> For the complete documentation index, see [llms.txt](https://docs.link11.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.link11.com/product-guides/web-ddos/interface/waf-logs.md).

# WAF Logs

<figure><img src="/files/KewC0p8Ke3aSe2If1Zgt" alt=""><figcaption></figcaption></figure>

## Overview

The WAF Logs display requests that matched [WAF Rules](/product-guides/web-ddos/interface/waf-rules.md) within the specified time.&#x20;

Note: appearing in this list does not necessarily mean the request was blocked (unless the list is filtered to exclusively display blocked requests).

## Controls

### **Instance Dropdown**

Selects the instance for which WAF logs will be displayed. (Only includes those instances for which WAF was purchased.)

### **Date and time selector**

This specifies the time frame for which logs will be displayed.

### **Export button**

Exports the WAF logs as an Excel file.

### **Search Bar**

For searching through the logs. Supported search fields are: Client, URL, Message, Rule ID. (Does not look at date or severity.)

### **WAF Config pulldown**

Redirects to [WAF Rules](/product-guides/web-ddos/interface/waf-rules.md), and will display the Rules according to the filter selected (All Rules or Disabled Rules).&#x20;

## **Log Entries**

Log entries display WAF rules that matched incoming requests.&#x20;

An appearance in this list does not necessarily mean that the request was blocked. To see the action taken for a given log entry, expand the entry to view the following data:

<figure><img src="/files/ifjQfHE7P89G1Mk8UxdS" alt=""><figcaption></figcaption></figure>

Log entries are initially sorted by date, but can be sorted by other columns if selected.

Entries display the client (IP) that triggered the hit, the severity of the trigger, the URL on which the hit was logged, the message for the triggered Rule, and the Rule ID.

{% hint style="info" %}
Admins can (and should) use the Log Entries to determine which WAF Rules should remain active, versus those which are producing False Positives and should be disabled. \
\
Rules can be disabled on the [WAF Rules](/product-guides/web-ddos/interface/waf-rules.md) page, or directly here in the Logs by clicking on the entry's **Rule ID**.
{% endhint %}