Security Center:Migrate from Log Analysis to Log Management

Migration process

Write logs to both services in parallel. After you verify that the new service is stable and reliable, stop writing to the old service.

1. Parallel write: Enable both Log Management and Log Analysis so incremental logs write to both services simultaneously.

2. Data validation: Compare data in Log Management against Log Analysis to verify that Log Management data is complete and accurate.

3. Switchover: After confirming data consistency, turn off the Log Analysis delivery switch. All incremental logs then write only to Log Management.

4. Process historical data: Archive Log Analysis historical data to OSS or let it expire automatically.

5. Resource cleanup: Unsubscribe from Log Analysis to stop billing and complete the migration.

Key risks and compatibility

• Risk of historical data loss: If you clear data and unsubscribe from Log Analysis before backing up historical data, the data is permanently lost.

• SQL query incompatibility: Due to differences in storage structures, Log Analysis (by Topic) and Log Management (by logstore) require separate SQL query statements and are not interchangeable.

• Management API incompatibility: Management APIs and exclusive features of Log Analysis and Log Management are incompatible. API fields and responses differ and require separate adaptation. Log Management API | Log Analysis API.

Cost assessment

• Costs during the parallel write phase: You incur data write and storage charges for both services.

• Costs for processing historical data:

  • Exporting to OSS incurs OSS storage fees.

  • Letting data expire naturally requires continued Log Analysis storage fees for up to 180 days.

Step 1: Enable and configure Log Management

1. Log on to the console

   Log on to the Security Center console. In the left-side navigation pane, choose Detection and Response > Log Management. In the upper-left corner, select the region of your assets: Chinese Mainland or Outside Chinese Mainland.

   Note

   If you have activated Agentic SOC, go to Agentic SOC > Log Management.

2. Activate the service

   On the Log Management page, select a billing method — Activate Subscription or Activate Pay-as-you-go — and follow the on-screen instructions. Activate or deactivate the Log Management service.

   • subscription:

     • Set the Purchase or Not option for Agentic SOC to Yes.

     • Enter the log storage capacity based on your needs, click Order Now, and complete the payment. To estimate capacity, see Agentic SOC Purchase Guide.

   • pay-as-you-go: Select a storage region and click Activate and Authorize.

3. Turn on the delivery switches

   1. On the Log Management page, click Log Settings.

   2. In the Log Storage Management area on the Security Center Logs tab, set the delivery status for each log type.

      Note

      • Agentic SOC automatically turns on all Security Center log delivery switches within 30 minutes by default.

      • If you have not purchased value-added services such as Application Protection or Malicious File Detection, their delivery switches are disabled by default.

Step 2: Validate data in Log Management

1. Query logs

   On the Log Management page, select a log type under Security Center Logs from the Log Type drop-down list, then click Search & Analyze.

   Important

   Logs may take about one minute to become queryable.

2. Verify the data

   Verify at least the following aspects:

   • Timeliness: The latest log timestamp should be close to the current time.

   • Completeness: Spot-check logs in both services to ensure all fields are present and no data is missing.

   • Volume: The log volume over a given period should roughly match the incremental volume in Log Analysis.

Step 3: Stop writing data to Log Analysis

1. On the Log Analysis service page, find the log delivery switch and turn it Off.

   The log delivery switch is the green toggle in the upper-right corner of the page, located to the left of the Enable All button.

2. After this switch is turned off, new incremental logs are written only to Log Management.

Step 4: Process historical data

For historical data still in Log Analysis (within its 180-day retention), choose one of the following options:

• Option 1: Export historical data to OSS for archiving

  Suitable if you need to retain historical data long-term for compliance or future analysis.

  • Procedure:

    1. On the Log Analysis page, click Advanced Management of Simple Log Service to go to the Simple Log Service (SLS) console.

    2. On the details page of the sas-log logstore, in the left-side navigation pane, click Data Processing > Export > Object Storage Service.

    3. Click + to create a data shipping job. For information about how to configure the job, see Create an OSS data shipping job (new version).

    4. After the historical data is saved, on the Log Analysis page, click Clear.

       Warning

       This action is irreversible. Verify that Log Management is receiving data correctly and that all historical data is backed up.

  • Note: You can store the data permanently. Use tools such as MaxCompute or Data Lake Analytics to analyze it when needed.

• Option 2: Allow historical data to expire naturally

  Suitable if you do not need to archive historical data long-term.

  • Procedure: No action required. Keep Log Analysis enabled after migrating incremental data. The system automatically deletes log data after its 180-day lifecycle.

  • Note: You continue to incur Log Analysis storage fees until all data expires.

Step 5: Unsubscribe from the Log Analysis service

After you process historical data and clear the storage, downgrade and unsubscribe from Log Analysis to stop billing.