About Access Logs

Access logs provide detailed information about requests sent to your load balancers.

By default, access logs are disabled. You can enable or disable them at any time. For more information, see Modifying the Attributes of a Load Balancer.

General Information

Access logs are published in log files stored in an OUTSCALE Object Storage (OOS) bucket. To enable access logs, you need to specify the name of the OOS bucket where the load balancer will publish them. For more information, see About OOS and Modifying the Attributes of a Load Balancer.

The load balancer and the OOS bucket must be located in the same Region, but can belong to different accounts. In that case, you must give the load balancer the rights to access the folder in the OOS bucket. For more information, see Configuring a Bucket ACL.

After you disable access logs, the existing log files remain in the OOS bucket until you delete them. For more information, see Removing Objects from a Bucket.

Log Files

The load balancer publishes one log file in the OOS bucket every 5 or 60 minutes (by default, 60 minutes). You can modify this time span at any time. For more information, see Modifying the Attributes of a Load Balancer.

Log files are automatically named using the following format:

bucket[/prefix]/OWSLogs/account-id/lbu/region/yyyy/mm/dd/account-id_lbu_region_load-balancer-name_end-time_ip-address_random-string.log

This format is composed of the following elements:

bucket: The name of the OOS bucket where the access logs are published.
prefix: The path to the folder in your OOS bucket for the access logs. If not specified, they are published at the root level of your bucket.
account-id: The account ID of the owner of the load balancer.
region: The Region where the load balancer and the OOS bucket are located.
yyyy/mm/dd: The date of the log.
load-balancer-name: The name of the load balancer.
end-time: The date and time when the time span ended. For example, a 20170210T1940Z end time contains log entries from 19:35 to 19:40 if the time span is 5 minutes.
ip-address: The IP of the load balancer that handled the request. For an internal load balancer, its private IP.
random-string: A random string generated by the system.

Log Entries

Inside a log file, each log entry provides information about a single request to the load balancer. This also includes requests that never reached the backend virtual machine (VM), such as malformed requests or requests for which there are no healthy VMs to respond.

Log entries use the following format:

For HTTP and HTTPS

timelog lbu user:port backend:port total_time/request_time/wait_time/connection_time/server_response_time lbu_state_code request_size response_size "request" "user_agent" ssl_cipher ssl_protocol

For TCP and SSL

timelog lbu user:port backend:port total_time/wait_time/connection_time lbu_state_code request_size response_size "request" "user_agent" ssl_cipher ssl_protocol

Fields depend on the routing protocol of the listener (HTTP, HTTPS, TCP, SSL). They are separated by a blank space, except time fields that are separated by a slash bar when they follow one another. For more information, see About Load Balancers.

The following fields are available:

timelog

The date and time when the load balancer received the request from the user (for example 20170210T1940Z).

lbu

The name of the load balancer.

user:port

The IP and port used by the user to connect to the load balancer.

backend:port

The IP and port of the backend VM that processed the request.

This value can be set to:

“–” if the user did not send a full request, and the load balancer thus cannot distribute it to a backend VM.
“-1” if the backend VM does not respond before the idle timeout.

total_time

The total time for the load balancer to handle the request.

This is the time between:

The moment the user sends the request to the load balancer.
The moment the load balancer sends the response back to the user.

request_time

(HTTP listener only) The total time for the load balancer to receive the request from the user.

This is the time between:

The moment the load balancer accepts the user connection.
The moment the load balancer receives the last HTTP header.

This value is set to “-1” if the load balancer never receives the empty line indicating the end of headers. This happens, for example, when the user times out or closes prematurely.

wait_time

The total time for the request to get a connection slot.

This accounts for both backend queue and server queues, and depends on the queue size and the time needed for the server to complete previous requests.

This value is set to “-1” if the request is canceled before reaching the queue.This happens, for example, when the request is invalid or denied.

connection_time

The total time for the load balancer to establish a TCP connection to the backend VM.

This is the time between:

The moment the load balancer sends the connection request, or the TCP SYN packet.
The moment the backend VM accepts the connection request, or sends back the SYN/ACK packet.

This value is set to “-1” if the connection is never established.

server_response_time

(HTTP listener only) The total time for the backend VM to respond.

This is the time between:

The moment the load balancer establishes a TCP connection to the backend VMs.
The moment the backend VM sends its complete response headers.

This value is set to “-1” if the load balancer never receives the empty line indicating the end of the response headers. This happens, for example, when the backend VM times out before processing the request.

lbu_state_code

(HTTP listener only) The HTTP code of the response from the load balancer.

request_size

The size of the request received from the user, in bytes.

This value includes:

(HTTP/HTTPS listener) The request body without the headers.
(TCP/SSL listener) The request body with the headers.

response_size

The size of the response sent to the user, in bytes.

This value includes:

(HTTP/HTTPS listener) The response body without the headers.
(TCP/SSL listener) The response body with the headers.

request

The request from the user, between quotation marks and in the following format:

HTTP Method + Protocol://Host header:port + Path + HTTP version

(TCP listener) The URL is three dashes, each separated by a space, and ending with a space (- - -).

user_agent

(HTTP/HTTPS listener only) A User-Agent string that identifies the requesting user, between quotation marks.

The string contains one or more product identifiers, in the following format: product[/version].

If longer that 8 KiB, it is truncated.

ssl_cipher

(HTTPS/SSL listener only) The SSL cipher.

This value is recorded only if the incoming SSL/TLS connection was established after a successful negotiation. Otherwise, it is set to “-”.

ssl_protocol

(HTTPS/SSL listener only) The SSL protocol.

This value is recorded only if the incoming SSL/TLS connection was established after a successful negotiation. Otherwise, it is set to “-”.

Related Pages