This blog post explains our attitude to logging: * https://blog.cloudflare.com/what-cloudflare-logs/ https://blog.cloudflare.com/what-cloudflare-logs/ For att

This blog post explains our attitude to logging: * https://blog.cloudflare.com/what-cloudflare-logs/ https://blog.cloudflare.com/what-cloudflare-logs/ For attack data we do two things: * We find the attacks and log the attack metadata (dest ip, duration, unique IP count with HLL, etc). This is in database and stored forever. Most of the info in this blog post is from this aggregates. * We automatically capture pcaps for some packet floods. The pcaps are pretty small, contain sampled packets (not full flows), and in many cases don't contain packet payload (netflow doesn't have payloads). These pcaps are kept for about a month and are automatically rotated. The "tcpdump-like" snippets in this blog post are from these files.