Akamai Cloud Monitor

How to start logging with Akamai Cloud Monitor through LogDNA

Follow the Cloud Monitor Implementation Guide to configure Akamai Cloud Monitor to forward the logs to LogDNA with the following parameters for the following properties:

Cloud Monitor Data Delivery

  • Set Origin Server Hostname to logs.logdna.com;
  • For Origin SSL Certificate CN:
    • Set Verification Settings to Choose Your Own;
    • Set Trust to Specific Certificates (pinning);
    • Set Match CN/SAN to {{Origin-Hostname}};
    • Add certificate having logs.logdna.com for Hostname/IP and 443 for HTTPS Port;
  • Set both HTTP and HTTPS Ports to 443;
  • For Content Provider Code, select 812828 - Cloud Monitor to LogDNA. If inexistent, contact Akamai Support to have this added to support the integration with LogDNA.

Dynamic Site Accelerator

In Dynamic Site Accelerator configuration, add Cloud Monitor Instrumentation behavior with the following parameters:

  • Set Cloud Monitor Delivery Hostname to the property hostname of Cloud Monitor Data Delivery configured above;
  • In Data Sets to Include, specify the datasets to get the logs from;
  • Set Delivery URL Path to /akamai/ingest/<Ingestion Key>;
  • Optional. Use querystring parameters to override hostname, app, or to add tags; e.g.
    /akamai/ingest/<Ingestion Key>?hostname=newHost&app=newTest;
    /akamai/ingest/<Ingestion Key>?tags=akamai,logdna&app=newTest;
    /akamai/ingest/<Ingestion Key>?tags=tag1&hostname=host1, etc.

How Akamai Logs are Parsed

The information from each selected dataset is going to show up in different nested fields as explained below:

  • Base Log Line Data: meta.*;
  • Geographic Data: geo.*;
  • HTTP 1.0 and Message Exchange Data: http.*;
  • Network Data 1.0: network.*;
  • Network Performance Data: netPerf.*;
  • Request Header Data: reqHdr.*;
  • Response Header Data: respHdr.*;
  • Web Application Firewall Data 2.0: waf_2.*.

The information about each dataset and the definition of each field can be found in Appendix A: Cloud Monitor Default Connectors section of Cloud Monitor Implementation Guide.

Unless specified, hostname is always http.reqPath and app is always AkamaiCloudMonitor. Tags, hostname and app can be customized using querystring parameters in the configuration step.

The log line is formatted using some http.* fields in the following way:
cliIP reqMethod reqPath?reqQuery proto/protoVer status bytes reqCT reqLen respCT respLen UA


  • - is used if the optional field is missing;
  • Just reqPath is used if there is no reqQuery;
  • In order to format the line, the fields are joined together using whitespace delimiter in the following order:
    • http.cliIP;
    • http.reqMethod;
    • http.reqPath?http.reqQuery or just http.reqPath;
    • http.proto/http.protoVer;
    • http.status;
    • http.bytes;
    • http.reqCT;
    • http.reqLen;
    • http.respCT;
    • http.respLen;
    • http.UA.