I'm trying to set up Cloudflare for a new project and I'm a bit confused. I've read the docs, but I'm nervous about misreading the logs.
If my site becomes unreachable, how can I tell if Cloudflare is actively mitigating a DDoS and my origin is protected, versus my own server just being down or having a separate network issue? I work with Salesforce a lot, where we can see clear audit trails, but I'm not sure what the equivalent signal is here.
Are there specific statuses in the analytics or firewall events I should look for first?
Yeah, the difference between mitigation and a simple outage can be really hard to spot when you're new to it. I've felt that panic too.
The firewall events in your dashboard are probably your first stop. If you're under attack, you should see a huge spike in blocked requests, likely with a rule name like "DDoS" or a managed rule. That's your audit trail. If your origin is just down, the graph might show a cliff of 5xx errors instead, with fewer blocks.
But then, if Cloudflare can't reach your origin at all, doesn't it just show 5xx errors anyway? How do you separate that from a DDoS? I guess you'd look for a high number of "challenge" or "block" actions versus just "connection failed"? Would love if someone more experienced could confirm.