Alibaba Cloud Web Application Firewall (WAF) Monitoring Integration
Site24x7 provides extensive visibility into Alibaba Cloud Web Application Firewall (WAF) performance and protection efficiency. It tracks request throughput, error ratios, WAF rule detection and blocking activity, ACL and CC defense metrics, and system resource usage to help maintain the availability and reliability of your web applications. When you integrate your Alibaba Cloud account with Site24x7, all WAF instances are automatically discovered and continuously monitored.
Use cases
- Traffic and request monitoring: Track queries per second (QPS) and WAF-specific traffic to understand load distribution and detect surges.
- Error and response analysis: Monitor 4xx and 5xx error ratios to identify potential client- or server-side issues.
- Security enforcement tracking: View WAF detection rates and blocked request counts to measure protection effectiveness.
- ACL and CC protection visibility: Analyze access control and Challenge Collapsar defense patterns to mitigate attacks.
- Resource health monitoring: Monitor CPU, memory, and disk utilization to ensure WAF stability and performance.
Setup and configuration
- Log in to your Site24x7 account and navigate to Cloud > Alibaba Cloud > Add Monitor.
- In the Edit Alibaba Cloud Monitor page, select Web Application Firewall (WAF) from the Service Types list.
- Once added, go to Cloud > Alibaba > WAF to view dashboards and performance metrics.
Supported metrics
Traffic & QPS
| Metric name | Description | Unit |
|---|---|---|
| QPS | The number of queries processed by the WAF per second. | Count |
| QPS (WAFv3) | The number of queries processed by the WAF per second in the WAFv3 environment. | Count |
| QPS Ratio | The ratio of query traffic handled by the WAF. | Count |
| QPS Ratio (WAFv3) | The ratio of query traffic handled by WAFv3. | Count |
| QPS Ratio Down | The decrease in the query-per-second ratio compared to the previous interval. | Count |
| QPS Ratio Down (WAFv3) | The decrease in the query-per-second ratio for WAFv3 compared to the previous interval. | Count |
| WAF QPS | The number of web requests inspected by the WAF per second. | Count |
| WAF QPS (WAFv3) | The number of web requests processed by WAFv3 per second. | Count |
| WAF QPS Max (WAFv3) | The maximum number of web requests processed per second in WAFv3. | Count |
Error Ratios
| Metric name | Description | Unit |
|---|---|---|
| 4xx Ratio | The number of 4xx (client error) responses generated by the WAF. | Count |
| 4xx Ratio (WAFv3) | The number of 4xx responses recorded in WAFv3. | Count |
| 4xx Ratio (WAFv3 v2) | The number of 4xx responses recorded in WAFv3 v2. | Count |
| 5xx Ratio | The number of 5xx (server error) responses generated by the WAF. | Count |
| 5xx Ratio (WAFv3) | The number of 5xx responses recorded in WAFv3. | Count |
| 5xx Ratio (WAFv3 v2) | The number of 5xx responses recorded in WAFv3 v2. | Count |
WAF Detection & Blocking
| Metric name | Description | Unit |
|---|---|---|
| WAF Rate (5m) | The number of web requests inspected by the WAF within a five-minute period. | Count |
| WAF Rate 5m (WAFv3) | The number of inspected requests recorded in WAFv3 within a five-minute period. | Count |
| WAF Rate 5m (WAFv3 v2) | The number of inspected requests recorded in WAFv3 v2 within a five-minute period. | Count |
| WAF Blocks (5m) | The number of web requests blocked by the WAF within a five-minute period. | Count |
| WAF Blocks 5m (WAFv3) | The number of web requests blocked by WAFv3 within a five-minute period. | Count |
ACL Protection
| Metric name | Description | Unit |
|---|---|---|
| ACL Rate (5m) | The number of requests processed under Access Control List (ACL) rules within a five-minute period. | Count |
| ACL Rate 5m (WAFv3) | The number of ACL-inspected requests recorded in WAFv3 within a five-minute period. | Count |
| ACL Rate 5m (WAFv3 v2) | The number of ACL-inspected requests recorded in WAFv3 v2 within a five-minute period. | Count |
| ACL Blocks (5m) | The number of requests blocked by ACL rules within a five-minute period. | Count |
| ACL Blocks 5m (WAFv3) | The number of ACL-blocked requests recorded in WAFv3 within a five-minute period. | Count |
CC Protection
| Metric name | Description | Unit |
|---|---|---|
| CC Rate (5m) | The number of requests inspected under CC (Challenge Collapsar) protection within a five-minute period. | Count |
| CC Rate 5m (WAFv3) | The number of requests inspected under CC protection in WAFv3 within a five-minute period. | Count |
| CC Rate 5m (WAFv3 v2) | The number of requests inspected under CC protection in WAFv3 v2 within a five-minute period. | Count |
| CC Blocks (5m) | The number of requests blocked under CC protection within a five-minute period. | Count |
| CC Blocks 5m (WAFv3) | The number of requests blocked under CC protection in WAFv3 within a five-minute period. | Count |
System Resource Usage
| Metric name | Description | Unit |
|---|---|---|
| CPU Usage | CPU utilization for the WAF instance. | Count |
| CPU Usage (Hybrid WAFv3) | CPU utilization in the hybrid WAFv3 environment. | Count |
| Memory Usage | Memory utilization for the WAF instance. | Count |
| Memory Usage (Hybrid WAFv3) | Memory utilization in the hybrid WAFv3 environment. | Count |
| Disk Usage | Disk usage for the WAF instance. | Count |
| Disk Usage (Hybrid WAFv3) | Disk usage for the hybrid WAFv3 environment. | Count |
| Active Monitor | The number of active monitoring processes running on the WAF instance. | Count |
| Active Monitor (Hybrid WAFv3) | The number of active monitoring processes in the hybrid WAFv3 environment. | Count |
Threshold configuration
- Go to Admin > Configuration Profiles > Threshold and Availability.
- Create or edit a threshold profile for Web Application Firewall (WAF).
- Assign the profile to the respective monitors to trigger alerts.
IT automation
Site24x7's IT Automation tools help with automatically resolving performance degradation issues. When a breach occurs, the alarm engine continuously examines the system events for which thresholds have been defined and performs the mapped automation.
- Go to Admin > IT Automation Templates.
- Create a new automation rule.
- Map the rule to the monitor for proactive resolution.
How to configure IT Automation for a monitor
Configuration rules
With Site24x7's Configuration Rules, you can set parameters like Threshold Profile, Notification Profile, Tags, and Monitor Group for multiple monitors and automate the configuration settings of your monitoring resources. Automatically assign these settings when new Web Application Firewall (WAF) monitors are added.
How to add a Configuration Rule