How to view raw logs and log details - Security Center - Alibaba Cloud Documentation Center

You can use the log analysis feature to view raw logs and log details. You can download raw logs to your computer.

Background information

Security Center shows the details of each log, including the time, content, and log fields. To view the log details, you can choose Risk Governance > Log Analysis and click the Raw Logs tab. For more information, see Log types and log fields. 原始日志

Procedure

Log on to the Security Center console. In the top navigation bar, select the region of the asset that you want to manage. You can select China or Outside China.
In the left-side navigation pane, choose Risk Governance > Log Analysis.
On the left side of the Raw Logs tab, click the value of a field to automatically add the field to the Search & Analyze search box.
Note
For example, after you click the value of the aegis-log-process field, this field is added to the search box. You can click Search & Analyze to view the logs related to this field.
You can perform the following operations on the Raw Logs tab:
- In the left-side field list, you can perform the following operations.
  - Below Displayed Fields, move the pointer over a field and click the icon to remove the field from Displayed Fields. Then, the field is no longer displayed in the log content on the right side.
  - Below Indexed Fields, move the pointer over a field and click the icon to add the field to Displayed Fields. Then, the field is displayed in the log content on the right side.
  - : allows you to view Basic Distribution and Statistical Metrics of a field.
  - : allows you to add a view to your favorites. After you add a field to or remove a field from Displayed Fields, you can click this icon to add the view to your favorites. Then, you can select the view from the Views drop-down list.
  - > Tag Settings: allows you to add fields as system tags.
  - > Alias: After you turn on Alias, the names of fields are replaced with aliases. If no alias is configured for a field, the name of the field is retained.
- In the right-side log content, you can perform the following operations.
  - If log content is displayed in Raw Data mode, you can perform the following operations:
    - : allows you to copy log content.
    - : allows you to label specific information or query error information in log content. This icon also serves as a copilot.
  - : allows you to specify a download scope and download logs. For more information, see Export logs.
  - > JSON Configurations: allows you to specify the display type of JSON and the level of JSON expansion.
  - > Event Settings: allows you to configure events for raw logs. For more information, see Event settings.