Skip to main content
Sumo Logic

Collect Logs for Akamai Cloud Monitor

  1. Last updated
  2. Save as PDF
399

This procedure explains how to collect logs from Akamai Cloud Monitor and ingest them into Sumo Logic.

Log Types

Akamai formatted logs provide one log message for each request.

For information about Akamai Cloud Monitor log formats, contact Akamai Support and request the document “Akamai Log Delivery User Guide.” Refer to “Appendix A: Log Formats and Examples."

Enable Akamai Cloud Monitor

Akamai Cloud Monitor is the service that generates transactional information for your Akamai CDN.

To enable Cloud Monitor in your Akamai environment, use the instructions at: 
https://www.akamai.com/us/en/solutions/intelligent-platform/cloud-monitor.jsp

Configure a Collector

In Sumo Logic, create a new Hosted Collector.

Configure a Source

  1. Configure an HTTP Source.
  2. Configure the Source Fields as follows:
    1. Name. Required. For example, use Akamai.
    2. Source Category. Required. For example, use akamai_cloud_monitor. (The Source Category metadata field is a fundamental building block to organize and label Sources. For details see Best Practices.)
  3. Configure the Advanced section:
    1. Check Extract timestamp information from log file entries.
    2. Timezone. Use time zone from log file. If none is present, use UTC.
    3. Timestamp Format. Auto-Detected
    4. Encoding Type. UTF-8
    5. Enable Multiline Processing.
      • Detect Messages Spanning Multiple Lines. False
      • Multi Line Boundary. NA
  4. Click Save.

Save the URL endpoint that is generated for your HTTP Source. You will use it to configure Akamai.

Configure Akamai

  1. In Akamai, open the Luna Control center and navigate to the property you’d like to work with.
  2. Create a new version for the property and select it.
  3. Scroll down to the Property Manager Configuration section.
  4. Select Add Rule and choose Cloud Management.
  5. Add Cloud Monitor Instrumentation.
  6. Add the path from your Sumo Logic URL endpoint, generated from the HTTP Source, in the Delivery URL Path section. (It should start with /receiver/v1/http/<your unique endpoint>).
  7. Return to the screen where you can see your main property and add a new property.
  8. Make sure to apply your TLS certificate so it can handle HTTPS traffic.
  9. Set the origin server as the server from your Sumo Logic URL endpoint.
  10. Set the HTTPS port to 443.

Field Extraction Rules

Field Extraction Rules (FERs) tell Sumo Logic which fields to parse out automatically. For instructions, see Create a Field Extraction Rule.

  1. In Sumo Logic, go to Manage Data > Logs > Field Extractions and click Add.
  2. Configure the following fields:
    • Rule Name. Required (for example, Akamai Cloud Monitor).
    • Scope. Use the Source Category you created for your HTTP Source (for example, akamai_cloud_monitor).
    • Parse Expression. Select the template Akamai Cloud Monitor and click Use Template. The full parse statement is below.
  3. Click Add.

FER for Akamai Cloud Monitor

parse "\"reqMethod\":\"*\"" as method, "\"status\":\"*\"" as status, "\"fwdHost\":\"*\"" as origin

| parse "\"bytes\":\"*\"" as bytes, "\"edgeIP\":\"*\"" as edgeip, "\"country\":\"*\"" as country, "\"cookie\":\"*\"" as cookie

Sample Log Messages

{
        "type": "cloud_monitor",
        "format": "default",
        "version": "1.0",
        "id": "dce9bc83ff6820435e6633e",
        "start": "1379543560.807",
        "cp": "180370",
        "message": {
            "proto": "http",
            "protoVer": "1.0",
            "status": "200",
            "cliIP": "109.31.186.162",
            "reqPort": "80",
            "reqHost": "www2.acmeco.com",
            "reqMethod": "GET",
            "reqPath": "/cart?display=full",
            "respCT": "",
            "respLen": "",
            "bytes": "",
            "UA": "Chrome/35.0.1916.153",
            "fwdHost": ""
    },
    "reqHdr": {
            "accEnc": "gzip",
            "conn": "Keep-Alive"
},
"respHdr": {
        "accRange": "bytes",
        "conn": "keep-alive",
        "contEnc": "gzip",
        "date": "2016-09-23 23:04:45.697 +0000",
        "eTag": "\"\"",
        "lastMod": "Mon,%2023%20Jan%202012%2001:44:17%20GMT",
        "server": "Apache/2.2.14%20(Ubuntu)",
        "cookie": "987597820765"
},
"netPerf": {
        "downloadTime": "1594",
        "netOriginLatency": "40",
        "originName": "down",
        "originIP": "",
        "originInitIP": "10.10.10.10",
        "originRetry": "0",
        "lastMileRTT": "43",
        "cacheStatus": "1",
        "firstByte": "1",
        "lastByte": "1",
        "asnum": "4812",
        "edgeIP": ""
},
"geo": {
        "country": "us",
        "region": "",
        "city": ""
},
"waf": {
        "logVer": ""
},
"ipRules": "",
"warnRules": "",
"denyRules": ""
}

Query Samples

Top Error-causing URLs

_sourceCategory=akamai 50?
| parse "\"reqPath\":\"*\"" as path, "\"status\":\"*\"" as status
| urldecode(path) as path
| where status > 499
| where status < 600
| count as errors by path
| sort by errors

Cache Performance

_sourceCategory=akamai cacheStatus
| parse "\"cacheStatus\":\"*\"" as status
| where !(status="")
| if(status="0", "0 - Non cacheable", if(status="1" OR status="2", "1/2 - Cache Hit", if(status="3", "3 - Cache Miss", ""))) as cachestatus
| count by cachestatus

Top Denials by Host

_sourceCategory=akamai waf denyRules reqHost
| parse "\"denyRules\":\"*\"" as deny, "\"reqHost\":\"*\"" as host
| where deny != ""
| timeslice 1m
| count by host, _timeslice
| transpose row _timeslice column host