Collect Logs for Akamai Cloud Monitor

Log Types

Akamai formatted logs provide one log message for each request.

For information about Akamai Cloud Monitor log formats, contact Akamai Support and request the document “Akamai Log Delivery User Guide.” Refer to “Appendix A: Log Formats and Examples."

Enable Akamai Cloud Monitor

Akamai Cloud Monitor is the service that generates transactional information for your Akamai CDN.

To enable Cloud Monitor in your Akamai environment, use the instructions at: 
https://www.akamai.com/us/en/solutions/intelligent-platform/cloud-monitor.jsp

Configure a Collector

In Sumo Logic, create a new Hosted Collector.

Configure a Source

1. Configure an HTTP Source.
2. Configure the Source Fields as follows:
   1. Name. Required. For example, use Akamai.
   2. Source Category. Required. For example, use akamai_cloud_monitor. (The Source Category metadata field is a fundamental building block to organize and label Sources. For details see Best Practices.)
3. Configure the Advanced section:
   1. Check Extract timestamp information from log file entries.
   2. Timezone. Use time zone from log file. If none is present, use UTC.
   3. Timestamp Format. Auto-Detected
   4. Encoding Type. UTF-8
   5. Enable Multiline Processing.
      • Detect Messages Spanning Multiple Lines. False
      • Multi Line Boundary. NA
4. Click Save.

Save the URL endpoint that is generated for your HTTP Source. You will use it to configure Akamai.

Configure Akamai

1. In Akamai, open the Luna Control center and navigate to the property you’d like to work with.
2. Create a new version for the property and select it.
3. Scroll down to the Property Manager Configuration section.
4. Select Add Rule and choose Cloud Management.
5. Add Cloud Monitor Instrumentation.
6. Add the path from your Sumo Logic URL endpoint, generated from the HTTP Source, in the Delivery URL Path section. (It should start with /receiver/v1/http/<your unique endpoint>).
7. Return to the screen where you can see your main property and add a new property.
8. Make sure to apply your TLS certificate so it can handle HTTPS traffic.
9. Set the origin server as the server from your Sumo Logic URL endpoint.
10. Set the HTTPS port to 443.

Field Extraction Rules

Field Extraction Rules (FERs) tell Sumo Logic which fields to parse out automatically. For instructions, see Create a Field Extraction Rule.

1. In Sumo Logic, go to Manage Data > Logs > Field Extractions and click Add.
2. Configure the following fields:
   • Rule Name. Required (for example, Akamai Cloud Monitor).
   • Scope. Use the Source Category you created for your HTTP Source (for example, akamai_cloud_monitor).
   • Parse Expression. Select the template Akamai Cloud Monitor and click Use Template. The full parse statement is below.
3. Click Add.

FER for Akamai Cloud Monitor

parse "\"reqMethod\":\"*\"" as method, "\"status\":\"*\"" as status, "\"fwdHost\":\"*\"" as origin

| parse "\"bytes\":\"*\"" as bytes, "\"edgeIP\":\"*\"" as edgeip, "\"country\":\"*\"" as country, "\"cookie\":\"*\"" as cookie

Sample Log Messages

{
        "type": "cloud_monitor",
        "format": "default",
        "version": "1.0",
        "id": "dce9bc83ff6820435e6633e",
        "start": "1379543560.807",
        "cp": "180370",
        "message": {
            "proto": "http",
            "protoVer": "1.0",
            "status": "200",
            "cliIP": "109.31.186.162",
            "reqPort": "80",
            "reqHost": "www2.acmeco.com",
            "reqMethod": "GET",
            "reqPath": "/cart?display=full",
            "respCT": "",
            "respLen": "",
            "bytes": "",
            "UA": "Chrome/35.0.1916.153",
            "fwdHost": ""
    },
    "reqHdr": {
            "accEnc": "gzip",
            "conn": "Keep-Alive"
},
"respHdr": {
        "accRange": "bytes",
        "conn": "keep-alive",
        "contEnc": "gzip",
        "date": "2016-09-23 23:04:45.697 +0000",
        "eTag": "\"\"",
        "lastMod": "Mon,%2023%20Jan%202012%2001:44:17%20GMT",
        "server": "Apache/2.2.14%20(Ubuntu)",
        "cookie": "987597820765"
},
"netPerf": {
        "downloadTime": "1594",
        "netOriginLatency": "40",
        "originName": "down",
        "originIP": "",
        "originInitIP": "10.10.10.10",
        "originRetry": "0",
        "lastMileRTT": "43",
        "cacheStatus": "1",
        "firstByte": "1",
        "lastByte": "1",
        "asnum": "4812",
        "edgeIP": ""
},
"geo": {
        "country": "us",
        "region": "",
        "city": ""
},
"waf": {
        "logVer": ""
},
"ipRules": "",
"warnRules": "",
"denyRules": ""
}

Query Samples