# How to debug rules created with Rules Engine
import DocButton from '~/components/webkit/DocButton.vue';
import Apiv4Rollout from '~/includes/snippets/apiv4Rollout/en/snippet.mdx'
import Tabs from '~/components/tabs/Tabs'
**Debug Rules** allows you to check whether rules or rule sets created using the **Rules Engine** module for **Applications** and **Firewall** have been successfully executed in your application.
You can debug rules using the **GraphQL API**, Azion **Data Stream**, and Azion **Real-Time Events**.
There are separate instructions using [legacy Domains](/en/documentation/products/build/applications/domains/) settings and using the new [Workloads](/en/documentation/products/secure/workloads) product.
:::tip
If you're not sure which steps apply to your account, see [the Verify Your Account Migration guide](/en/documentation/products/guides/verify-account-migration/) to determine if your account has already been migrated.
:::
---
## Enabling Debug Rules
To debug your rules or rule sets, you must first activate the **Debug Rules** feature on Azion's interface.
To enable Debug Rules for Application:
1. Access [Console](https://console.azion.com).
2. Go to **Products menu** > **Application**.
3. Select an existing application to activate debug.
4. On the **Main Settings** tab, enable the **Debug Rules** option.
5. Click the **Save** button.
To enable Debug Rules for Firewall:
1. Access [Console](https://console.azion.com).
2. Go to **Products menu** > **Firewall**.
3. Select the firewall you want to configure.
4. On the **Main Settings** tab, enable the **Debug Rules** option.
5. Click the **Save** button.
:::caution[warning]
Debugging is only functional for active rule sets. Make sure to activate any rule set you wish to include in the debugging process.
:::
---
## Debugging rules with the GraphQL API
:::tip
Check the [GraphQL API documentation](/en/documentation/devtools/graphql-api/overview/) for more information.
:::
To query the available rules data in the **GraphQL API**, follow the steps described on [How to query GraphQL requests on Postman](/en/documentation/products/guides/query-graphql-postman/) using the `https://api.azionapi.net/events/graphql` URL.
Then, on Postman’s GraphQL request code box, add the following **HTTP Query**, modifying the `tsRange` to fit the time interval you want:
```graphql
query HttpQuery {
workloadEvents(
limit: 10,
filter: {
tsRange: {begin:"2023-02-14T10:10:10", end:"2023-02-15T10:10:10"}
}
orderBy: [ts_ASC]
)
{
ts
remoteAddress
requestUri
stacktrace
}
}
```
The example above shows a query for rule data using the **HTTP Events** dataset. The **limit** field filters the last 10 entries within the **tsRange** field. The presented data is ordered through the **ts** (timestamp) field.
The query above should return:
- **ts**: the time range for when each request was initiated.
- **remoteAddress**: the IP of the client that made the request to the application.
- **requestUri**: the type of HTTP request and URI.
- **stacktrace**: executed rules and rule sets.
Send your request. You’ll receive a response similar to this:
```json
{
"data": {
"workloadEvents": [
{
"ts": "2023-02-15T17:52:16Z",
"remoteAddress": "00.00.000.00",
"requestUri": "/get",
"stacktrace": "{\\\"edge_application_response\\\":[\\\"Add Azion Cookie\\\"],\\\"edge_firewall\\\":[\\\"Set WAF\\\",\\\"Rate-Limit Root\\\"],\\\"edge_application_request\\\":[\\\"Default Rule\\\",\\\"Test Send Cert to Origin 1\\\",\\\"Test Send Cert to Origin 2\\\"]}"
}
]
}
}
```
In this example, the **GraphQL API** has returned all active request and response phase rules created for **Applications**, as well as an active **Firewall** rule set.
For more information on the **GraphQL API**, visit the [datasets documentation page](/en/documentation/devtools/graphql-api/features/#datasets).
---
## Debugging rules using Data Stream
:::tip
See the [Data Stream documentation](/en/documentation/products/observe/data-stream/) for more information on how to set it up.
:::
To debug rules via Data Stream, follow these steps:
1. Access [Console](https://console.azion.com).
2. Select **Products menu** > **Data Stream**.
3. Click **+ Stream**.
4. Choose a name for your stream.
5. On the **Source** dropdown menu, select **Applications**.
6. On the **Template** dropdown menu, select **Custom Template**.
7. On the **Data Set** code box, add the following variables:
```json
{
"time": "$time",
"traceback": "$traceback"
}
```
Console - Workloads
Console - Domains
8. On **Workloads**, select between **Filter Workloads** or **All Current and Future Workloads**. See more about each option on [How to associate domains on Data Stream](/en/documentation/products/guides/data-stream-associate-workloads/).
9. On the **Destination** section, select a **Connector** on the dropdown menu.
- You'll see different fields depending on the endpoint type you choose. Find more information on each of them on the [Setting an endpoint page](/en/documentation/products/observe/data-stream/#endpoints).
10. Make sure the **Status** switch is active.
11. Click the **Save** button.
8. On **Domains**, select between **Filter Domains** or **All Current and Future Domains**. See more about each option on [How to associate domains on Data Stream](/en/documentation/products/guides/data-stream-associate-domains/).
9. On the **Destination** section, select an **Connector** on the dropdown menu.
- You'll see different fields depending on the endpoint type you choose. Find more information on each of them on the [Setting an endpoint page](/en/documentation/products/observe/data-stream/#endpoints).
10. Make sure the **Status** switch is active.
11. Click the **Save** button.
To make sure your logs are being sent to your endpoint through the configured stream, you can use [Real-Time Events](/en/documentation/products/observe/real-time-events/) to query detailed analysis.
To see all your created stream, go to the **Data Stream** page on Azion Console and select one from the list. Feel free to create multiple ones.
### Variables definition
| Variable | Definition |
| --- | --- |
| $time | Request date and time. Example: Oct. 31st, 2022 - 19:30:41 |
| $traceback | Provides the names of the rules created using Rules Engine for Applications and Firewall that are run by the request. |
:::note
The `Set WAF [Your WAF]` Firewall behavior performs special processing, allowing other rules to be processed simultaneously. As a result, logs may display other rules in the `traceback` field, even if the WAF Rule Set is configured to block and return the request. However, the WAF rules operate correctly, blocking requests that match the specified criteria. This behavior is standard for the platform.
:::
---
## Debugging rules using Real-Time Events
:::tip
See the [Real-Time Events documentation](/en/documentation/products/observe/real-time-events/) for more information on how to configure a Data Stream endpoint.
:::
To access Real-Time Events, follow these steps:
1. Access [Console](https://console.azion.com).
2. On the upper-left corner, select **Products menu** > **Real-Time Events**.
3. Select the **HTTP Requests** tab.
4. Modify the desired time range and add filters if needed.
5. Click the **Search** button.
6. Select the log body you want to inspect.
7. Look for the **traceback** field.
The **traceback** field should contain the type of rule executed and the behavior triggered within the selected time range. For instance:
```yaml
{\"edge_application_response\":[\"Add Azion Cookie\"],\"edge_firewall\":[\"Set WAF\",\"Rate-Limit Root\"],\"edge_application_request\":[\"Default Rule\",\"Test Send Cert to Origin 1\",\"Test Send Cert to Origin 2\"]}
```
In this example, the **traceback** field contains all active request and response phase rules created for **Applications**, as well as an active **Firewall** rule set.
:::note
The `Set WAF [Your WAF]` Firewall behavior performs special processing, allowing other rules to be processed simultaneously. As a result, logs may display other rules in the `traceback` field, even if the WAF Rule Set is configured to block and return the request. However, the WAF rules operate correctly, blocking requests that match the specified criteria. This behavior is standard for the platform.
:::