CDN log delivery with Arc XP

Arc XP gives you with the option to deliver CDN logs to the repository of your choice, including:

  • Amazon S3

  • Azure Storage

  • Custom HTTPS

  • DataDog

  • Google Cloud Storage

  • NewRelic

  • Oracle Cloud

  • Splunk

  • Edge Integrations

    • DataDome
    • Tollbit

Cache data

Enable the Cache status field to determine whether requests were served from the edge cache.

Data elementExamplesDescription
Cache status0, 1Returns1if the request was served from the edge cache. Returns0if it was forwarded to the parent or origin server.

Geolocation data

Use these fields to capture geographic information about each request.

Data elementExamplesDescription
Country/RegionUSThe ISO country/region code of the client location.
Statec:4380:7:161:New%20HampshireThe URI-encoded name of the state where the request originated.
CityBangaloreThe city of origin for the request.

Log information

These fields provide customer identification and basic request metadata.

Data elementExamplesDescription
CP code2097150TheContent Provider Codeused for billing, reporting, and monitoring.
Request ID2256a92The unique request identifier assigned by the server.
Request time1612215703.120The UNIX timestampe (in seconds) when the edge server accepted the request.

Message exchange data

These fields capture details form the request-response cycle, including traffic, protocol, and client information.

Data elementExamplesDescription
Bytes0, 14995The number of bytes in the response body (excluding HTTP headers). This includes HTTP/2 overhead.
Client IP198.18.77.18,2001:0db8:85a3:<>0000:0000:8a2e:0370:7334The client’s IPv4 or IPv6 address.
Cookiecountry=AU; sessionId=12a8f83bThe cookies received in the HTTP request headers. This field is RFC-1738 escaped, replacing spaces and other special characters, and separated by a semicolon;.
HTTP status codes0, 200, 206, 404The HTTP status codes sent in the response. Returns0if the connection closed before a response was sent.
Object size-1, 0, 1, 2The size of the returned object (excluding headers). Returns-1if incomplete or undetermined.
Overhead bytes400The TCP/IP/ETH overhead in bytes (excluding HTTP/UDP overhead).
Protocol typeHTTP/1.1, HTTPS/1.1, HTTP/2, HTTP3The protocol used for the request-response cycle.
Query stringq=foo&submit=trueThe query string portion of the request URI.
To monitor this parameter in your logs, you must update your stream’s property configuration to set theCache Key Query Parametersfield to include all parameters.
Request hostsplat-traffic.205400.<cdn-provider>.comThe value of theHostheader.
If no port is included, the default port for the service is implied. For example, 443 for an HTTPS URL, and 80 for an HTTP URL. AHostheader must be present in HTTP/1.1 requests. If a request lacks this header or has more than one, the server may respond with a 400 status code.
Request methodGET, POST, PUT, OPTIONSThe HTTP method of the request.
Request pathpath1/path2/file.extThe URI path excluding query parameters.
Request port80, 443The port number the client uses.
Response Content-Length-1, 0, 5000The size of object data returned to the client (excludes headers). Returns-1if unknown.
Response Content-Typetext-plain,text-htmlThe media type of the repsonse content. Returns-if unknown.
TLS overhead time-, 3The time in milliseconds for the TLS handshake. Returns-for non-TLS.
TLS version-, TLSv1.3, QUICThe TLS protocol version. Returns-for non-TLS.
Total bytes839, 9376The total bytes served (includes headers, content, and overhead).
Uncompressed size46251The original object size before compression.
User-AgentMozilla%2F5.0+%28Macintosh %3B+Intel+Mac+OS+X+10_14_3%29The URI-encodedUser-Agentheader value. Escaped per RFC-1738.

Network performance data

Select from these fields to get data on the edge server and client performance, and error codes when serving the requests for troubleshooting.

Data elementExamplesDescription
Breadcrumbs//BC/%5Ba=23.33.41.20 ,c=g,k=0,l=1,m=1%5DAdditional diagnostics for the request-response cycle. Available for Adaptive Media Delivery, Download Delivery, and Object Delivery.
• a – the component IP of the node or host processing the request, such as the edge or origin host
• c – the letter identifier for the <cdn-provider> network component that as involved during that phase of the request (c - cache parent, g - edge host, p - peer host, o - origin, or w - Cloud Wrapper)
• j (optional) – forward list
• k – the request end time (in milliseconds) between when the edge host accepts the connection and receives the request header, including initial metadata parsing time and SSL overhead
• l – the turnaround time (in milliseconds) between receiving the end of the request headers and gathering the breadcrumb, including fetching the object from another server in case of a miss, or synchronous validation of cached object’s freshness, fetching the object from the disk, performing ESI processing, and computing response headers
• m – the DNS lookup time (in milliseconds) as the delta between the start of the request and the completion of the DNS lookup
DNS lookup time3The time in milliseconds to complete DNS resolution. Returns0if cached.
Error codeERR_ACCESS_DENIED|fwd_aclA string describing the problem with serving the request.
Last byte1The last byte of the object served. Returns0for partial byte-range responses.
Request end time0, 1, 3The time in milliseconds to fully read the client’s request.
Turnaround time16The time in milliseconds from receiving the full request ot sending the first response byte.
Transfer time0, 1, 125The time in milliseconds to transfer the full response to the client.

Requesting log delivery

To request or modify your CDN log delivery configuration, contact Arc XP Customer Support and provide the following information:

Required information:

  • Organization name
  • Site ID - available on the Admin page
  • Environment - specify either Sandbox or Production
  • Request type - indicate whether you’re adding, removing, or modifying
  • Sampling percent - 1 to 100%
  • Push frequency - 30 or 60 seconds
  • Integration type - any of the integrations listed at the top of this document.

For Datadog:

  • Endpoint
  • API key

Google Storage Cloud

  • Bucket
  • Product ID
  • Service Account Name
  • Private Key (transfer encrypted/securely)
  • Path

For NewRelic

  • Endpoint
  • Auth token

For S3:

  • Bucket region
  • Bucket name
  • Folder path
  • Access key ID
  • Secret access key

For Splunk:

  • Endpoint
  • HTTP Event Collector (HEC) token

For Tollbit:

  • TollbitKey

Edge Integrations

Edge Integrations may want or require Edge logs to be forwarded to the integrating service in order to provide full benefits from the service. See each integrations specific information needed above for log delivery.

Example: DataDome uses Edge logs to provide analytics as well as better fingerprinting for security profiling for all of your traffic.