Alibaba Cloud Service Mesh:Enable control-plane log collection and alerting

Prerequisites

Before you begin, make sure that you have:

• Simple Log Service activated for your Alibaba Cloud account. See "Step 1: Activate Simple Log Service" in Getting Started

• The logtail-ds component installed in the data-plane cluster. See "Step 1: Install Logtail" in Collect log data from containers by using Simple Log Service

• A cluster added to an ASM instance of version 1.17.2.35 or later. See Add a cluster to an ASM instance and Update an ASM instance

Enable control-plane log collection

1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.

2. On the Mesh Management page, click the name of your ASM instance. In the left-side navigation pane, choose Observability Management Center > Log Center.

3. On the Log Center page, click the Control-Plane Logs tab. Select New project or Use existed project, configure the parameters, and then click Enable Control-Plane Log Collection.

4. In the Submit confirmation dialog, click OK.

After log collection is enabled:

• View control-plane logs in the ASM console or Simple Log Service console.

• Configure log-based alerting to detect issues early.

View control-plane logs

After you enable log collection, control-plane component logs stream into Simple Log Service. View them in the ASM console or the Simple Log Service console.

Configure log-based alerting

Set up alert rules to get notified about control-plane issues such as configuration push failures, configuration risks, and certificate expiration.

1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.

2. On the Mesh Management page, click the name of your ASM instance. In the left-side navigation pane, choose Observability Management Center > Log Center.

3. On the Log Center page, click the Control-Plane Logs tab. In the upper-left corner, click Alert Setting.

4. In the Control-Plane Alert Setting dialog box, find the alert policy you want, select an action policy, and click Enable Alert. In the Note message, click OK.

An action policy defines how notifications are sent when an alert fires. Two types are available:

Action policy type	Description
ASM Built-in Action Strategy	A default policy with no notification channels preconfigured. Click the icon to open the Simple Log Service alert center and configure a notification channel.
Custom action strategy	A policy you define with your own notification channels.

Add alert contacts

You can configure built-in action policies for gateways, alert contacts, and notification templates in Simple Log Service.

1. Log on to the Simple Log Service console.

2. In the Projects section, click the name of the desired project. In the left-side navigation pane, click Alerts.

3. On the Alert Center page, choose Notification Objects > User Group Management.

4. On the User Group Management tab, find sls.app.asm.builtin and click Edit in the Actions column.

5. In the Edit User Group dialog box, select the members to add, click the icon to add them to the user group, and then click OK.

   

Verify alert notification settings

Trigger a test alert to confirm that notifications are delivered correctly.

1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.

2. On the Mesh Management page, click the name of your ASM instance. In the left-side navigation pane, choose ASM Gateways > Gateway. On the page that appears, click Create from YAML.

3. On the Create page, select a namespace and a template, paste the following YAML, and click Create. This example deploys an Istio gateway in the default namespace with a non-existent TLS credential to intentionally trigger an error:

   apiVersion: networking.istio.io/v1beta1
   kind: Gateway
   metadata:
     name: gateway-test
     namespace: default
   spec:
     selector:
       istio: ingressgateway
     servers:
       - hosts:
           - '*console.aliyun.com'
         port:
           name: https
           number: 443
           protocol: HTTPS
         tls:
           credentialName: not-existing-credential
           mode: SIMPLE

4. Check the alert in the ASM console:

   1. In the left-side navigation pane, choose Observability Management Center > Log Center.

   2. On the Control-Plane Logs tab, search for ACK ERROR to view the alert information.

If you configured email notifications, check your inbox for the alert email.

Troubleshoot alerts

Change the control-plane log project

1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.

2. On the Mesh Management page, click the name of your ASM instance. In the left-side navigation pane, choose Observability Management Center > Log Center.

3. On the Control-Plane Logs tab, click Change Log Project. In the Change Log Project dialog box, update the settings and click Submit.