Logging options
You have several logging options with Optimizely.
- Application logs
- Log streams
- Application Insights logs
- Edge logs for CMS 12 (PaaS)
See also Storage containers to access logs.
Note If your CMS uses Opti ID, see also Activity log in the Opti ID documentation for additional log information about user activity.
Application logs
Use application logging for troubleshooting purposes. You can access application logs for environments from the DXP Management Portal as a live stream or download them for offline analysis. The default Application logging configuration for Azure Web Apps in a DXP environment is enabled, and logs are stored in the BLOB storage with 90 days of retention.
The configuration is applied to environments during provisioning, and you can change it in the Integration environment yourself. To change any of the following for Preproduction or Production environments, contact Optimizely Support:
- Get access to web server logs.
- Temporarily change the logging level.
- Temporarily enable detailed error messages.
- Temporarily enable failed request tracing.
For information about the data structure and the use of the Microsoft logging abstraction, see Log in .NET Core and ASP.NET Core.
Log Stream
The Log Stream option lets you view output from Optimizely log files to help troubleshoot deployment errors. This option is already available in your DXP subscription.
Click Open Log Stream Window to access the log stream. You can hook the Optimizely logs to monitor the live stream from site instances.
Click Pause or Resume to stop or continue streaming log information. Click Clear to remove the recent log output.
See Troubleshoot DXP.
Application Insights logs
Application Insight logs let you manage application performance and monitor Web Apps. See Create an Optimizely Cloud Account to request access to your environment's Application Insights.
The ILogger automatically logs to Application Insights. By default, only warning logs and more severe logs are automatically captured. To change this behavior, override the logging configuration for the provider ApplicationInsights as shown below. The following configuration lets ApplicationInsights capture Information logs and more severe logs.
{
"Logging": {
"LogLevel": {
"Default": "Warning"
},
"ApplicationInsights": {
"LogLevel": {
"Default": "Information"
}
}
}
}For information about the log structure and configuration, see Application Insights for ASP.NET Core applications.
Edge Logs streaming using CDN (Beta)
Edge Logs for CMS 12 (PaaS), enables you to stream logs from our CDN directly to a Storage Account in Azure, where you can fetch them via SAS URIs. You can use these logs to debug, identify configuration adjustments to improve performance and security, and create custom analytics.
First, submit a beta access request here (Optimizely will reach out through email and turn on the feature for you) at Register interest for betas.
EpiCloud module
The EpiCloud PowerShell module introduces the Get-EpiEdgeLogLocation cmdlets, enabling storage containers API operations through PowerShell. For installation and to link the module with the authentication system, refer to Deploy using PowerShell for details on setting up the EpiCloud module.
Get-EpiEdgeLogLocation creates a non-editable SAS link to the project's edge logs that expires automatically after a day.
# Fetchs edge logs location based on projectId
Get-EpiEdgeLogLocation -ProjectId "ac138482-0a55-420a-ab4a-b1a700206a64"
https://sitrcmsli879s2af.blob.core.windows.net/cloudflarelogpush?sv=2023-01-03&st=2024-07-09T06:21:45Z&se=2024-07-10T06:26:45Z&sr=c&sp=rl&sig=r2NBPDR%2FTTEta4ggqLVGDOKayYupdLIFfgjXdpsKn%2FA%3D Obtain credentials
Use the Get-EpiEdgeLogLocation from the EpiCloud module, or make an API call with a set of client key and client secret to retrieve this information. You can generate multiple credentials through the self-service feature within the DXP management portal and link these credentials with the edge logs permission.
Add API credentials in the DXP Management Portal. You have the option to create an API credential or access your existing credentials through the API tab.
- Go to the Deployments > Deployment API Credential section to see a list of current credentials.
- Click Add API credentials.
- Type in the name for the credential, choose Edge logs permission, and click Save to create an API credential.
The credentials list displays added credentials. The API secret is revealed only once upon addition and remains visible until you refresh the page; after that, it will no longer be displayed.
Copy the ProjectId from the API tab. In Postman or similar software, make a GET call to the following endpoint:
https://paasportal.episerver.net/api/v1.0/projects/{Project Id}/edgelogs/location
As you do this, add the following Pre-request script in the Postman script. Update the key and the secret variable values in the Pre-request script with what you obtained in step 1:
var crypto = require("crypto-js");
var sdk = require('postman-collection');
// This script uses 2 variables.
//
// EPTSKey
// EPTSSecret
//
var method = pm.request.method;
var key = "Your key";
var secret = CryptoJS.enc.Base64.parse("Your secret");
var target = new sdk.Url(request.url).getPathWithQuery();
var timestamp = (new Date()).getTime();
var nonce = Math.random().toString(36).substring(7);
var body = "";
if( pm.request.body )
{
body = pm.request.body.raw;
}
var bodybase64 = crypto.MD5(body).toString(CryptoJS.enc.Base64);
var hmac = crypto.HmacSHA256(key + method + target + timestamp + nonce + bodybase64, secret);
var base64hmac = CryptoJS.enc.Base64.stringify(hmac);
var header = "epi-hmac " + key + ":" + timestamp +":" + nonce + ":" + base64hmac;
pm.request.headers.add(header, "Authorization")This gives you the SAS link for the logs. The identifier of the project, projectId is a Guid. The response is as follows:
{
"application/json": {
"success": true,
"errors": [],
"result": {
"location": "https://episite.blob.core.windows.net/location"
}
}
}# Fetchs edge logs location based on projectId
Get-EpiEdgeLogLocation -ProjectId "ac138482-0a55-420a-ab4a-b1a700206a64"
https://sitrcmsli879s2af.blob.core.windows.net/cloudflarelogpush?sv=2023-01-03&st=2024-07-09T06:21:45Z&se=2024-07-10T06:26:45Z&sr=c&sp=rl&sig=r2NBPDR%2FTTEta4ggqLVGDOKayYupdLIFfgjXdpsKn%2FA%3D Download logs from SAS link
Using the generated SAS link, you can retrieve logs from the BLOB container called cloudflarelogpush. The following procedure shows how to download the logs using the Microsoft Azure Storage Explorer tool.
- Open the Microsoft Azure Storage Explorer tool and click Connect to Azure resources.
- Then select Blob container or directory.
- Select Shared access signature URL (SAS) option.
- Enter Connection Information, then click Connect.
- Open the BLOB Containers section in the Explorer panel and choose the BLOB container you named before.
- From the list of logs on the right, pick the log file to download and click Download.
Note These logs do contain PII in the form of IP addresses.
For information about the data structure, see Log fields.
General logging FAQs
- Can I integrate with my own SIEM or push logs to external systems that Cloudflare/Azure integrates with, such as Splunk? You can create your own integrations to then programmatically send the logs to other destinations from the container (the retention period for the logs is 7 days). Currently, you cannot select which log fields are exported, but this could be adjusted in a custom integration.
- I don't want to recreate the SAS link every day. What is the max retention hours setting I can use? 168 hours (7 days).
- What is the log retention period? 7 days. Logs can be exported and saved by the customer programmatically if they want to hold on to them for longer.
- For various log options, what is Optimizely’s responsibility? For questions regarding log access, configuration, or troubleshooting, contact Optimizely Support. Otherwise, Optimizely has no control over log structure, formatting, or fields included in the logs.
- Does DDoS activity and bot block percentage also get included in these logs? Yes, DDoS activity and bot block percentage are not explicitly included as separate fields in the Cloudflare edge logs; however, you can get insights from the firewall events logs: see Firewall events.