TL;DR

When an event summary is not enough, WP fail2ban Premium can record the complete XML-RPC request body with its date, source address, and length. You can inspect the exact methods and values the client sent.

Raw bodies may contain usernames, passwords, content, or other private values, and sustained traffic can make the file grow quickly. Enable raw logging for a defined investigation, protect the file, and stop collecting once you have the evidence you need.

Capture the request you need to understand

WP fail2ban Premium can append each XML-RPC request body to a separate file with enough source and timing information to place it in the investigation. You can see the exact methods and parameters the client presented.

Structured events remain the better way to answer routine questions efficiently; the raw log preserves the detail they deliberately leave out.

Use the raw body to answer focused questions

The additional detail can show whether an unfamiliar client is using an expected method, how a malformed request differs from normal traffic, or what a repeated probe is actually sending.

Raw logging supports investigation. It does not classify the request, decide whether it is hostile, or create a firewall block by itself.

Treat the log as sensitive evidence

XML-RPC carries application data inside the request body. Depending on the method, that can include authentication credentials, draft content, and other values that do not belong in an ordinary long-lived log.

The file also grows with every request while logging remains enabled. Access, storage, retention, and deletion therefore form part of the security decision, not merely housekeeping after the investigation.

Collect deliberately and then stop

Raw logging is disabled by default. Enable it when you have a question the normal event history cannot answer, limit the collection period, and remove or archive the file securely when the investigation is complete.

Persistent Premium events remain the better source for routine monitoring. The raw log is the instrument you reach for when the summary is not enough.

More about XML-RPC policy.