First protected app / Step 6 of 6
Read logs and plan training
Source and package versions
One AIWAF repository.
Python: py/aiwaf/ · Node.js: js/ · Rust/WASM: rust/ · Java: java/.
Source and canonical README.
Versions shown describe the source checkout; package releases are independent.
Current Python/Node source targets are aiwaf 1.1.8 (Python) and
aiwaf 1.1.5 (npm), with Rust/Python 0.2.7 and
WASM 0.2.5 and Java 1.3.5. Sandbox guides retain their separately pinned builds.
Enforcement decisions are easier to operate when you can connect them to request observations. The tutorial already selects logging; now inspect the files it writes and understand the boundary between logging and training.
1. Read the access log
From the app directory:
python -c "from pathlib import Path; print(Path('aiwaf_logs/access.log').read_text())"AIWAF_LOG_FORMAT='json' writes JSON records to the access log. Look for the request path and response status for the message/preview calls. Timestamps, durations, addresses, and record details depend on the runtime; the file is evidence of the observed requests, not a trained model.
2. Separate three kinds of state
| Data | Purpose | Tutorial behavior |
|---|---|---|
| Rate counters | Decide whether the current request crosses the window | In memory in this process; lost on restart |
| Request logs / CSV state | Record observations and persist store data when used | Files under the configured directories |
| Model artifact | Score behavior after offline training | No anomaly model is trained or selected here |
Keeping CSV files does not make rate counters shared across workers. See shared state configuration before scaling beyond a single process.
3. Inspect the trainer before running it
aiwaf flask train --help
aiwaf flask model --helpFor an application with a representative combined-format log corpus, the Flask trainer accepts:
aiwaf flask train --log-dir /path/to/combined-format-logsThis is a separate operational example, not the next command to run on these few JSON tutorial records. Check the installed trainer's supported input formats, volume thresholds, output path, and model diagnostics. Convert or collect a supported log format deliberately; do not assume the logger format is the trainer format.
Current Python persisted models use JSON. A file with a different extension does not become a compatible model by renaming it. Collect representative traffic, train with the runtime's supported workflow, and verify model loading before enabling anomaly inference. Logs can contain request data; configure retention and redaction for your application.
4. Choose your next task
- Integrate the wider Flask middleware set.
- Follow policy, deterministic checks, observations, and training through the architecture.
- Configure defaults, exemptions, and a shared backend.
- Operate Python training and state.
- Upgrade an existing installation.