CDN log delivery with Arc XP

Arc XP gives you with the option to deliver CDN logs to the repository of your choice, including:

Amazon S3
Azure Storage
Custom HTTPS
DataDog
Google Cloud Storage
Oracle Cloud
Splunk

Cache data

Enable the Cache status field to determine whether requests were served from the edge cache.

Data element	Examples	Description
Cache status	0, 1	Returns `1` if the request was served from the edge cache. Returns `0` if it was forwarded to the parent or origin server.

Geolocation data

Use these fields to capture geographic information about each request.

Data element	Examples	Description
Country/Region	US	The ISO country/region code of the client location.
State	`c:4380:7:161:New%20Hampshire`	The URI-encoded name of the state where the request originated.
City	Bangalore	The city of origin for the request.

Log information

These fields provide customer identification and basic request metadata.

Data element	Examples	Description
CP code	2097150	The Content Provider Code used for billing, reporting, and monitoring.
Request ID	2256a92	The unique request identifier assigned by the server.
Request time	1612215703.120	The UNIX timestampe (in seconds) when the edge server accepted the request.

Message exchange data

These fields capture details form the request-response cycle, including traffic, protocol, and client information.

Data element	Examples	Description
Bytes	0, 14995	The number of bytes in the response body (excluding HTTP headers). This includes HTTP/2 overhead.
Client IP	`198.18.77.18`, `2001:0db8:85a3:<>0000:0000:8a2e:0370:7334`	The client's IPv4 or IPv6 address.
Cookie	`country=AU; sessionId=12a8f83b`	The cookies received in the HTTP request headers. This field is RFC-1738 escaped, replacing spaces and other special characters, and separated by a semicolon `;`.
HTTP status codes	0, 200, 206, 404	The HTTP status codes sent in the response. Returns `0` if the connection closed before a response was sent.
Object size	-1, 0, 1, 2	The size of the returned object (excluding headers). Returns `-1` if incomplete or undetermined.
Overhead bytes	400	The TCP/IP/ETH overhead in bytes (excluding HTTP/UDP overhead).
Protocol type	HTTP/1.1, HTTPS/1.1, HTTP/2, HTTP3	The protocol used for the request-response cycle.
Query string	`q=foo&submit=true`	The query string portion of the request URI. To monitor this parameter in your logs, you must update your stream’s property configuration to set the Cache Key Query Parameters field to include all parameters.
Request host	`splat-traffic.205400.<cdn-provider>.com`	The value of the `Host` header. If no port is included, the default port for the service is implied. For example, 443 for an HTTPS URL, and 80 for an HTTP URL. A `Host` header must be present in HTTP/1.1 requests. If a request lacks this header or has more than one, the server may respond with a 400 status code.
Request method	GET, POST, PUT, OPTIONS	The HTTP method of the request.
Request path	`path1/path2/file.ext`	The URI path excluding query parameters.
Request port	80, 443	The port number the client uses.
Response Content-Length	-1, 0, 5000	The size of object data returned to the client (excludes headers). Returns `-1` if unknown.
Response Content-Type	`text-plain`, `text-html`	The media type of the repsonse content. Returns `-` if unknown.
TLS overhead time	-, 3	The time in milliseconds for the TLS handshake. Returns `-` for non-TLS.
TLS version	-, TLSv1.3, QUIC	The TLS protocol version. Returns `-` for non-TLS.
Total bytes	839, 9376	The total bytes served (includes headers, content, and overhead).
Uncompressed size	46251	The original object size before compression.
User-Agent	`Mozilla%2F5.0+%28Macintosh %3B+Intel+Mac+OS+X+10_14_3%29`	The URI-encoded `User-Agent` header value. Escaped per RFC-1738.

Network performance data

Select from these fields to get data on the edge server and client performance, and error codes when serving the requests for troubleshooting.

Data element	Examples	Description
Breadcrumbs	`//BC/%5Ba=23.33.41.20 ,c=g,k=0,l=1,m=1%5D`	Additional diagnostics for the request-response cycle. Available for Adaptive Media Delivery, Download Delivery, and Object Delivery. a – the component IP of the node or host processing the request, such as the edge or origin host c – the letter identifier for the `<cdn-provider>` network component that as involved during that phase of the request (c - cache parent, g - edge host, p - peer host, o - origin, or w - Cloud Wrapper) j (optional) – forward list k – the request end time (in milliseconds) between when the edge host accepts the connection and receives the request header, including initial metadata parsing time and SSL overhead l – the turnaround time (in milliseconds) between receiving the end of the request headers and gathering the breadcrumb, including fetching the object from another server in case of a miss, or synchronous validation of cached object’s freshness, fetching the object from the disk, performing ESI processing, and computing response headers m – the DNS lookup time (in milliseconds) as the delta between the start of the request and the completion of the DNS lookup
DNS lookup time	3	The time in milliseconds to complete DNS resolution. Returns `0` if cached.
Error code	ERR_ACCESS_DENIED\|fwd_acl	A string describing the problem with serving the request.
Last byte	1	The last byte of the object served. Returns `0` for partial byte-range responses.
Request end time	0, 1, 3	The time in milliseconds to fully read the client's request.
Turnaround time	16	The time in milliseconds from receiving the full request ot sending the first response byte.
Transfer time	0, 1, 125	The time in milliseconds to transfer the full response to the client.

Note

Fields containing whitespace of non-ASCII characters are hex-encoded as per RFC-1738 (URL encoding).

Requesting log delivery

To request or modify your CDN log delivery configuration, contact Arc XP Customer Support and provide the following information:

Required information:

Organization name
Site ID - available on the Admin page
Environment - specify either Sandbox or Production
Request type - indicate whether you're adding, removing, or modifying
Sampling percent - 1 to 100%
Push frequency - 30 or 60 seconds
Integration type - S3, Datadog, Splunk, Sumo, custom HTTP

For S3:

Bucket region
Bucket name
Folder path
Access key ID
Secret access key

For Datadog:

Endpoint
API key

For Splunk:

Endpoint
HTTP Event Collector (HEC) token

Google Storage Cloud

Bucket
Product ID
Service Account Name
Private Key (transfer encrypted/securely)
Path

In this section: