Discuss with expertTry it for free
© 2026 Direct Cursus Technology L.L.C.

Configuring logging via Application Load Balancer

Written by
Updated at September 17, 2026
View in Markdown

To write logs, Smart Web Security integrates with Cloud Logging and Audit Trails. They solve different tasks:

  • Cloud Logging: Analyzes HTTP requests and triggered rules in security, WAF, and ARL profiles.
  • Audit Trails: Collects Smart Web Security audit events. These are not full Smart Web Security logs but records of security events and actions with resources.

Audit logs

There are two types of events in Audit Trails:

  • Management events, which include actions related to Yandex Cloud resource configuration, such as creating or deleting a security profile.
  • Data events, which include actions performed on resources within Yandex Cloud services, e.g., triggering a rule from a WAF profile.

You can log events to a bucket in Object Storage, log group in Cloud Logging, or data stream in Data Streams.

Logs of HTTP requests and triggered rules

There are two logging options available: via Smart Web Security and via the Application Load Balancer L7 load balancer the security profile is connected to. Logging via Smart Web Security provides more analysis options than logging via Application Load Balancer. Logs are written to a log group in Cloud Logging.

Log analysis enables you to configure and monitor Smart Web Security performance:

  • Test security rules, WAF, and ARL in Logging only (dry run) mode. In this mode, the system does not block user requests but logs rule matches.
  • View the number of blocked and allowed requests, evaluate and adjust rule performance.
  • View detailed request information and identify false positives.

In some cases, traffic may be blocked during attacks. When this happens, the logs will include the sws_service_rule service rule label.

Working with logs

To get started with Smart Web Security logs:

  1. Enable and set up logging.
  2. View and filter logs.

Enable logging

Note

To manage logging in the L7 load balancer, you need the following roles:

To view logs, you need the logging.viewer role for the log group.

  1. In the management console, select the folder containing the Smart Web Security profile.

  2. Navigate to Application Load Balancer.

  3. In the list, select the load balancer linked to the security profile.

  4. Click and select Edit.

  5. Under Log settings:

    1. Enable Write logs.
    2. Select or create a Cloud Logging log group to store your load balancer logs.
    3. Click Add discard rule and configure its settings.

  6. Click Save.

For other ways to enable logging, see Setting up L7 load balancer logging.

You can log Audit Trails events to an Object Storage bucket, Cloud Logging log group, Data Streams data stream, or EventRouter bus. In this guide, we will set up logging of audit events to a log group.

  1. In the management console, select the folder containing the Smart Web Security profile.
  2. Navigate to Audit Trails.
  3. Click Create trail.
  4. In the Log destination field, select Cloud Logging.
  5. Select a log group or create a new one.
  6. Disable Control plane log collection.
  7. Under Data plane log collection, clear the list and select Smart Web Security.
  8. Under Service account, select an account with the logging.writer role or create a new one.
  9. Under General information, enter a name for the trail, e.g., trail-sws.
  10. Click Create.

The system will log all data events from Smart Web Security in the current folder, ignoring management events.

For other ways to enable event logging, see Creating a trail to upload audit logs.

Viewing logs

  1. In the management console, select the folder containing the Smart Web Security profile.

  2. Navigate to Application Load Balancer.

  3. Select the Logs section.

  4. Select the log display period using one of the following methods:

    • Click the interval, e.g., Last hour, and select one of the options: from Last 5 minutes to Last day.

      You can also select the required dates in the calendar and specify the time in the From and To fields.

    • Select a preset period: Now, 5m, 30m, 1h, 1d, 2d, or specify your own value.

    • On the timeline, move the period start and end indicators.

  5. In the Query row, specify your query using the filter expression language and click Execute query.

    You can find examples of queries below.

  6. To view log details, expand it.

For other ways to view logs, see Viewing L7 load balancer logs and Reading records.

Examples of preset log filters

Logs are delivered in JSON format. A single log entry maps to a single client request to the L7 load balancer.

Requests for log filtering are based on the relationship between Smart Web Security profiles and rules. You can view logs for active, running rules, or rules in Logging only (dry run) mode.

Filters for active rules

  • Show requests blocked by basic rules based on specific conditions, e.g., by IP list or region:

    json_payload.smartwebsecurity.matched_rule.rule_type = RULE_CONDITION and json_payload.smartwebsecurity.matched_rule.verdict = DENY

  • Show requests that have triggered the Smart Protection rules with a CAPTCHA challenge:

    json_payload.smartwebsecurity.matched_rule.rule_type = SMART_PROTECTION and json_payload.smartwebsecurity.matched_rule.verdict = CAPTCHA

  • Show requests blocked based on the WAF profile, i.e., by the security profile WAF rules:

    json_payload.smartwebsecurity.matched_rule.rule_type = WAF and json_payload.smartwebsecurity.matched_rule.verdict = DENY

  • Show requests blocked by the ARL profile rules:

    json_payload.smartwebsecurity.advanced_rate_limiter.verdict = DENY

  • Show requests which triggered a specific ARL rule, arl-rule-1:

    json_payload.smartwebsecurity.advanced_rate_limiter.verdict = DENY and json_payload.smartwebsecurity.advanced_rate_limiter.applied_quota_name = "arl-rule-1"

You can similarly add other conditions to the filters and adjust them to fit your traffic flow.

Filters for rules in logging mode

  • Show requests that have triggered the Smart Protection rules with a CAPTCHA challenge:

    json_payload.smartwebsecurity.dry_run_matched_rule.rule_type = SMART_PROTECTION and json_payload.smartwebsecurity.dry_run_matched_rule.verdict = CAPTCHA

  • View requests that have triggered the ARL rules (limits on requests).

    For the Logging only mode, you cannot use a request filtered by the DENY verdict, because this mode does not block requests. The rule verdict will be ALLOW even after the limit is exceeded. To debug the rules, use the dry_run_exceeded_quota_names parameter. This parameter shows which ARL rules were triggered by the request. If this parameter contains no rules, no limits were exceeded.

    Here is an example of a log fragment with the dry_run_exceeded_quota_names parameter:

    "smartwebsecurity": {
  "advanced_rate_limiter": {
    "applied_quota_name": "",
    "dry_run_exceeded_quota_names": [
      "<rule_name_1>",
      "<rule_name_2>"
    ],
    "profile_id": "<profile_id>",
    "verdict": "ALLOW"
  },

In this fragment, limits were exceeded for the <rule_name_1> and <rule_name_2> rules in the <profile_id> profile.

  1. In the management console, select the folder containing the Smart Web Security profile.

  2. Navigate to Cloud Logging.

  3. Select the log group receiving your Audit Trails events.

  4. Select the log display period using one of the following methods:

    • Click the interval, e.g., Last hour, and select one of the options: from Last 5 minutes to Last day.

      You can also select the required dates in the calendar and specify the time in the From and To fields.

    • Select a preset period: Now, 5m, 30m, 1h, 1d, 2d, or specify your own value.

    • On the timeline, move the period start and end indicators.

  5. In the Query row, specify your query using the filter expression language and click Execute.

    Audit Trails events are written in JSON format. To find a specific event, provide its name in the following format:

    yandex.cloud.audit.smartwebsecurity.<event_name>

    For examples of how to create queries, see Examples of requests for searching events in audit logs.

  6. To view log details, expand it.

For other ways to view logs, see Viewing L7 load balancer logs.

Previous
Configuring logs via Smart Web Security
Next
Migrating to the new condition format in the API, CLI, and Terraform