEF, JSON, etc.); in this way, central log collection and long-term retention become possible.

Access Log

Standard access log

Each HTTP request/response on a single line

End to End

Client → Backend

Connection, host, path and response information

Visibility

Traffic insight

Who received which response, and when

SIEM

To external systems

Forwarding to syslog with a Log profile

Filtered

Fast analysis

Country, status code, host and method criteria

Load Balancer

Part of the product

Enabled separately for every vService

HTTP Logs form the basis of Debug Logs: Debug Mode adds deep diagnostic information in addition to every field the HTTP log keeps. HTTP Logs are used for daily monitoring and traffic visibility, and Debug Logs for deep troubleshooting. HTTP Logs are a part of the Load Balancer module and are enabled separately for every vService.

Supported vService Types

HTTP

L7 TCP

Network

How Are HTTP Logs Enabled?

HTTP Logs start being produced when a Log Profile is assigned to the vService. The Log profile is enabled from the LOG field in the Details panel of the vService form, and a profile is selected. It is off by default; when it is enabled, the default (Default) Log profile comes selected.

How Are HTTP Logs Enabled?

Default Log Profile

When the Default Log profile is assigned, no sending to external log systems (syslog / SIEM) takes place; only HTTP Logs are enabled for the related vService. The records are kept on TR7 and are viewed from the Logs & Tracking tab. For external forwarding, target Log addresses must be defined in the Log profile.

1

Step 1 The vService edit form is opened

The edit form of the related HTTP vService is opened by following the Load Balancer → Load Balancer vService List path.

2

Step 2 LOG is enabled from the Details panel

The Details panel is opened in the vService form, the LOG field is enabled and the Log profile to be applied is selected.

3

Step 3 The change is saved

When the form is saved, an HTTP Log is created for each HTTP request coming to the vService.

How long records are kept

There is no adjustable retention period for HTTP Logs; records are limited by a disk budget of 256 MB per vService. Files rotate by size, not by time: each engine thread keeps its own file pair; when a file reaches the limit allotted to it, it is handed over to its backup and the previous backup file is deleted entirely. For this reason, the viewable history varies between half and all of the budget.

In a vService with heavy traffic, the same budget covers a shorter time range. If long-term retention is needed, the records must be forwarded to an external log server with a log profile.

Log Profile and External Forwarding

The Log profile configures not only the keeping of records but also their forwarding to external log servers (syslog): the target Log addresses (IP or domain name, together with the port), the Log standard (RFC 3164 / RFC 5424, etc.), the line format (Apache, CEF, TR7 JSON, etc.) and the sampling settings are defined in the Log profile. Details are located on the Logs page.

Viewing HTTP Logs

1. Left Monitor Panel is opened.
2. Load Balancer vServices is selected from the category tabs at the top left.
3. The vServices defined on TR7 are listed.
4. The vService to be monitored is clicked; the screen opens with the Dashboard tab that carries the vService's name.
5. On the screen that opens, the Logs & Tracking tab is clicked and HTTP Logs is selected.

HTTP Logs Listing Screen

When the HTTP Logs source is selected in the Logs & Tracking tab, the records are listed as a table. When the screen opens, the records are fetched automatically if the vService is in the enabled state; when the log source is changed, the fetch is renewed. Filter selections are applied to the fetched records and do not start a new fetch.

HTTP Logs Listing Screen

The table opens with the following columns by default:

Column	Description
Date	The date and time the record was created. Seconds are not shown in the table; the full value with millisecond precision is located in the preview panel.
Connection Info	The address information (IP:port) and country flag of the client that established the connection. The full connection chain is shown in the preview panel.
Location	The client's geographic location (city, country; e.g. Ankara, Turkey).
User-Agent	The client application that sent the request (browser/client information).
Request	The request line; method, HTTP version and full URL.
Response	The response status; HTTP status code and its description.

The Source column is hidden by default and is added from the column selector; it shows the name of the device that produced the record and is meaningful only in cluster setups.

The items in the toolbar are arranged from left to right in the following order; the last two items (Page Information and Page Size) are located in the information strip below the table.

Columns

Which columns are shown in the table is selected. In the same panel, columns are reordered by dragging and alignment is selected per column; the row height is fitted to the page with the Fit rows to the page button, and the column layout is reset to default with the Reset button. The layout is stored per user.

Logs Type

Determines the log source to be listed. HTTP Logs is selected to view HTTP Logs. The selector is populated according to the vService's configuration and leaves out the WAF and Bot/DDoS sources.

Line Limit

Determines at most how many records are scanned from the source. An integer between 1 and 50000 is entered; the default value is 1000. The selection is stored per user and also applies to the other vService log screens opened by the same user (including Debug Mode Logs and WAF logs). When the value is changed, the records are not fetched again automatically; Refresh is required for the new value to be applied.

Filter

Opens and closes the filter panel; the panel comes open by default. While the panel is open, the filters are listed above the table as a strip of cards, and the number next to a card shows how many distinct values that filter carries in the fetched records. When a card is clicked, the values of that filter open as chips; the number next to each chip is the number of records carrying that value, and when a chip is selected, the table is narrowed to that value.

Filters that come open by default:

Filter	Description
Status Class	HTTP response status class (2xx, 3xx, 4xx, 5xx).
Status Code	HTTP response status code (200, 404, 503, etc.).
Method	HTTP method (GET, POST, PUT, DELETE, etc.).
Country	The country the request came from.
IP Tags	The IP Tags that match the client address; untagged addresses are collected under the No Tags option.
Client IP	The IP address of the client that sent the request.
Host	The host (domain name) the request is directed to.
Backend Service	The Backend Service that answered the request.
Response Source	The source of the response (Backend Service, cache, TR7, etc.).
Browser	The client browser.
Operating System	The client operating system.
Device Type	The client device type (desktop, mobile, tablet, etc.).
Browser Version	The client browser version.

The following filters are hidden by default and are added from the filter manager:

Filter	Description
Backend Group	The Backend Group the request was distributed to.
TLS Version	The TLS version of the connection (TLS 1.2, TLS 1.3, etc.). Connections that do not use TLS are grouped as Plain HTTP.
HTTP Version	The HTTP version of the request (HTTP/1.1, HTTP/2, etc.).
Path	The request path (URL path).

Which filters are shown, their order and their appearance can be arranged as needed.

Filters specific to Debug Mode

The Security Action, Termination State, Retries and X-Forwarded-For filters are not present in this source; they are located only in Debug Logs.

Export

The table is exported as Excel, CSV or PDF by clicking the Export button. In the window that opens, the Filename, Format and Data Source, together with the Columns to be exported, are determined; the remaining fields are displayed according to the format: CSV Separator for CSV, Excel Sheet Name for Excel, and Page Orientation and Page Size for PDF.

Refresh

The records are fetched again by clicking the Refresh button. Since filter selections work only on the fetched records, this button is the way to get up-to-date records from the server and to apply a changed Line Limit value. While fetching is in progress, the button stays inactive and shows a spinning icon; if the vService is stopped, the button stays inactive.

Search

Used to search all information in the table.

RegExp Search

Used to search all information in the table with a regular expression (RegExp).

Column Based Search

Used to perform a column-based search on the information in the table.

Page Information

Contains information about the total number of fetched records and the range of records displayed in the list: Showing N-M of T records. Since rows cannot be selected in this source, the number of selected rows is not shown.

Page Size

The maximum number of records to be displayed on the page is selected. The default is 100; the options are 50, 100, 250 and All. The selection is not stored.

Preview of the Selected Log

When any record in the list is clicked, a preview panel of that request opens on the screen. The panel consists of three tabs: Summary, Request (request side) and Response (response side). The HTTP Logs preview is simpler compared to the Debug Logs preview: header lists (Header Info), body content, cookies, performance counters and the certificate breakdown are collected only in Debug Mode. Rows without information are not displayed at all.

Summary Tab

Gathers the summary information of the request and the response in a single list.

Preview: Summary

Information	Description
Request	The summary of the request; method, HTTP version and full URL (e.g. GET HTTP/1.1 https://test.tr7.com/).
Response	The HTTP status of the response (e.g. 200: OK).
Date	The date and time the request was processed (with millisecond information).
Request ID	The unique identifier assigned to the request. Used to match the same request across different records. If the record has no identifier, the row is not displayed at all.
Client IP	The IP address and country flag of the client that sent the request. Quick operations for this address are performed from the Actions menu next to it.
Connection Info	The connection chain; source/destination IP and port information. CLIENT IP→TR7 vService IP→Backend Service IP:Port
Location	The client's geographic location (city, country; e.g. Ankara, Turkey).
User-Agent	The client application / browser information that sent the request.
Size Info	The transferred data size; the amount of data received from the client (↑) and sent to the client (↓).
Response Source	The source that produced the response; which Backend Service answered the request and the distribution it is bound to (e.g. Default Backend Services).

Request Tab

Shows the details of the request (client → TR7 direction).

Preview: Request

Information	Description
SSL Info	The TLS details of the connection; Version Number (TLS version) and Cipher (cipher suite). The detailed breakdown of the certificates (SSL CDN/IDN, key and signature algorithm, validity dates) is located only in Debug Logs.
Size Info	Uploaded: the amount of data received from the client.

Response Tab

Shows the details of the response (TR7 → client direction).

Preview: Response

Information	Description
Size Info	Downloaded: the amount of data sent to the client.