Logging Amazon WAF web ACL traffic - Amazon WAF, Amazon Firewall Manager, and Amazon Shield Advanced
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Logging Amazon WAF web ACL traffic

You can enable logging to get detailed information about traffic that is analyzed by your web ACL. Logged information includes the time that Amazon WAF received a web request from your Amazon resource, detailed information about the request, and details about the rules that the request matched. You can send your logs to an Amazon CloudWatch Logs log group, an Amazon Simple Storage Service (Amazon S3) bucket, or an Amazon Data Firehose delivery stream.

Note

The logging configuration only affects the Amazon WAF logs. In particular, the redacted fields configuration for logging has no impact on request sampling. The only way to exclude fields from sampled requests is by disabling sampling for the web ACL.

If you can't find a log record in your logs

On rare occasions, it's possible for Amazon WAF log delivery to fall below 100%, with logs delivered on a best effort basis. The Amazon WAF architecture prioritizes the security of your applications over all other considerations. In some situations, such as when logging flows experience traffic throttling, this can result in records being dropped. This shouldn't affect more than a few records. If you notice a number of missing log entries, contact the Amazon Web Services Support Center.