Network Attached Storage (NAS) access logs can be sent to Log Service in real time. Each access log records the details of an access event, such as the operation type, target object, and response status of the current user. This topic describes how to collect NAS access logs. It also describes relevant log fields.


  1. Alibaba Cloud Log Service and NAS are activated.
  2. A file system and a mount point are created. The file system is mounted to an Elastic Compute Service (ECS) instance.

    For more information, see Create a file system, Add a mount target, and Mount a file system.


  1. Log on to the NAS console with your Alibaba Cloud account.
  2. Click Apply to apply for the user-level monitoring feature as prompted at the top of the console.

    User-level monitoring is now available for NAS so that you can monitor multiple I/O metrics of NAS files in real time. You must apply for this feature to configure these metrics.

  3. In the left-side navigation pane, choose Log Analysis > Log Management to go to the Log Management page.
  4. Set Region.
  5. Authorize NAS to access your cloud resources.

    If you configure NAS log collection for the first time, click Auth now. After authorization, NAS can send NAS access logs to your Logstore.

  6. Go back to the Log Management page.
  7. Click Create Log Store in the upper-right corner.
  8. Set Region and File System ID/Name, and then click OK.
After you complete the preceding configuration, Log Service creates a project and a Logstore for you. Your NAS access logs are sent to this default Logstore of Log Service in real time. You can view the project and Logstore of Log Service corresponding to your NAS file system on the Log Management page. You can also:
  • Click Click to go to go to the Log Service console to view logs.
  • Click stop to stop dumping logs to Log Service.

More actions

On the Log Management page, find the target file system and click Click to go. On the query and analysis page of the Log Service console, you can perform the following operations:
  • Query and analyze logs

    Log Service supports query syntax and analysis syntax for log query in complex scenarios. For more information, see query syntax and analysis syntax.

  • View dashboards

    Log Service provides three dashboards for NAS to display real-time status such as event types and event source distribution.

    You can also modify the dedicated dashboards, create a custom dashboard, and add custom analysis charts in various scenarios to your dashboards. For more information about dashboards, see Create and delete a dashboard.

  • Configure alerts

    On the query and analysis page of the target Logstore, you can save current query conditions as a saved search and an alert to regularly monitor important log data and send alert notifications when exceptions occur. For more information, see Configure an alert.

Default configuration

Table 1. Default configuration
Default configuration item Description
Project A project is created by default.
  • Chinese environment: nas-AliUid-cn-RegionId
  • English environment: nas-AliUid-en-RegionId
Logstore The nas-nfs Logstore is created by default. All logs collected by the NAS log collection feature are stored in this Logstore.
Note Currently, only NFS NAS access logs can be analyzed. Other protocol types will be supported in the future.
Region By default, logs are stored in the region where the current file system resides.
Shard By default, two shards are created and the Automatic Sharding feature is enabled.
Log storage duration By default, logs are stored for seven days. Logs stored more than seven days are automatically deleted.

You can modify the storage duration as needed. If you store logs for a longer period, you are charged for the extra storage duration. For more information about pricing, see Pay-as-you-go.

Dashboard By default, the following dashboards are created:
  • nas-nfs-nas_audit_dashboard
  • nas-nfs-nas_detail_dashboard
  • nas-nfs-nas_summary_dashboard

Log fields

Field Description Example
ArgIno The inode number of the file system. 226
AuthRc The authorization return code. 0
NFSProtocolRc The NFS return code. 0
OpList The NFSv4 procedure number. null
Proc The NFSv3 procedure number. 1
RWSize The size of data that was read and write, in bytes. -1
RequestId The ID of the request. 5ACF5CD506EAC7A508F056DF
ResIno The inode number of lookup resources. null
SourceIp The IP address of the client.
User The ID of the user. 123456789
Vers The version number of the NFS protocol. 3
Vip The IP address of the server.
Volume The ID of the file system. 2d2794a330
microtime The time when the request was sent, in microseconds. 1523539157201995