CloudOps Orchestration Service:Enable and configure Log Audit Service of Log Service for a DingTalk application

Step 1: Enable Log Audit Service and view the initialized service configurations

1. Enable Log Audit Service.

On the Overview tab of the DingTalk application for which you want to enable Log Audit Service, click Enable next to Audit Log to initialize a Log Service project, a Logstore, and a Logtail configuration for the DingTalk application. The name of the Logtail configuration is the ID of the DingTalk application. In this example, the ID of the DingTalk application is 031001.

2. View the initialized configurations of Log Audit Service.

After Log Audit Service is enabled, click View next to Audit Log. You are navigated to the details page of the created Logstore in the Log Service console.

The following content describes the endpoint of the Logstore:

Specify the project name and Logstore name in the endpoint. 
- dingtalk-application-cn-{regionId}: the name of the project. Set the regionId parameter to the ID of the region in which the application group is deployed.
- dingTalkAppId: the name of the Logstore. Set the dingTalkAppId parameter to the ID of the DingTalk application.

Format:
https://sls.console.aliyun.com/lognext/project/dingtalk-application-{regionId}/logsearch/{dingTalkAppId}

Example:
https://sls.console.aliyun.com/lognext/project/dingtalk-application-cn-chengdu/logsearch/031001

A project, a Logstore, and a Logtail configuration are initialized for the DingTalk application. Then, proceed to Step 2 to view the details of the Logtail configuration.

Step 2: View the default Logtail configuration

A Logtail configuration is initialized for the DingTalk application in the Logstore under Logtail Configurations. A Logtail configuration is a set of policies that are used by Logtail to collect logs. For more information, see Logtail configurations.

The following table describes the parameters initialized for the Logtail configuration.

Step 3: Create a machine group

On the Logstore page, choose Resources > Machine Groups in the left-side navigation pane. On the page that appears, click Create Machine Group.

In the Create Machine Group panel, specify the name and one or more IP addresses for the machine group. In this example, the name of the machine group is app-test. Take note of the following items: Only Elastic Compute Service (ECS) instances in the same region as the project are supported. The IP addresses must be the internal IP addresses of ECS instances. You cannot add both Windows and Linux instances to the same machine group.

Step 4: Associate the machine group with the Logtail configuration

On the Logtail Configurations tab, click Modify. In the Machine Groups section, move the app-test machine group that you created from Source Server Groups to Applied Server Groups.

Step 5: Configure indexes for the Logstore

You can enable the indexing feature for the Logstore as needed. After the indexing feature is enabled, you can use the feature of automatic index generation to simplify the index creation process. For more information, see Configure indexes.

Step 6: Collect a sample log

Create a log file on an ECS instance that belongs to the machine group created in the previous step and write test data to the log file.

mkdir -p /home/logs
touch /home/logs/031001.log
echo "2022-03-09 18:36:13.236 INFO LogHelper.printProviderLog(85): ANTL_41A46571-0B69-1BD0-851C-35A893395774 userId=1309208528360047,sourceIpAddress=106.11.41.212,userName=root,eventName=AddUserToGroup,request=requestBody,response=responseBody" >> /home/logs/031001.log

After 3 to 5 seconds, a sample log is displayed on the monitoring panel. The log collection is successful.