Alibaba Cloud service log collection - Simple Log Service - Simple Log Service

Simple Log Service (SLS) collects logs from Alibaba Cloud services, including computing, storage, security, database, and other categories. These logs record operations, service status, and business activity.

Overview

Automatic collection

When you enable log collection for a cloud service, SLS automatically:

Deploys a built-in agent (such as Logtail) on the target instance. No manual installation required.
Creates Logstores in SLS to store the logs.
Transmits log data to SLS in real time, organized by service type.

Stop billing

To stop billing, disable both data collection and storage:

Disable log collection
- Turn off the SLS integration feature in the cloud service console.
- After collection stops, no new logs are transmitted.
Clean up storage resources
- In the Simple Log Service console, delete the Project and Logstore created for the cloud service.
- Delete all linked instances to avoid ongoing storage fees.

Supported services

Computing

Cloud service	Enable/Disable	Default Project and Logstore	Log fields	Note
Elastic Compute Service (ECS)	Host text log collection	Custom	-	Uses a custom Project and Logstore.
Distributed Cloud Container Platform for Kubernetes (ACK One)	Enable control plane component logs and audit logs for ACK One master instances	Project: Custom k8s-log-Master instance ID Logstore: apiserver-Master instance ID kcm-Master instance ID application-controller-Master instance ID cluster-operator-Master instance ID audit-Master instance ID	-	Project name: k8s-log-Master instance ID (e.g., `k8s-log-ab79abd******************f2a8f45`). Logstores with the master instance ID suffix are automatically created.
	Enable/Disable GitOps control plane logs and audit logs for ACK One	Project: k8s-log-Master instance ID Logstore: gitops-argocd-logstore	-	Project name: k8s-log-Master instance ID (e.g., `k8s-log-ab79abd******************f2a8f45`). A Logstore named `gitops-argocd-logstore` is created in this Project.
	Enable/Disable workflow logs for ACK One	Project: k8s-log-Master instance ID Logstore: workflow-logstore	-	Project name: k8s-log-Master instance ID (e.g., `k8s-log-ab79abd******************f2a8f45`). A Logstore named `workflow-logstore` is created in this Project.
ACK Managed and Dedicated Clusters	Enable/Disable control plane component logs for ACK managed and dedicated clusters	Project: Custom k8s-log-Cluster ID Logstore: apiserver-Cluster ID ccm-Cluster ID scheduler-Cluster ID kcm-Cluster ID	Default fields for ACK Pro control plane logs	Project name: k8s-log-Cluster ID (e.g., `k8s-log-cb70fbd******************f2a8f45`). Logstores with the cluster ID suffix are automatically created.
	Collect Kubernetes cluster text logs (DaemonSet)	Project: k8s-log-Cluster ID Logstore: config-operation-log	Default fields for container text logs Default fields for Kubernetes cluster standard output	Project name: k8s-log-Cluster ID (e.g., `k8s-log-cb70fbd******************f2a8f45`). A Logstore named `config-operation-log` is automatically created.
	Enable/Disable container internal operation audit logs for ACK managed and dedicated clusters	Project: k8s-log-Cluster ID Logstore: advaudit-Cluster ID	-	Project name: k8s-log-Cluster ID (e.g., `k8s-log-cb70fbd*****************f2a8f45`). Logstore name: advaudit-Cluster ID* (e.g., `advaudit-cb70fbd******************f2a8f45`).
	Enable Kubernetes event logs for ACK managed and dedicated clusters	Project: Custom k8s-log-Cluster ID Logstore: k8s-event internal-alert-history security-inspector-configaudit-Cluster ID	-	Project name: k8s-log-Cluster ID (e.g., `k8s-log-cb70fbd******************f2a8f45`). Logstores with the cluster ID suffix are automatically created.
	Enable Nginx Ingress access logs for ACK managed and dedicated clusters	Project: k8s-log-Cluster ID Logstore: nginx-ingress nginx-ingress-metrics-result	Metric fields extracted from Kubernetes Ingress access logs Fields in Kubernetes Nginx Ingress access logs	Project name: k8s-log-Cluster ID (e.g., `k8s-log-cb70fbd******************f2a8f45`). Logstores named `nginx-ingress` and `nginx-ingress-metrics-result` are automatically created.
ACK Serverless Clusters	Enable/Disable control plane component logs for ACK Serverless	Project: Custom k8s-log-Cluster ID Logstore: apiserver-Cluster ID ccm-Cluster ID kcm-Cluster ID	-	Project name: k8s-log-Cluster ID (e.g., `k8s-log-cb70fbd******************f2a8f45`). Logstores with the cluster ID suffix are automatically created.
ACK Edge Clusters	Enable/Disable control plane component logs for ACK Edge	Project: Custom k8s-log-Cluster ID Logstore: alb-Cluster ID apiserver-Cluster ID audit-Cluster ID ccm-Cluster ID controlplane-events-Cluster ID k8s-event kcm-Cluster ID scheduler-Cluster ID	-	Project name: k8s-log-Cluster ID (e.g., `k8s-log-cb70fbd******************f2a8f45`). Logstores with the cluster ID suffix are automatically created.
WUYING Workspace	Enable operation logs for WUYING Workspace	Project: elastic-desktop-Custom Logstore: elastic_desktop_Custom	-	Project name: elastic-desktop-Custom (e.g., `elastic-desktop-test`). A Logstore named `elastic_desktop_test` is automatically created.
Function Compute 2.0	Enable access logs for Function Compute 2.0	Project: Custom aliyun-fc-cn-Region ID-Random ID Logstore: function-log	Function Compute 2.0 metric fields	If SLS is enabled when you create a service: The system creates a Project named `aliyun-fc-cn-hangzhou-cc**d0-d3-54-ad-698******d7d` (region ID cn-hangzhou indicates China (Hangzhou)). A Logstore named `function-log` is created by default. If SLS is not enabled when you create the service, manually select a custom Project and Logstore when updating the service.
Function Compute 3.0	Enable access logs for Function Compute 3.0	Project: serverless-cn-Region ID-Random ID Logstore: default-logs	Function Compute 3.0 metric fields	When you create a function, the log feature is enabled by default. The system creates a Project named `serverless-cn-hangzhou-cc**d0-d3-54-ad-698******d7d` (region ID cn-hangzhou indicates China (Hangzhou)). A Logstore named `default-logs` is created by default. If SLS is not enabled when you create the service, manually select a custom Project and Logstore when updating the service.

Storage

Cloud service	Enable/Disable	Default Project and Logstore	Log fields	Note
Object Storage Service (OSS)	Enable/Disable access logs for OSS	Project: oss-log-Alibaba Cloud account ID-Region ID Logstore: oss-log-store	-	The system creates a Project named `oss-log-1290******9680-cn-hangzhou` and a Logstore named `oss-log-store`. Here, `1290******9680` is your Alibaba Cloud account ID.
File Storage NAS	Enable access logs for NAS Disable access logs for NAS	Project: nas-Alibaba Cloud account ID-Region ID Logstore: General-purpose NAS: NFS protocol file system: nas-nfs SMB protocol file system: nas-smb-access-log Extreme NAS file system: nas-extreme-nfs	NAS log fields	The system creates a Project named `nas-1290******9680-cn-hangzhou`, where `1290******9680` is your Alibaba Cloud account ID. Logstores vary by NAS type: General-purpose NAS: `nas-nfs` (NFS protocol file system) or `nas-smb-access-log` (SMB protocol file system). Extreme NAS file system: `nas-extreme-nfs`.
Elastic Block Storage	Enable/Disable access logs for EBS	Project: aliyun-product-data-Alibaba Cloud account ID-Region ID Metricstore: ebs_disk_metric	-	The system creates a Project named `aliyun-product-data-1290******9680-cn-hangzhou` and a Metricstore named `ebs_disk_metric`. Here, `1290******9680` is your Alibaba Cloud account ID.

Security

Cloud service	Enable/Disable	Default project and logstore	Log fields	Note
Anti-DDoS Proxy	Enable full logs for DDoS	Anti-DDoS Proxy (Chinese Mainland) Project: ddoscoo-project-Alibaba Cloud account ID-cn-hangzhou Logstore: ddoscoo-logstore Anti-DDoS Proxy (Outside Chinese Mainland) Project: ddosdip-project-Alibaba Cloud account ID-ap-southeast-1 Logstore: ddosdip-logstore	Anti-DDoS Proxy full log fields	The system creates a Project named `ddoscoo-project-1290******9680-cn-hangzhou` and a Logstore named `ddoscoo-logstore`. Here, `1290******9680` is your Alibaba Cloud account ID, and `cn-hangzhou` indicates the Chinese Mainland region.
Anti-DDoS Origin	Enable Mitigation Logs for Anti-DDoS Origin	Project: ddosbgp-project-Alibaba Cloud account ID-cn-hangzhou Logstore: ddosbgp-logstore	Anti-DDoS Origin log fields	The system creates a Project named `ddosbgp-project-1290******9680-cn-hangzhou` and a Logstore named `ddosbgp-logstore`. Here, `1290******9680` is your Alibaba Cloud account ID.
Security Center	Enable logon logs for Security Center	Project: sas-log-Alibaba Cloud account ID-Region ID Logstore: sas-log	Security Center security logs Vulnerability Log Baseline Log Alert Logs Cloud Platform Configuration Assessment Security Center network logs DNS Log Internal DNS logs Session Access Log Security Center host logs Process Network Login Brute Force Process Snapshot Log Account Snapshot Log Port Snapshot Log DNS Query	The system creates a Project named `sas-log-1290******9680-cn-hangzhou` and a Logstore named `sas-log`. Here, `1290******9680` is your Alibaba Cloud account ID.
WAF 2.0	Enable full logs for WAF 2.0	WAF instances in the Chinese mainland Project: waf-project-Alibaba Cloud account ID-cn-hangzhou, located in China (Hangzhou). Logstore: waf-logstore WAF instances outside the Chinese mainland Project: waf-project-Alibaba Cloud account ID-ap-southeast-1, located in Singapore. Logstore: waf-logstore	WAF 2.0 log fields	The system creates a Project named `waf-project-1290******9680-cn-hangzhou` and a Logstore named `waf-logstore`. Here, `1290******9680` is your Alibaba Cloud account ID. The cn-hangzhou region indicates a Chinese mainland WAF instance.
WAF 3.0	Enable/Disable full logs for WAF 3.0	WAF instances in the Chinese mainland Pay-as-you-go instances Project: wafnew-project-Alibaba Cloud account ID-cn-hangzhou, located in China (Hangzhou). Logstore: wafnew-logstore Subscription instances Project: wafng-project-Alibaba Cloud account ID-cn-hangzhou, located in China (Hangzhou). Logstore: wafnew-logstore WAF instances outside the Chinese mainland Pay-as-you-go instances Project: wafnew-project-Alibaba Cloud account ID-ap-southeast-1, located in Singapore. Logstore: wafnew-logstore Subscription instances Project: wafng-project-Alibaba Cloud account ID-ap-southeast-1, located in Singapore. Logstore: wafnew-logstore	WAF 3.0 log fields	The system creates a Project named `wafnew-project-1290******9680-cn-hangzhou` and a Logstore named `wafnew-logstore`. Here, `1290******9680` is your Alibaba Cloud account ID. The wafnew-project prefix with cn-hangzhou indicates a pay-as-you-go WAF instance in the Chinese mainland.
Cloud Firewall	Enable Traffic Logs of Cloud Firewall	Project: cloudfirewallnew-project-Alibaba Cloud account ID-Region ID Logstore: cloudfirewallnew-logstore	Log fields of Cloud Firewall	The system creates a project named `cloudfirewallnew-project-1290******9680-cn-hangzhou` and a Logstore named `cloudfirewallnew-logstore`. Here, `1290******9680` is your Alibaba Cloud account ID.
ActionTrail	Enable operation event logs for ActionTrail Disable operation event logs for ActionTrail	Project: custom project Logstore: actiontrail_Trail name	ActionTrail event log fields	Uses a custom Project and Logstore. When creating a trail, select a custom Project. The system creates a Logstore named `actiontrail_test001`, where `test001` is your trail name.
ActionTrail	Enable Alibaba Cloud-initiated events for ActionTrail	Custom	Alibaba Cloud-initiated events fields	Select a custom Project and Logstore for storage.
Cloud Config	Enable audit logs for Cloud Config	Custom	Cloud Config log fields	Select a custom Project and Logstore for storage.

Networking

Cloud service	Enable/Disable	Default Project and Logstore	Log fields	Note
Classic Load Balancer (CLB) Layer 7	Enable/Disable access logs for CLB	Custom	CLB access log fields	Select a custom Project and Logstore for storage.
Virtual Private Cloud (VPC)	Enable/Disable flow logs for VPC	Custom	VPC flow log fields	Select a custom Project and Logstore for storage.
Cloud Enterprise Network (CEN)	Enable/Disable flow logs for CEN	Custom	CEN flow log fields	Select a custom Project and Logstore for storage.
Smart Access Gateway (SAG)	Enable flow logs for SAG Stop, Disable flow logs for SAG	Custom	SAG flow log fields	Select a custom Project and Logstore for storage.
Elastic IP Address (EIP)	Enable/Disable high-precision monitoring that is accurate to seconds for EIP	Custom	-	Select a custom Project and Logstore for storage.
API Gateway	Enable gateway logs for API Gateway	Project: aliyun-product-data-Alibaba Cloud account ID-Region ID Logstore: apig-access-log apig-plugin-log	API Gateway log fields	The system creates a Project named `aliyun-product-data-<code data-init-id="9c7d0fbf40hrc" data-tag="code" id="061ddd61cfrkk">1290******9680`-cn-hangzhou and Logstores named `apig-access-log` and `apig-plugin-log` to store access logs and plugin logs respectively. Here, `1290******9680` is your Alibaba Cloud account ID.
Dynamic Content Delivery Network (DCDN)	Enable/Disable real-time logs for DCDN	Project: Chinese Mainland: dcdn-edge-rtlog-cn-Random ID Outside Chinese Mainland: dcdn-edge-rtlog-sg-Random ID Logstore: dcdn-edge-rtlog	-	The system creates a Project named `dcdn-edge-rtlog-cn-02**c4` and a Logstore named `dcdn-edge-rtlog`. Here, `02**c4` is a random number, and `cn` indicates the Chinese Mainland.
Global Accelerator (GA)	Enable/Disable access logs for GA	Custom	GA log fields	Select a custom Project and Logstore for storage.

Databases

Cloud service	Enable/Disable	Default Project and Logstore	Log fields	Note
ApsaraDB RDS	Enable audit logs for ApsaraDB RDS	Custom	ApsaraDB RDS audit log fields	Select a custom Project and Logstore for storage.
Tair (Redis OSS-compatible)	Enable audit logs for Tair	Project: nosql-Alibaba Cloud account ID-Region ID Logstore: redis_audit_log_standard redis_slow_run_log	-	The system creates a Project named `nosql-1290******9680-cn-hangzhou` and Logstores named `redis_audit_log_standard` and `redis_slow_run_log`. Here, `1290******9680` is your Alibaba Cloud account ID.
ApsaraDB for MongoDB	Enable audit logs for MongoDB Disable audit logs for MongoDB	Project: nosql-Alibaba Cloud account ID-Region ID Logstore: mongo_audit_log_standard mongo_slow_run_log	-	The system creates a Project named `nosql-1290******9680-cn-hangzhou` and Logstores named `mongo_audit_log_standard` and `mongo_slow_run_log`. Here, `1290******9680` is your Alibaba Cloud account ID.

Analytics Computing

Cloud service

Enable/Disable

Default Project and Logstore

Log fields

Note

Data Management (DMS)

Enable operation logs for DMS

Custom

DMS operation log fields

Select a custom Project and Logstore for storage.

E-MapReduce (EMR)

Enable/Disable operation logs for E-MapReduce (EMR)

Project: custom
Logstore: emr_EMR service name_log

Select a custom Project and Logstore for storage.

Cloud Communication

Cloud service	Enable/Disable	Default Project and Logstore	Log fields	Note
Short Message Service (SMS)	Enable/Disable SMS logs for Short Message Service	Project: sms-log-Alibaba Cloud account ID Logstore: sms-log	Short Message Service log fields	The system creates a Project named `sms-log-1290******9680` and a Logstore named `sms-log`. Here, `1290******9680` is your Alibaba Cloud account ID.

Internet of Things

Cloud service	Enable/Disable	Default Project and Logstore	Log fields	Note
IoT Platform	Enable/Disable operational logs for IoT	Project: iot-log-Alibaba Cloud account ID-Region ID Logstore: iot_logs	IoT operational log fields	The system creates a Project named `iot-log-1290******9680-cn-hangzhou` and a Logstore named `iot_logs`. Here, `1290******9680` is your Alibaba Cloud account ID.

Middleware

Cloud service	Enable/Disable	Default Project and Logstore	Log fields	Note
Microservices Engine (MSE)	Enable gateway logs for MSE	Project: Custom aliyun-product-data-Alibaba Cloud account ID-Region ID Logstore: mse_gw_access_log	MSE gateway log delivery fields	The system creates a Project named `aliyun-product-data-1290******9680-cn-hangzhou` and a Logstore named `mse_gw_access_log`. Here, `1290******9680` is your Alibaba Cloud account ID.
Enterprise Distributed Application Service (EDAS)	Enable business logs for EDAS	Custom	-	Select a custom Project and Logstore for storage.
Service Mesh (ASM)	Enable control plane logs for Service Mesh	Project: Custom mesh-log-ASM instance ID Logstore istio-ASM instance ID audit-ASM instance ID	-	The system creates a Project named `mesh-log-cbc49*********************5449b` and Logstores named `audit-cbc49*******************5449b` and `istio-cbc49*******************5449b`. Here, `cbc49*********************5449b` is the ASM instance ID.

Observability

Cloud service

Enable/Disable

Default Project and Logstore

Log fields

Note

Managed Service for Prometheus

Enable usage logs for Managed Service for Prometheus

Project: workspace-default-cms-Alibaba Cloud account ID-Region ID
MetricStore:
- Container cluster: aliyun-prom-Cluster ID
- Others: aliyun-prom-Prometheus instance ID

Prometheus usage metrics

The system creates a Project named workspace-default-cms-1290********9680-cn-hangzhou and a MetricStore named aliyun-prom-c4cb*************************d9a9. Here, 1290********9680 is your Alibaba Cloud account ID, and aliyun-prom-c4cb*************************d9a9 is the Prometheus instance ID.