All logs of Security Center are stored in the dedicated sas-log Logstore. You can find this Logstore in the sas-log-Alibaba Cloud account ID-region ID project.

After the log Security Center is enabled for log analysis, the system automatically creates a logstore (logstore name sas-log) dedicated to Security Center and stores the log data of Security Center. Please be careful not to delete it by mistake.
Notice If you delete the Logstore by mistake, the background will prompt "sas-log log library does not exist", and all your current log data will be lost. You need to submit a work order reset process. After the reset, you need to re-open the log analysis service before you can continue to use log analysis. Lost log data cannot be recovered.

Logstore limits

  • You cannot use the Log Service API or SDK to write data into Logstores or modify the attributes of a Logstore, such as the storage period.
  • To use Log Service, you must purchase and activate Log Service in Security Center first. After you purchase Log Service in Security Center, you do not have to pay additional fee in Log Service.
  • The default reports may be updated later.
  • The maximum storage of the Security Center Logstore is 50 TB. We recommend that you periodically back up and clear the Logstore.