Skip to content

Commit a727c81

Browse files
vhornevhorne
committed
freshness review
1 parent d5cd5e6 commit a727c81

File tree

1 file changed

+10
-104
lines changed

1 file changed

+10
-104
lines changed

‎articles/web-application-firewall/afds/waf-front-door-monitor.md

Lines changed: 10 additions & 104 deletions
Original file line numberDiff line numberDiff line change
@@ -5,14 +5,14 @@ author: vhorne
55
ms.service: web-application-firewall
66
ms.topic: article
77
services: web-application-firewall
8-
ms.date: 02/07/2023
8+
ms.date: 05/23/2024
99
ms.author: victorh
1010
zone_pivot_groups: front-door-tiers
1111
---
1212

1313
# Azure Web Application Firewall monitoring and logging
1414

15-
Azure Web Application Firewall in Azure Front Door provides extensive logging and telemetry to help you understand how your web application firewall (WAF) is performing and the actions it takes.
15+
Azure Web Application Firewall on Azure Front Door provides extensive logging and telemetry to help you understand how your web application firewall (WAF) is performing and the actions it takes.
1616

1717
The Azure Front Door WAF log is integrated with [Azure Monitor](../../azure-monitor/overview.md). Azure Monitor enables you to track diagnostic information, including WAF alerts and logs. You can configure WAF monitoring within the Azure Front Door resource in the Azure portal under the **Diagnostics** tab, through infrastructure as code approaches, or by using Azure Monitor directly.
1818

@@ -40,111 +40,15 @@ Logs aren't enabled by default. You must explicitly enable logs. You can configu
4040

4141
If logging is enabled and a WAF rule is triggered, any matching patterns are logged in plain text to help you analyze and debug the WAF policy behavior. You can use exclusions to fine-tune rules and exclude any data that you want to be excluded from the logs. For more information, see [Web application firewall exclusion lists in Azure Front Door](../afds/waf-front-door-exclusion.md).
4242

43-
Azure Front Door provides two types of logs: access logs and WAF logs.
43+
You can enable three types of Azure Front Door logs:
4444

45-
### Access logs
4645

47-
::: zone pivot="front-door-standard-premium"
48-
49-
The log `FrontDoorAccessLog` includes all requests that go through Azure Front Door. For more information on the Azure Front Door access log, including the log schema, see [Monitor metrics and logs in Azure Front Door](../../frontdoor/front-door-diagnostics.md?pivot=front-door-standard-premium#access-log).
50-
51-
::: zone-end
52-
53-
::: zone pivot="front-door-classic"
54-
55-
The log `FrontdoorAccessLog` includes all requests that go through Azure Front Door. For more information on the Azure Front Door access log, including the log schema, see [Monitor metrics and logs in Azure Front Door (classic)](../../frontdoor/front-door-diagnostics.md?pivot=front-door-classic#diagnostic-logging).
56-
57-
::: zone-end
58-
59-
The following example query returns the access log entries:
60-
61-
::: zone pivot="front-door-standard-premium"
62-
63-
```kusto
64-
AzureDiagnostics
65-
| where ResourceProvider == "MICROSOFT.CDN" and Category == "FrontDoorAccessLog"
66-
```
67-
68-
::: zone-end
69-
70-
::: zone pivot="front-door-classic"
71-
72-
```kusto
73-
AzureDiagnostics
74-
| where ResourceType == "FRONTDOORS" and Category == "FrontdoorAccessLog"
75-
```
46+
- WAF logs
47+
- Access logs
48+
- Health probe logs
49+
50+
Activity logs are enabled by default and provide visibility into the operations performed on your Azure resources, such as configuration changes to your Azure Front Door profile.
7651

77-
::: zone-end
78-
79-
The following snippet shows an example log entry:
80-
81-
::: zone pivot="front-door-standard-premium"
82-
83-
```json
84-
{
85-
"time": "2020-06-09T22:32:17.8383427Z",
86-
"category": "FrontDoorAccessLog",
87-
"operationName": "Microsoft.Cdn/Profiles/AccessLog/Write",
88-
"properties": {
89-
"trackingReference": "08Q3gXgAAAAAe0s71BET/QYwmqtpHO7uAU0pDRURHRTA1MDgANjMxNTAwZDAtOTRiNS00YzIwLTljY2YtNjFhNzMyOWQyYTgy",
90-
"httpMethod": "GET",
91-
"httpVersion": "2.0",
92-
"requestUri": "https://wafdemofrontdoorwebapp.azurefd.net:443/?q=%27%20or%201=1",
93-
"requestBytes": "715",
94-
"responseBytes": "380",
95-
"userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4157.0 Safari/537.36 Edg/85.0.531.1",
96-
"clientIp": "xxx.xxx.xxx.xxx",
97-
"socketIp": "xxx.xxx.xxx.xxx",
98-
"clientPort": "52097",
99-
"timeTaken": "0.003",
100-
"securityProtocol": "TLS 1.2",
101-
"routingRuleName": "WAFdemoWebAppRouting",
102-
"rulesEngineMatchNames": [],
103-
"backendHostname": "wafdemowebappuscentral.azurewebsites.net:443",
104-
"sentToOriginShield": false,
105-
"httpStatusCode": "403",
106-
"httpStatusDetails": "403",
107-
"pop": "SJC",
108-
"cacheStatus": "CONFIG_NOCACHE"
109-
}
110-
}
111-
```
112-
113-
::: zone-end
114-
115-
::: zone pivot="front-door-classic"
116-
117-
```json
118-
{
119-
"time": "2020-06-09T22:32:17.8383427Z",
120-
"category": "FrontdoorAccessLog",
121-
"operationName": "Microsoft.Network/FrontDoor/AccessLog/Write",
122-
"properties": {
123-
"trackingReference": "08Q3gXgAAAAAe0s71BET/QYwmqtpHO7uAU0pDRURHRTA1MDgANjMxNTAwZDAtOTRiNS00YzIwLTljY2YtNjFhNzMyOWQyYTgy",
124-
"httpMethod": "GET",
125-
"httpVersion": "2.0",
126-
"requestUri": "https://wafdemofrontdoorwebapp.azurefd.net:443/?q=%27%20or%201=1",
127-
"requestBytes": "715",
128-
"responseBytes": "380",
129-
"userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4157.0 Safari/537.36 Edg/85.0.531.1",
130-
"clientIp": "xxx.xxx.xxx.xxx",
131-
"socketIp": "xxx.xxx.xxx.xxx",
132-
"clientPort": "52097",
133-
"timeTaken": "0.003",
134-
"securityProtocol": "TLS 1.2",
135-
"routingRuleName": "WAFdemoWebAppRouting",
136-
"rulesEngineMatchNames": [],
137-
"backendHostname": "wafdemowebappuscentral.azurewebsites.net:443",
138-
"sentToOriginShield": false,
139-
"httpStatusCode": "403",
140-
"httpStatusDetails": "403",
141-
"pop": "SJC",
142-
"cacheStatus": "CONFIG_NOCACHE"
143-
}
144-
}
145-
```
146-
147-
::: zone-end
14852

14953
### WAF logs
15054

@@ -264,6 +168,8 @@ The following snippet shows an example log entry, including the reason that the
264168

265169
::: zone-end
266170

171+
For more information about the other Azure Front Door logs, see [Monitor metrics and logs in Azure Front Door](../../frontdoor/front-door-diagnostics.md#logs).
172+
267173
## Next steps
268174

269175
Learn more about [Azure Front Door](../../frontdoor/front-door-overview.md).

0 commit comments

Comments
 (0)