Cloud Monitor:Integrate Alibaba Cloud VPC logs

Procedure

1. Log on to the Cloud Monitor 2.0 console and click the target Workspace. In the Integration Center, find and click AlibabaCloud VPC Log under the Alibaba Cloud.

2. On the integration configuration page, use the default configurations and click Determine. Alternatively, you can customize the configurations as needed. The Integration Name and VPC flow log settings appear after you configure the Policy Name and Scope and click OK.

   Configuration Item		Description
   Policy Name		The default is acs.vpc.vpc:{{ WorkspaceID }}:{{ Region }}. You can also specify a custom name.
   Entitys		All Entities: Integrates all entities in the current region, including existing and future ones. By Resource Group: Integrates all entities in the specified resource group. By Tags: Filters entities to integrate based on tags. Manual Selection: Manually select the entities to integrate.
   Name		Optional. The name of the configuration item.
   VPC flow log		Enabled by default. Do not disable this switch. Otherwise, VPC flow logs will not be saved to SLS.

3. After the integration is successful, you can view the details under Integration Management in the Integration Center. The following resources are automatically created:

   • If the VPC flow log service is not enabled, it is enabled automatically.

   • A flow log instance is created. To view the instance, go to the VPC console, switch to the region of the workspace, and find the instance under Flow Logs.

   • A Simple Log Service (SLS) project named aliyun-product-data-{{ AccountID }}-{{ VPCRegion }} is automatically created. Logs are written to the vpc_log Logstore within this project. Two scheduled SQL jobs are also created. Their functions are described in the following table. Do not delete these jobs.

     Scheduled SQL Name	Function	Result Output
     {{ IntegrationPolicyID }}-vpc-country-entity	Extracts country entities for audit and compliance from VPC flow logs.	A dedicated SLS Logstore for the workspace. Project: cms-{workspace_name}-{random_ID} Logstore: {workspace_name}__entity
     {{ IntegrationPolicyID }}-vpc-country-topo	Extracts the associations between country entities and VPCs for audit and compliance from VPC flow logs.	A dedicated SLS Logstore for the workspace. Project: cms-{workspace_name}-{random_ID} Logstore: {workspace_name}__topo