Logs & Reports
Access and WAF event logs are in Console → WAF → [your domain] → Logs. To stream logs to your own collector, configure Console → WAF → [your domain] → Log Forwarding (TCP or TCP+TLS). Every config change is captured in the Audit Log.
Filtering live logs
Section titled “Filtering live logs”The access log shows every request in real time. Filter by:
- Response status (2xx, 3xx, 4xx, 5xx, blocked)
- Country and ASN
- Path and method
- Response time
- Rule that matched
- Bot score and category
- Cache status (hit, miss, bypass)
Usage reports
Section titled “Usage reports”Usage reports summarise traffic over a selected period (year, month, day) with a per-region breakdown (Turkey, Europe/North America, Asia/Oceania). Reports show clean traffic delivered, blocked traffic, and bandwidth. Useful for billing verification and capacity planning.
Log forwarding
Section titled “Log forwarding”HEIMWALL can stream every access log and WAF event line to a collector of your choice. Go to Console → WAF → [your domain] → Log Forwarding, enter the collector address (host:port) and choose a transport: TCP for reliable delivery or TCP+TLS for encrypted delivery. When enabled, every server handling your domain starts forwarding events immediately. The collector must listen on the selected protocol.
Compatible with Vector, Fluentd, Logstash and similar tools.
Audit log and notifications
Section titled “Audit log and notifications”Every change to your HEIMWALL configuration is recorded in the audit log: rule changes, certificate uploads, DNS record edits, user access changes. Each entry shows who made the change, from what IP, and at what time. The notification log shows every email HEIMWALL has sent your account (alerts, reports, renewal notices).