Loading...

CDN.com.tr Help

Access logs (logpush)

Receive every request your CDN serves as gzipped JSON Lines, and download the files from the panel or with cdnctl.

Access logs (logpush)

Receive every request your CDN serves as gzipped JSON Lines, and download the files from the panel or with cdnctl.

Panel path

  1. Management Panel
  2. CDN Accounts
  3. Access logs

Prerequisites

  • Owners and editors can turn delivery on or off; every role can list and download.
  • You are the data controller for these logs: decide whether you need full visitor IPs before turning delivery on.

Step-by-step guide

1

Turn on delivery

Each edge collects the account's requests and uploads a compressed file every five minutes.

  • Open Access logs.
  • Switch on log delivery.
  • Tick IP masking to keep only the network part (IPv4 /24, IPv6 /48).

Expected result: Within about ten minutes the first files appear under today's date.

cdnctl equivalent
cdnctl logs status --account $ACCOUNT_UUID
2

Download a day

Days are in UTC. Each file covers five minutes of one edge.

  • Pick the day in the date field.
  • Download single files from the list, or pull the whole day with cdnctl.

Expected result: The files for that day are on your machine; running pull again fetches only new ones.

cdnctl equivalent
cdnctl logs list --account $ACCOUNT_UUID --day 2026-09-25
cdnctl logs pull --account $ACCOUNT_UUID --day 2026-09-25 --out ./logs
3

Read the lines

One JSON object per request: ts, edge, client_ip, method, scheme, host, uri, protocol, status, bytes, cache (HIT/MISS), request_time, origin_time, referer, user_agent, country, asn.

  • Decompress and filter with any log tool, e.g. jq.
  • Load them into Elasticsearch, BigQuery or your SIEM as JSON Lines.

Expected result: You can answer "what happened to this request" from your own data.

cdnctl equivalent
zcat ./logs/*.jsonl.gz | jq -r 'select(.status >= 500) | [.ts, .host, .uri, .status] | @tsv'

Verification

  • A download link only ever points inside your account's own folder and expires after 15 minutes.
  • With masking on, client_ip ends in .0 (IPv4) or :: (IPv6).

Use cases

You need request-level data the reports do not show: one visitor's requests, the status codes of a single URL, or logs for your own SIEM.

Quick workflow

  1. Open Access logs for the account.
  2. Turn on delivery; choose IP masking if you do not need full visitor IPs.
  3. Wait about ten minutes for the first files.
  4. Download a day from the panel, or pull it with cdnctl.

Checks

  • Every edge that serves the account is ready for log delivery; until then the switch stays disabled.
  • Stored log files count toward the monthly pool as storage (the month's peak).
  • Files are deleted automatically after 30 days.

Related pages

Export reports as CSV or Excel

Data consumption, Cache overview and the security events table each hand you the same numbers as a file: CSV for a script, XLSX for a spreadsheet.