Recording Access Logs Using VPC Flow Logs

Updated at：2025-10-16

Application scenarios

When external services are enabled for the load balancer, users need to track access. In this case, you can activate the Layer-7 access logging feature of the load balancer, which saves access record data in the VPC flow logs.

Description:

The current function of recording Layer 4 Load Balancer access logs to flow logs only applies to the instances on dedicated clusters. The function of recording Layer 7 Load Balancer access logs to flow logs only applies to the instances on shared clusters and dedicated clusters.

Preparation

Service enabling

In addition to the load balancer, you need to enable the following services:

VPC flow logs
BLS service or BOS service

VPC flow logs can forward access data generated by the load balancer instance to either the BLS or BOS service, so you only need to choose one of these services.

Create BLS

Please refer to BLS operation documentation to create BLS LogStore.

Create BOS

Please refer to BOS operation documentation to create BOS Bucket.

Enable access log recording for the load balancer

Ensure you have created a load balancer instance with a Layer 7 listener (HTTP/HTTPS) deployed.
On the Load Balancer List page, click the Load Balancer Instance ID to enter the Load Balancer Details page. Select Flow Logs from the left navigation bar. Click: Layer-7 Flow Logs -> Create Flow Log, redirect to the VPC-side Flow Log Creation page. Select the corresponding parameters as needed and choose the newly created BLS or BOS LogStore or Bucket. Click OK, and then return to the load balancer instance. It can be observed that the current load balancer instance has enabled access logging, which is linked to VPC flow logs.

Note: Log information is recorded with a delay of 2~3 minutes

Log Record field

Field	Types	Description
time_local	string	Record the time of access logs
vip	string	BLB IP
vport	int	BLB listener port
response_status	int	Status code of BLB response message
vdum_ups_id	string	ID of server group accessed by traffic
upstream_addr	string	Address of real server accessed by traffic
upstream_status	string	Response code of real server accessed by traffic
remote_addr	string	The remote client IP establishing connection with the BLB. If BGW does not enable cip_forward, it will be the BGW BIP.
cip	string	The remote client IP establishing connection with BLB
cport	int	The remote client port establishing connection with BLB
server_addr	string	Virtual server IP of the accessed BLB
server_port	int	Virtual server port of the accessed BLB
scheme	string	Protocol type (HTTP/HTTPS)
host	string	Domain name
request	string	Request line information
request_length	int	Request length
body_bytes_sent	int	Bytes of sent responses
http_referer	string	The refer header content in the request message received by the BLB
http_user_agent	string	The user-agent header content in the request message received by the BLB
http_x_forwarded_for	string	The x-forward-for content in the request message received by the BLB
upstream_connect_time	float	Connection establishment time between BLB and real servers
upstream_response_time	float	The time taken by BLB to forward a request to the real server and receive a response from the real server
request_time	float	The time taken by BLB to receive a request from the client and return a response to the client
ssl_handshake_time	float	SSL handshake time
ssl_session_reused	string	Indicate whether SSL session is reused. r means reuse, and . means no reuse.
vdum_rs_proto	string	Real server protocol type
upstream_local_addr	string	BLB service nodes use internal IPs, which require no attention from users
extension_log	string	BLB instance ID & BLB instance rate limit status where 0 indicates no rate limit and 1 indicates rate limit & QPS of the BLB instance on the current service node which displays 0 when no rate limit is applied & Count of QPS tokens for the BLB instance on the current service node which displays 0 when no rate limit is applied

Load Balancer Frontend and Backend Protocol Correspondence

Service Release Point

BLB BLB