Show search and navigation.
Use the Rates dashboard to analyze recently rate limited requests to:
Logging for rate limited requests is downsampled to 10% due to the volume of requests that may occur during a single incident (e.g., volumetric Distributed Denial-of-Service attack).
Log data is retained for 30 days for most WAF solutions. The exception is WAF Insights which only retains data for 7 days.
This article describes:
The Rates dashboard contains two different views through which rate limit analysis may be performed, which are:
To view the Rates dashboard
The Rates dashboard will display a chart showing recent violations of your security policy.
The Overview is a useful tool for detecting patterns for rate limited traffic directed to your origin servers. This view consists of a chart and statistics for a given time period.
A chart or line graph displays the number of rate limited requests over a given time period.
By default, a single line on the graph represents all downsampled rate limited traffic. Alternatively, categorize rate limited traffic by selecting the desired categorization criteria from the option that appears directly above the graph. A line will be drawn on the chart for each unique value. For example, if you select Top Action Types and rate limited requests were either dropped or redirected, then the graph will contain a line for REDIRECT-302 and another one for DROP-REQUEST.
Statistics for rate limited traffic over a given time period are displayed directly below the chart. Statistics are broken down by category.
The following information is displayed for each category:
Percentage (%): Indicates the percentage of rate limited traffic over a given time period for the current group.
Percentages are calculated from the total rate limited requests during the given time period. The Max Top Number option determines the limit of entries per category. If the number of entries exceeds this limit, then the sum of the percentages for that category will not add up to 100%.
This view provides the means to delve into the details of a rate limited request. The information derived from this view provides a deeper understanding as to why rate limiting was applied to the request.
The event log contains a list of recent rate limited requests. Each request is described as follows:
Enforced Rule: RuleIdentifies the rate rule that was violated by its name. Elapsed TimeIndicates the amount of time that has passed since the request was screened. TimeIndicates the time (UTC) at which the request was screened.
A sample rule violation is provided below.
Enforced Rule: Marketing 10s ago 12:00:00.00 UTC
Action Type: CUSTOM-RESPONSE
Clicking on an event will expand that entry and display detailed information about it.
Filters are applied to both the Overview and the Event Log views. Most fields support filtering.
The Overview and the Event Log views cannot be filtered by the Timestamp field. Use the Time Range option instead. This option filters the dashboard for events that occurred during a relative time period from the present (e.g., Last 24 hours or Last 7 days).
Quickly apply a filter by clicking on the desired entry. After which, the icon will be displayed next to it. This icon indicates that the dashboard is being filtered by that entry.
A brief description for each field used to describe/categorize rate limited requests is provided below.
Identifies the IP address (IPv4) of the client from which the request originated.
Identifies the country from which the request originated.
Indicates the action (e.g., CUSTOM-RESPONSE) that was applied to the rate limited request.
Indicates the request’s referrer as defined by the Referer request header. A referrer identifies the address of the resource that linked to the requested content.
Indicates the request's HTTP method.
Indicates the name of the rule that was applied to the rate limited request.
Indicates the date and time (UTC) at which the request was rate limited.
This field is only available from within the Event Log view. Requests may not be filtered by this field. Filter by time through the Time Range option that appears on the left-hand side of the dashboard.
Local time is displayed on the right-hand side of the event log entry header that appears directly above this field.
Indicates the URL of the request that was rate limited.
Indicates the user agent that submitted the request that was rate limited. A request's user agent is defined in the User-Agent request header.