Monitoring CDN logs: best practices

A content delivery network, or CDN, is a network of servers that provides website content in a distributed manner to users in or near their geographical vicinity. A CDN helps users across the globe load applications faster—no matter where the application is located—via caching services that lower latency.

A CDN seeks to improve the user experience (UX) and reduce networking overhead on the servers hosting the content. Additionally, CDNs also increase the security of a website and its ability to resist cyberattacks since traffic is proxied to the main server.

Logs generated by CDNs record three types of data: user activity, its origin, and application performance (including latency and caching). This information is of great value, allowing organizations to tune the CDN for maximum performance and security, as well as identify the best geographic regions for expansion. Hence, it’s crucial to monitor CDN logs effectively.

In this article, we will discuss how to read and understand CDN logs, as well as provide best practices for monitoring them.

How to analyze a CDN log

CDN logs are not all that different from web server logs. A CDN log in raw format could be:

101.100.20.56 username [5/Oct/2023:11:50:16 +0000] “GET 
/image.png HTTP/2.0” 200 150 1289 

Each value above has a meaning:

• 101.100.20.56 is the IP address accessing the resource. Every user navigating your website would have a unique IP address.
• username is the username of the user navigating through your website. This is implemented differently by different CDNs.
• [5/Oct/2023:11:50:16 +0000] is the date and time on which the user is accessing the resource.
• “GET /image.png HTTP/2.0” is the type of request (HTTP GET or POST) along with the resource it is trying to access.
• 200 indicates the status code returned by the CDN. A 200 means the CDN has already cached the resource,
• 150 indicates the time taken between the request hitting the CDN and the user being served the resource. This key metric allows you to determine how your website performs.
• 1289 indicates the response size returned to the user. An unusually large amount means your website is serving a large amount of data, which might impact performance.

Most CDNs provide logs that can be seen using an application programming interface (API) or on the product’s dashboard. Companies usually collect logs close to runtime and automate the log analysis to extract value. CDN providers facilitate such automation practices by providing data in easily ingestible ways, such as JSON, for processing.

Best practices for CDN log monitoring

Due to the large number of CDN logs generated, organizations have a hard time analyzing them. However, when monitored effectively, these logs can provide a wealth of insights.

To extract the most value from CDN logs and use them to improve application performance and security, organizations should adopt best practices focused on a few key areas.

Reduce network latency with performance monitoring

CDN logs can indicate if response time and latency are being impacted. Ideally, the CDN should not only reduce network overhead on the origin servers but also reduce computing metrics such as CPU and memory usage. This is because CDNs perform caching on the most requested data.

Repeatedly monitoring latency values can give you an idea of how well the CDN is performing on these fronts.

Identify gaps in user experience through website marketing performance

CDN logs give insights into how many users visit and navigate your website, along with information about which part of the website is experiencing the most traffic. This data is useful in identifying potential gaps in the popularity of various features and the demographic popularity of the website. It can also help boost marketing tactics.

For example, if the website is experiencing high traffic in a profitable region, you might decide to plan marketing strategies around that region to boost sales.

Mitigate IT risks through security monitoring

Since CDN logs record a user’s activities and origin, they can help detect and mitigate suspicious activities, including those listed below.

Denial-of-service attacks (DoS)

DoS attacks are attempts to request a large amount of data with the intent to exhaust the origin server’s computing resources. Companies can easily detect and block such attacks using a CDN to monitor the number of hits from a particular IP address in a given period. Many CDNs provide this feature alongside their usual caching capabilities.

Brute force attacks

A brute force attack entails bad actors attempting to authenticate as a user by guessing the password multiple times. Similar to DoS attacks, a CDN can monitor and block such actions as well.

Injection attacks

An injection attack entails an attempt to inject malicious code into a site to gain access to unauthorized user data. Such attacks normally have signatures known to the security team. CDN logs help the team determine if these known signatures are being used and, if so, proactively block the hacker from trying to inject the faulty code.

To boost security against any suspicious activity, organizations should proactively monitor CDN logs, analyze activity, and set access policies accordingly.

Conclusion

In this article, we learned about CDN logs and how we can extract value by monitoring them effectively. Organizations can leverage tools to help them optimize their content delivery strategies and enhance overall web performance. By delving into CDN logs, organizations gain valuable insights into the behavior of their web traffic, helping them make informed decisions to improve user experience and efficiency.

For example, Site24x7 has partnered with all major CDN providers to extract logs from them easily. The service generates a graphical CDN log analysis report for your website, allowing you to see the following:

• Incorrect cache configurations
• Slow loading resources
• User traffic, broken down per region

To learn more about Site24x7’s CDN Report, click here.