Log analysis with SASE SLS logs - Secure Access Service Edge

Log analysis collects and stores logs from devices accessing Secure Access Service Edge (SASE). Built on Alibaba Cloud Simple Log Service (SLS), it supports query analysis, statistical charts, and alerting—so you can investigate access activity without manually organizing raw data.

This topic explains how to enable log storage, collect logs, run queries, and view data reports.

Prerequisites

The log storage service for SASE is enabled.

Enable the log storage service

Log storage is a paid service that must be activated before you can collect or query logs.

Log on to the SASE console.
In the left navigation pane, choose Log Analysis > Log Analysis.
On the Log Analysis page, click Activate Now.
Set the log storage service and log storage capacity based on your requirements, click Buy Now, and complete the payment.

After activation, SLS automatically creates a dedicated project for SASE. To view it, go to the Project list on the home page of the Simple Log Service console.

Enable log collection and storage

After the log storage service is active, turn on log collection for your SASE deployment.

Log on to the SASE console.
In the left navigation pane, choose Log Analysis > Log Analysis.
In the upper-right corner of the Log Analysis page, click Log Status to enable log collection and storage.

Supported log types

SASE can collect and store the following log types:

Private access log
PA sensitive file audit log
Accelerate log
Client logon log
Client status log
DLP log
Internet access log
Dynamic decision log

Query logs

Select a log type and enable log delivery

In the upper-left corner of the Log Analysis page, click the drop-down list and select the log type you want to view. Filter the results by specifying conditions as needed.
Click the switch next to a log type to enable or disable log delivery for that type.

Run a query

Enter a search statement in the search box and set a time range.

A query analysis statement combines a search statement and an analytic statement, separated by a vertical bar (|):

<Search statement> | <Analytic statement>

Statement type	Required	Description
Search statement	Yes	The filter condition. Accepts keywords, fuzzy queries, numeric values, numeric ranges, or combinations. Leave blank or enter `*` to return all data in the selected time range. For more information, see Query syntax and features.
Analytic statement	No	Computes or aggregates query results. If omitted, only the matching log entries are returned without statistical analysis. You can omit the `from log` clause that standard SQL requires. By default, the first 100 entries are returned. Use the LIMIT clause to change this limit. For more information, see Query and analysis overview.

Click Search & Analyze to run the query and view results.

Results appear as a log distribution histogram and Raw Logs. From the results page, you can also set alerts, create saved searches, refresh, and share. For more information, see Description of the Query/Analysis page.

Common query examples

The following examples use the AND operator to filter logs by type and condition. All examples return up to 10,000 results, grouped and sorted by count.

SASE client online status

Before running these queries, manually add an index for the app_status field. For more information, see Create an index.

Query online devices:

* AND log_type : client_status_log | select username,app_status,COUNT(*) AS cn GROUP BY username,app_status order by cn desc limit 10000

Query offline devices:

* AND log_type : client_status_log AND app_status:offline | select username,app_status,COUNT(*) AS cn GROUP BY username,app_status order by cn desc limit 10000

SASE client logon

Query logon actions by user and device:

* AND log_type : client_logon_log | select username,action,COUNT(*) AS cn GROUP BY username,action order by cn desc limit 10000

Intranet access

Query devices and users accessing the intranet:

* AND log_type : pa_access_log | select username,device_type,COUNT(*) AS cn GROUP BY username,device_type order by cn desc limit 10000

Query blocked access attempts and the reasons:

* AND log_type : pa_access_log AND action:block | select username,block_info,COUNT(*) AS cn GROUP BY username,block_info order by cn desc limit 10000

Sensitive file detection

Query how many times each sensitive file policy was matched:

* AND log_type : dlp_log | select username,matched_policy,COUNT(*) AS cn GROUP BY username,matched_policy order by cn desc limit 10000

View data reports

Data reports are available for Internet access log only.

From the drop-down list, select Internet access log, then click the Data Report tab.

On the Data Report tab, explore the log data:
- Time Range: Select a time range in the upper-right corner to filter report data.
- Drill Down: Click in the upper-right corner of the report. In the Drill Down dialog box, view data from different data sources.

Log field reference

Identity and account fields

Field name	Description	Example
`__time__`	Operation time.	`2018-02-27 11:58:15`
`aliuid`	Alibaba Cloud account ID.	`141681795035****`
`username`	Name of the enterprise employee.	`John Doe`
`department`	Department of the enterprise employee.	`Test Department`

Device fields

Field name	Description	Example
`device_type`	Device type. Valid values: `Windows`, `macOS`, `Linux`, `Android`, `iOS`.	`Windows`
`device_tag`	Unique ID of the device.	`ccabaebc-77b3-a877-23f1-31b89b59****`
`app_status`	Device status. Valid values: `Online`, `Offline`.	`Online`

Access and traffic fields

Field name	Description	Example
`action`	Action applied to the request. The valid values depend on the log type:<br>- Intranet access logs: `allow` (access permitted by policy), `block` (access denied by policy)<br>- Client logon logs: `logon` (device logged on), `logout` (device logged out), `exit` (SASE client closed)	`block`
`domain`	Domain name accessed on the intranet.	`www.aliyundoc.com`
`dst_addr`	Destination address for intranet access.	`10.2.XX.XX`
`dst_port`	Destination port for intranet access.	`80`
`src_addr`	Source address for intranet access.	`10.4.XX.XX`
`src_port`	Source port for intranet access.	`30001`
`in_bytes`	Inbound traffic volume, in bytes.	`234`
`out_bytes`	Outbound traffic volume, in bytes.	`567`
`protocol`	Network protocol. Valid values: `All`, `tcp`, `udp`.	`tcp`
`request_uri`	Request URI.	`/test.php`

Policy and log type fields

Field name	Description	Example
`log_type`	Log type. Valid values: `pa_access_log` (intranet access log), `client_logon_log` (client logon log), `dlp_log` (log of detected sensitive file exfiltration), `client_status_log` (client status log).	`pa_access_log`
`policy_name`	Name of the policy that matched.	`test`

Timestamp fields

Field name	Description	Example
`event_time`	Time when the event occurred, as a Unix timestamp in seconds.	`1675278754`
`unixtime`	Time when the event was recorded, as a Unix timestamp in seconds.	`1675278754`