Configuring logging via Application Load Balancer

1. In the management console, select the folder containing the Smart Web Security profile.
2. Select Application Load Balancer.
3. In the list, select the load balancer linked to the security profile.
4. Click and select Edit.
5. Under Log settings:
   1. Enable Write logs.
   2. Select or create a Cloud Logging log group to store your load balancer logs.
   3. Click Add discard rule and configure its settings.
6. Click Save.

For other ways to enable logging, see Setting up L7 load balancer logging.

1. In the management console, select the folder containing the Smart Web Security profile.

2. Select Application Load Balancer.

3. Go to the Logs section.

4. Select the number of messages per page and the time interval: 1 hour, 3 hours, 1 day, 1 week, 2 weeks.

5. In the Query row, specify you query using the filter expression language and click Run.

   You can find examples of queries below.

6. To view log details, expand it.

For other ways to view logs, see Viewing L7 load balancer logs and Reading records.

Examples of preset log filtersExamples of preset log filters

Logs are delivered in JSON format. A single log entry maps to a single client request to the L7 load balancer.

Requests for log filtering are based on the relationship between Smart Web Security profiles and rules. You can view logs for active, running rules, or rules in Logging only (dry run) mode.

Filters for active rulesFilters for active rules

• Show requests blocked by basic rules based on specific conditions, e.g., by IP list or region:

  json_payload.smartwebsecurity.matched_rule.rule_type = RULE_CONDITION and json_payload.smartwebsecurity.matched_rule.verdict = DENY
  

• Show requests that have triggered the Smart Protection rules with a CAPTCHA challenge:

  json_payload.smartwebsecurity.matched_rule.rule_type = SMART_PROTECTION and json_payload.smartwebsecurity.matched_rule.verdict = CAPTCHA
  

• Show requests blocked based on the WAF profile, i.e., by the security profile WAF rules:

  json_payload.smartwebsecurity.matched_rule.rule_type = WAF and json_payload.smartwebsecurity.matched_rule.verdict = DENY
  

• Show requests blocked by the ARL profile rules:

  json_payload.smartwebsecurity.advanced_rate_limiter.verdict = DENY
  

• Show requests which triggered a specific ARL rule, arl-rule-1:

  json_payload.smartwebsecurity.advanced_rate_limiter.verdict = DENY and json_payload.smartwebsecurity.advanced_rate_limiter.applied_quota_name = "arl-rule-1"
  

You can similarly add other conditions to the filters and adjust them to fit your traffic flow.

Filters for rules in logging modeFilters for rules in logging mode

• Show requests that have triggered the Smart Protection rules with a CAPTCHA challenge:

  json_payload.smartwebsecurity.dry_run_matched_rule.rule_type = SMART_PROTECTION and json_payload.smartwebsecurity.dry_run_matched_rule.verdict = CAPTCHA
  

• View requests that have triggered the ARL rules (limits on requests).

  For the Logging only mode, you cannot use a request filtered by the DENY verdict, because this mode does not block requests. The rule verdict will be ALLOW even after the limit is exceeded. To debug the rules, use the dry_run_exceeded_quota_names parameter. This parameter shows which ARL rules were triggered by the request. If this parameter contains no rules, no limits were exceeded.

  Here is an example of a log fragment with the dry_run_exceeded_quota_names parameter:

  "smartwebsecurity": {
    "advanced_rate_limiter": {
      "applied_quota_name": "",
      "dry_run_exceeded_quota_names": [
        "<rule_name_1>",
        "<rule_name_2>"
      ],
      "profile_id": "<profile_id>",
      "verdict": "ALLOW"
    },
  

In this fragment, limits were exceeded for the <rule_name_1> and <rule_name_2> rules in the <profile_id> profile.