Alibaba Cloud Service Mesh:Enable control-plane log collection and alerting (ASM versions earlier than 1.17.2.35)

Prerequisites

• An ASM instance of a version earlier than 1.17.2.35. For more information, see Create an ASM instance.

Enable control-plane log collection

1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.

2. On the Mesh Management page, click the name of your ASM instance. In the left-side navigation pane, choose ASM Instance > Base Information.

3. In the Config Info section, click Enable next to Control-plane log collection.

   • First-time enablement: The Enable Control-plane log collection dialog box appears. Create a project or select an existing one. When creating a project, use either the default name or a custom name, then click Submit.

   • Re-enablement (previously enabled and then disabled): A Note message appears. Click OK. The previously used project is automatically selected.

   Important

   The control-plane Logstore retains logs for 30 days and automatically discards older logs.

After log collection is enabled, click View log next to Control-plane log collection in the Base Information section to view detailed control-plane logs.

Enable log-based alerting

When the data plane rejects an xDS request from the control plane, an alert fires. This means the affected sidecar proxy or gateway did not receive the latest configuration. The impact depends on the proxy's state:

• Has previous configurations: The proxy or gateway keeps running with the last successfully received configuration.

• Has no configurations: The proxy or gateway has no listeners configured and cannot process or forward requests based on routing rules.

To enable alerting:

1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.

2. On the Mesh Management page, click the name of your ASM instance. In the left-side navigation pane, choose ASM Instance > Base Information.

3. In the Config Info section, click Alert Setting next to Control-plane log collection.

4. In the Control-Plane Alert Setting dialog box, find the alert policy to enable. Select ASM Built-in Action Strategy (recommended) or a custom action policy, then click Enable Alert. An action policy specifies the action to be performed when an alert is triggered. To create or modify action policies, see Create an action policy in Simple Log Service.

5. In the Note message, click OK.

Configure alert contacts

Add members to the built-in alert user group so they receive alert notifications.

1. Log on to the Simple Log Service console.

2. In the Projects section, click the name of your project. In the left-side navigation pane, click Alerts.

3. On the Alert Center page, choose Notification Objects > User Group Management.

4. On the User Group Management tab, find sls.app.asm.builtin and click Edit in the Actions column.

5. In the Edit User Group dialog box, select the members to add, click the icon to add them to the group, then click OK.

   

Verify alert notifications

To confirm that alerts are delivered correctly, apply an intentionally invalid gateway configuration that references a non-existing TLS credential. This triggers a configuration push failure and generates an alert.

1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.

2. On the Mesh Management page, click the name of your ASM instance. In the left-side navigation pane, choose ASM Gateways > Gateway. Click Create from YAML.

3. On the Create page, select a namespace and a template, paste the following YAML, and click Create. The following Istio gateway uses the default namespace and references a non-existing TLS credential (not-existing-credential), which causes a configuration push failure:

   apiVersion: networking.istio.io/v1beta1
   kind: Gateway
   metadata:
     name: gateway-test
     namespace: default
   spec:
     selector:
       istio: ingressgateway
     servers:
       - hosts:
           - '*console.aliyun.com'
         port:
           name: https
           number: 443
           protocol: HTTPS
         tls:
           credentialName: not-existing-credential
           mode: SIMPLE

4. Check that the alert was triggered:

   1. On the ASM instance details page, choose ASM Instance > Base Information in the left-side navigation pane.

   2. In the Config Info section, click View log next to Control-plane log collection.

   3. In the Simple Log Service console, search for 'ACK ERROR' to locate the alert log entry.

      If you configured email notifications, also check your inbox for the alert email.

Handle alerts

Change the control-plane log project

1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.

2. On the Mesh Management page, click the name of your ASM instance. In the left-side navigation pane, choose ASM Instance > Base Information.

3. In the Config Info section of the Base Information page, click Change Log Project next to Control-plane log collection. In the Change Log Project dialog box, modify the settings and click Submit.