From c82392d07037da8f5dd702a75099674ff09ebe8c Mon Sep 17 00:00:00 2001
From: UrosDJ94 <89927625+UrosDJ94@users.noreply.github.com>
Date: Thu, 26 Dec 2024 15:15:53 +0100
Subject: [PATCH] Update logs-uploader.md

---
 documentation/cdn/logs/logs-uploader.md | 103 +++++++++++++++++++++++-
 1 file changed, 101 insertions(+), 2 deletions(-)

diff --git a/documentation/cdn/logs/logs-uploader.md b/documentation/cdn/logs/logs-uploader.md
index 5f7e8f70..f70eacee 100644
--- a/documentation/cdn/logs/logs-uploader.md
+++ b/documentation/cdn/logs/logs-uploader.md
@@ -269,7 +269,7 @@ You can check other fields—they can be helpful for traffic analysis or statist
   <tr>
     <td>$gcdn_internal_status_code,<br>(internal system variables)</td>
     <td>-</td>
-    <td>Initial status code. Possible values are: <code>-</code>, or <code>100700</code></td>
+    <td>Initial status code. Possible values are: <code>-</code>, or <code>1000-1200</code></td>
   </tr>
   <tr>
     <td   >$ssl_cipher<br>(internal system variable)</td>
@@ -321,6 +321,105 @@ You can check other fields—they can be helpful for traffic analysis or statist
 
 </expandable-element>
 
+<expandable-element title="Internal status codes table">
+<table>
+<thead>
+  <tr>
+    <th>Reason</th>
+    <th>HTTP Code</th>
+    <th>Internal Code</th>
+    <th>Comment</th>
+  </tr>
+</thead>
+<tbody>
+  <tr>
+    <td>Country ACL</td>
+    <td>403</td>
+    <td>1001</td>
+    <td></td>
+  </tr>
+  <tr>
+    <td>Refferer ACL</td>
+    <td>403</td>
+    <td>1002</td>
+    <td></td>
+  </tr>
+  <tr>
+    <td>IP ACL</td>
+    <td>403</td>
+    <td>1003</td>
+    <td></td>
+  </tr>
+  <tr>
+    <td>User-Agent ACL</td>
+    <td>403</td>
+    <td>1004</td>
+    <td></td>
+  </tr>
+  <tr>
+    <td>Secure Token</td>
+    <td>403</td>
+    <td>1005</td>
+    <td>If the requested link passes the authenticity check, the $secure_link variable is set to the link extracted from the request URI. Otherwise, the $secure_link variable is set to an empty string.</td>
+  </tr>
+  <tr>
+    <td>Secure Token</td>
+    <td>410</td>
+    <td>1006</td>
+    <td>If the link has a limited lifetime and the time has expired, the $secure_link variable is set to "0".</td>
+  </tr>
+  <tr>
+    <td>WAF</td>
+    <td>403</td>
+    <td>1007</td>
+    <td>Request blocked by WAF</td>
+  </tr>
+  <tr>
+    <td>Bot challenge / Testcookie</td>
+    <td>307</td>
+    <td>1008</td>
+    <td>Redirection sent by bot challenge (testcookie) </td>
+  </tr>
+  <tr>
+    <td>Blocklist</td>
+    <td>403</td>
+    <td>1009</td>
+    <td>Request blocked by bot protection blocklist </td>
+  </tr>
+  <tr>
+    <td>HTTP method</td>
+    <td>405</td>
+    <td>1200</td>
+    <td>AllowedHttpMethods enabled AND HTTP req method not in AllowedHttpMethods list</td>
+  </tr>
+  <tr>
+    <td>Streaming disabled .(ts|m3u8)</td>
+    <td>402</td>
+    <td>1201</td>
+    <td>Streaming feature disabled for the client</td>
+  </tr>
+  <tr>
+    <td>LE Validation /.well-known/acme-challenge/</td>
+    <td>404</td>
+    <td>1202</td>
+    <td>we return 404 if http_user_agent not in the list "cert-manager-challenges|acme.zerossl.com|Cpanel-HTTP-Client|Buypass validation client|Google-Certificates-Bridge|vercel-fetch|win-acme|Typhoeus|Go-http-client".</td>
+  </tr>
+  <tr>
+    <td>check $http_x_cdn_requestor not empty</td>
+    <td>403</td>
+    <td>1203</td>
+    <td>non authorized request to shield</td>
+  </tr>
+  <tr>
+    <td>Force Return</td>
+    <td>ANY</td>
+    <td>1204</td>
+    <td>Status code option, this internal code indicates that the response was generated by this feature</td>
+  </tr>
+</tbody>
+</table>
+</expandable-element>
+
 ## Configure logs for export
 
 You can enable and set up the **Logs uploader** feature in the Gcore Customer Portal on the <a href="https://gcore.com/cdn" target="_blank">Gcore CDN page</a>. 
@@ -411,4 +510,4 @@ Follow these instructions to export logs to <a href="https://gcore.com/storage"
 
 ## How near real-time log exporting works
 
-Logs are achived and exported to your endpoint every five minutes. If CDN servers are not requested and you didn’t select the **Do not send empty logs** checkbox when configuring Logs uploader, an empty log file (± 20 bytes) will be sent to your storage.
\ No newline at end of file
+Logs are achived and exported to your endpoint every five minutes. If CDN servers are not requested and you didn’t select the **Do not send empty logs** checkbox when configuring Logs uploader, an empty log file (± 20 bytes) will be sent to your storage.