user_id :您的阿里云账号ID | SELECT t1.user_id, t1.now1mQPS, t1.past1mQPS, de_ratio, t1.host, t2.Rate_2XX, Rate_3XX, Rate_4XX, Rate_5XX, aveQPS FROM ( ( SELECT user_id, round(c [1] / 60, 0) AS now1mQPS, round(c [2] / 60, 0) AS past1mQPS, round( 100-round(c [1] / 60, 0) / round(c [2] / 60, 0) * 100, 2 ) AS de_ratio, host FROM ( SELECT compare(t, 60) AS c, host, user_id FROM ( SELECT COUNT(*) AS t, host, user_id FROM log GROUP BY host, user_id ) GROUP BY host, user_id ) WHERE c [3] < 0.9 AND ( c [1] > 180 or c [2] > 180 ) ) t1 JOIN ( SELECT user_id, host, Rate_2XX, Rate_3XX, Rate_4XX, Rate_5XX, countall / 60 AS "aveQPS", status_2XX, status_3XX, status_4XX, status_5XX, countall FROM ( SELECT user_id, host, round( round(status_2XX * 1.0000 / countall, 4) * 100, 2 ) AS Rate_2XX, round( round(status_3XX * 1.0000 / countall, 4) * 100, 2 ) AS Rate_3XX, round( round(status_4XX * 1.0000 / countall, 4) * 100, 2 ) AS Rate_4XX, round( round(status_5XX * 1.0000 / countall, 4) * 100, 2 ) AS Rate_5XX, status_2XX, status_3XX, status_4XX, status_5XX, countall FROM ( SELECT user_id, host, count_if( status >= 200 and status < 300 ) AS status_2XX, count_if( status >= 300 and status < 400 ) AS status_3XX, count_if ( status >= 400 and status < 500 and status <> 444 and status <> 405 ) AS status_4XX, count_if( status >= 500 and status < 600 ) AS status_5XX, COUNT(*) AS countall FROM log GROUP BY host, user_id ) ) WHERE countall > 1 ) t2 on t1.host = t2.host ) ORDER BY de_ratio DESC LIMIT 5该图表中包含now1mpqs（当前一分钟的平均QPS）、past1mqps（过去一分钟的平均QPS）、de_ratio（QPS下降率）、host等字段，您可以根据需要使用这些字段设置告警条件。
原文链接：https://www.alibabacloud.com/help/zh/web-application-firewall/latest/examples-of-alert-configurations-based-on-waf-logs
原创文章，作者：优速盾-小U，如若转载，请注明出处：https://www.cdnb.net/bbs/archives/20813
