Bots, DNS, Workers and RUM

Bots

Monitor → Cloudflare → Bots. The bot-score distribution of your traffic, and which paths attract the most automated requests.

Useful for two things: sizing how much of your traffic is not people, and spotting a scraper before it becomes a capacity problem.

DNS

Monitor → Cloudflare → DNS. Query volume, response codes and the busiest records.

An NXDOMAIN rate that rises is usually one of: a record deleted by mistake, a service whose clients still ask for an old name, or somebody enumerating your subdomains.

Workers

Monitor → Cloudflare → Workers. Per-worker invocations, CPU time, errors and subrequests.

CPU time is the one to watch — Workers are billed and limited on it, and a worker that creeps towards the limit fails suddenly rather than gradually.

RUM — real-user monitoring

Monitor → Cloudflare → RUM. What actual browsers experienced: Core Web Vitals, by page and by country.

RUM and synthetic checks answer different questions. A synthetic check runs from one place on a good connection; RUM is everybody, including the ones on a phone on a train. When they disagree, RUM is what your users had.

Firewall

Monitor → Cloudflare → Firewall. Which rules are matching, what they are blocking, and how the mix changes.

A firewall rule whose match rate suddenly rises is worth a look in both directions: it may be blocking an attack, or it may be blocking your own users after a deploy changed a request shape.