Delivery problems are invisible until you can see them. Edge logs and metrics turn cache behaviour, origin egress, errors, and latency into evidence you can act on. This page covers where logs go, which fields matter, and what to watch on adult video specifically.
Log export targets
Decide early where raw logs land, because the choice determines retention, cost, and how you join edge data with application data.
- Object storage — cheap long-term retention and batch analytics; the usual default for audit and takedown evidence.
- A log pipeline or SIEM — for real-time search, correlation, and alerting alongside application logs.
- A streaming endpoint — for live dashboards and automated reactions.
- A metrics system — aggregated counters for dashboards and alerts; logs answer what happened, metrics answer how much.
Export in a structured format so fields are parsed at write time rather than guessed at query time. Keep retention long enough to reconstruct a takedown or abuse report.
Raw log fields that matter
A useful edge log carries more than status and bytes. The fields that drive real decisions:
| Field | Why it matters |
|---|---|
| Timestamp, request ID | Correlate edge with origin and app |
| Client IP, ASN, region | Distinguish a regional incident from a global one |
| Host, path, method, query | Reproduce the exact request |
| Status code, bytes sent | Error mix and egress accounting |
| Byte range | Proves whether 206 seeks hit cache |
Cache status (HIT/MISS/BYPASS, Cache-Status per RFC 9211) | Separates edge from origin |
| Cache key | Diagnoses fragmentation |
| TLS protocol, HTTP version | Confirms HTTP/3 uptake and TLS floor |
Trace ID (traceparent) | Joins edge, origin, and app spans |
Include a Cache-Status value (RFC 9211) so downstream tooling can tell an edge hit from a revalidated object from an origin fill. When a log says MISS but the dashboard says high offload, the mismatch is usually a cache-key change you can read straight off the key field.
The log viewer and dashboards
The log viewer is for investigation: filter by host, path, status, cache status, region, or request ID, sample a noisy stream, and tail live during a change. Dashboards are for trends: build Grafana-style panels over the exported metrics for byte offload, origin bytes, status mix, and latency percentiles by region and ASN.
Two habits keep dashboards honest:
- Plot byte offload, not request-hit ratio. On adult sites images dominate requests but video dominates bytes, so request-hit ratio hides origin video egress. See Cache control and cache keys.
- Segment by region and ASN. A global average hides the one market that is broken.
W3C traceparent
Propagating a W3C Trace Context traceparent header from the edge through origin and application lets one trace span the whole path. Without it, an edge MISS and an origin 500 look like unrelated events. Log the trace ID at every hop, accept an inbound header where present, and generate one where absent so playback sessions can be reconstructed end to end.
What to alert on for adult video
Alert on symptoms that map to viewer experience or cost, not on every counter:
- 5xx rate above baseline, split by region.
- Origin egress rising faster than viewership — the classic sign of cache-key or TTL drift.
- Byte offload dropping sharply after a config change.
- Spikes in 402/403/410 — entitlement, geo, or takedown issues, not just errors.
- Manifest staleness — a live manifest older than its target duration.
- Rebuffer ratio and seek latency per region and ASN.
- Certificate expiry inside a comfortable window.
Where AdultInfra fits
AdultInfra wires edge logs and metrics into your existing pipeline, defines the alert set around byte offload and viewer experience, and keeps trace context flowing end to end. When something looks wrong, the evidence-collection checklist in Troubleshooting and status codes is the companion to this page. See the platform overview or contact us.