ACK integrates with Simple Log Service (SLS) to collect, store, and analyze cluster logs.
See What is Simple Log Service and Glossary.
Log collection components
Log collection components integrate with SLS to auto-discover and collect container logs in various formats, such as text logs, binary logging, and HTTP data. Collected data is stored in SLS for real-time query and analysis.
LoongCollector (formerly Logtail): The next-generation log collection agent from Simple Log Service. Deploy it on servers, Kubernetes nodes, or Docker hosts to collect logs from files without modifying application code. It is backward-compatible with Logtail and delivers enhanced performance.
Logtail-based data collection: Logtail is a log collection agent that is provided by Simple Log Service. You can use Logtail to collect logs from multiple data sources, such as Alibaba Cloud Elastic Compute Service (ECS) instances, servers in data centers, and servers from third-party cloud service providers. Logtail supports non-intrusive log collection based on log files. You do not need to modify your application code, and log collection does not affect the operation of your applications.
Log collection principles
ACK supports DaemonSet and Sidecar log collection methods.
Collection procedure
Deploy a log collection component to transmit log data to SLS for storage and analysis:
Procedure:
Deploy a log collection component.
Installing a log collection component creates an AliyunLogConfig CRD and associates it with the SLS collection configuration.
LoongCollector component: loongcollector-ds (DaemonSet), loongcollector-operator (Deployment), alibaba-log-configuration (ConfigMap)
Logtail component: logtail-ds (DaemonSet), alibaba-log-controller (Deployment), alibaba-log-configuration (ConfigMap)
Create a collection configuration for the log collection component.
Configure log collection using the console, a CRD, or environment variables. See Collect container logs from ACK clusters, Collect stdout and stderr from Kubernetes containers in DaemonSet mode (old version), and Collect text logs from Kubernetes containers in Sidecar mode.
The log collection component uploads log data to SLS in real time.
Collection method
Kubernetes clusters support two log collection methods: DaemonSet and Sidecar.
DaemonSet: Runs in the
kube-systemnamespace. Each node's log pod collects standard output and files from all pods on that node. See Collect container logs from ACK clusters.Sidecar
Each application pod runs a log collection container sharing the log volume with the main container. See Collect text logs from Kubernetes containers in Sidecar mode.
Classification | DaemonSet method | Sidecar method |
Scenarios | Best for single-tenant clusters with simple log requirements.
| Suited for large, hybrid clusters. Supports per-pod log collection configuration. Can generate high log volumes and consume significant resources. |
Resource usage | One log collection pod runs on each node. | One log collection container runs in each pod. |
Deployment and O&M | Maintain only the DaemonSet. | Deploy a log collection container per pod. |
Log type collected | Standard output and text logs. | Text logs. |
Supported log types
ACK clusters can collect and transmit the following log types to SLS.
Log type | Description | References |
Application (container) logs | Collect container standard output and text files from ACK clusters. |
|
Control plane component logs | Collect logs from control plane components, such as API Server, kube-scheduler, kube-controller-manager, cloud-controller-manager, Controlplane-Events, and the ALB Ingress Controller. Logs are stored in dedicated Logstores for centralized analysis and troubleshooting. Each SLS Logstore corresponds to a Kubernetes control plane component. | Collect control plane component logs of ACK managed clusters |
Network component logs |
| |
Data plane component logs | Collect logs for plugins, such as storage plugins, Terway networking, Flannel networking, and Auto Scaling. |
Limits
Limitations | Description |
Cluster version |
|
| |
Actual usage depends on collection rate, monitored directory and file count, and send blockage. Keep usage below 80% of the limit. See Logtail limits. |
Billing
Costs for SLS in ACK clusters consist of cluster management fees and SLS fees.
Cluster management fees: These fees are charged by ACK. Only ACK Pro clusters incur these fees. ACK Basic clusters and ACK dedicated clusters are free of charge. See Billing overview.
SLS fees: These fees are billed on a pay-as-you-go basis and are charged by SLS. See Billing overview.
FAQ
How do I copy logs from a project to another project?
To copy access logs from logstore-a in project-a to logstore-b in project-b for unified query and analysis in project-b, see Replicate Logstore data.
What do I do if the log collection status is abnormal?
If Logtail log collection status is abnormal, see How to troubleshoot abnormal container log collection.
FAQ about log loss, log deletion, and reducing log storage costs
To change the log retention period or disable log collection, see Logstore-related issues.
Logtail-related issues
For Logtail collection latency, historical log collection, and configuration change timing, see Logtail basic issues.