Raw access logs are available for customers who would like granular details about the end-user request for CDN content. Every hit to the CDN is reported in the Raw Logs. Raw Logs are a premium service and are enabled at the Account Services level, and then enabled for each host within the account. Logs enable custom reporting as well as visibility to details such as User-Agent, Requestor IP address, Status Code, and Path to Content delivered.
The raw log storage area is accessed via FTP using your StrikeTracker login credentials. The FTP hostname for raw logs is:
Users should log in using their StrikeTracker password, with the username of the following format:
Where username is your StrikeTracker username, and host hash is the 8-character alphanumeric hash of the host for the logs which you wish to access. For instance, if your StrikeTracker username was
firstname.lastname@example.org, and you had a host with the hash of
q2w3e4r5, you would enter the following username when prompted by the FTP server:
Your password would be your StrikeTracker password.
Please note that at this time, downloading the raw logs for multiple hosts via a single FTP login is not supported. If you require the raw logs for multiple hostnames to be combined into a single set of raw logs, you must do so by using a single host for delivery and configuring multiple virtual hosts on that StrikeTracker host (typically configured with multiple scopes within the host).
Note: Access to the FTP space is granted after raw logs are enabled and after delivery has occurred on the account. Your credentials will not function prior to the first raw log being generated.
Log File Naming Conventions
After you have logged in to the raw log FTP access area, you will see a series of folders containing the raw logs. Logs are nested in directories representing dates. Directory naming convention is [product]/YYYY/MM/DD/, where the days are defined by GMT timezones.
Within each daily folder, you will see one or more logs with the naming convention of:
Note that the HH-MM portion is in the GMT timezone. For example:
The delivery timestamp shown within the log is also GMT and represents when the delivery request is complete (end-user disconnects or full file is delivered).
Multiple separate logs may be generated for each time period, in which case many logs may appear within each directory. Logs are moved to the FTP space every 15 minutes or when individual log size reaches 5MB, whichever is first.
Logs are currently saved for 45 days. Access to this space is read-only.
Access Log Format
|1||Request Date||date||YYYY-MM-DD||n||The date the request was made to the CDN.|
|2||Request Time||time||HH:MM:SS||n||The time represented in GMT when the request was made to the CDN.|
|3||HTTP Method||cs-method||string||n||The HTTP method used for the request (HEAD, GET).|
|4||Client IP||c-ip||a.b.c.d||n||The IP address of the user agent making the request.|
|5||HTTP Version||cs-version||string||n||This should either be HTTP or HTTPS depending on how the content was requested on the CDN.|
|6||Referrer||cs-referrer||URL||Y||The referrer header sent by the user agent. A referrer is not a required header so this field may not always have a URL.|
|7||User-Agent String||cs-user-agent||string||Y||The string sent by the user agent to the identity itself.|
|8||File Size||filesize||bytes||n||Size of the asset being delivered.|
|9||Request Size||cs-bytes||bytes||n||The total size of the request header.|
|10||Response Bytes Sent||sc-bytes||bytes||n||Total bytes in the response to the client.|
|11||Web Server IP||s-ip||a.b.c.d [port]||n||The IP address of the edge server - we default to the Anycast IP.|
|12||Response Seconds||time-taken||floating-point number||n||The number of seconds (accurate to the millisecond) taken to deliver the asset.|
|13||HTTP Status Code||sc-status||number||n||The HTTP status code returned to the user agent. This number should be a valid HTTP status code.|
|14||Query String||cs-uri-query||string||Y||The query string parameters provided in the request.|
|15||Path||cs-uri-stem||URI||n||The full URI of the request.|
|16||Range Bytes||x-byte-range||range||Y||For range request, you'll see the range request and delivered to the client in the form bytes=<range requested>.|