Manage logs - Security Center - Alibaba Cloud Documentation Center

Security audit, threat investigation, and emergency response depend on centralized log management and effective analysis. The Log Analysis feature centrally collects host logs (such as logins, process activity, and network connections) and security logs from Security Center (such as alerts, vulnerabilities, and baseline checks). It solves common problems like scattered logs, difficult queries, and a lack of correlation analysis. This helps you quickly gain insights into security events and meet compliance audit requirements.

View log reports

After you enable Log Analysis in Security Center, the system automatically creates a dashboard that centralizes data from host logs and security logs.

Applicability

The following table lists the supported report types. For details about these reports, see Appendix: Log report details.

Log type	Log report	Description
host log	Logon Center	Analyzes server logon activities to identify unusual logons.
	Process Center	Audits process startups on your servers to detect suspicious programs.
	Network Connectivity Center	Monitors network connections to identify suspicious outbound or inbound traffic.
security log	Baseline Center	Shows the configuration risk distribution and remediation trends for your assets.
	Vulnerability Center	Shows the vulnerability distribution, types, and remediation status of your assets.
	Alert Center	Shows the alert levels, types, and handling status for all security events.

Procedure

Log on to the console

Go to the Security Center console > Risk Governance > Log Analysis page. In the upper-left corner of the page, select the region where your assets are located: Chinese Mainland or Outside Chinese Mainland.
Enable log delivery

On the Log Analysis page, turn on the Enable switch.

To enable delivery for all log types at once, click Enable All.
Click a report tab to view its dashboard.
Set the time range

In the upper-right corner of the report tab, click the time range selector and specify a time range.

Note
This setting is temporary and applies only to the current page. When you reopen the report page, the dashboard reverts to the default time range.

The time range dialog provides the following presets: 1 Minute, 5 Minutes, 15 Minutes, 1 Hour, 4 Hours, 1 Day, Today, Yesterday, Day Before Yesterday, 1 Week, This Week, Last Week, 30 Days, This Month, Last Month, This Quarter, This Year, and Custom. Select a preset and click OK to apply it.
Set the refresh rate (Optional)

In the upper-right corner of the report tab, click Refresh and set the refresh rate for the log report.
- Once: Refreshes the dashboard immediately.
- Automatic Refresh: Refreshes the dashboard at a specified interval. You can set the interval to 15 seconds, 60 seconds, 5 minutes, or 15 minutes.

Export logs

Log in to the Security Center console.
In the left-side navigation pane, choose Risk Governance > Log Analysis. In the upper-left corner, select the region of your assets: Chinese Mainland or Outside Chinese Mainland.
In the upper-left corner, select a log type from the drop-down list and run a query. For details on how to query logs, see Customize log queries and analysis.
Above the log list on the Raw Logs tab, click the icon and select Download Log.
In the Log Download dialog box, configure the parameters and click OK.

Important
You can download a maximum of 20 million log entries for a standard query.
- Time range (read-only): The time range for the export.
- Query statement (read-only): The query statement used for the export.
- Task name: A custom name for the export task.
- Number of logs: Specify whether to export all logs (up to 20 million) or a custom number of logs.
- Data format: Select CSV (for tabular data) or json (for structured data).
- Quote character: For the CSV format only. The character used to enclose fields to prevent parsing errors. You can select " or '.
- Allow inaccurate results: Specifies whether to allow approximate results for faster exports.
  - Yes: The export completes faster, but the results may be approximate.
  - No: The results are accurate, but the export may take longer or fail.
- Compression method: The compression format for the exported file. Options: None, gzip, and zstd.
- Sort order: The sort order of the logs by time. Options: Ascending (asc) or Descending (desc).
Download the file
1. Above the log list on the Raw Logs tab, click the icon and select Download Tasks.
2. In the Advanced Download dialog box, view the status of the export task. When the task status changes to Success, click Download.

Note

For other download methods, such as using Cloud Shell or the command line, go to the Simple Log Service (SLS) console. For more information, see Download logs.

Advanced management

The Log Analysis feature in Security Center allows you to access the Simple Log Service console for advanced management, where you can set alerts, configure notification methods, subscribe to and consume real-time data, and set up data shipping.

Go to the Security Center console > Risk Governance > Log Analysis page. In the upper-left corner, select the region where your assets are located: Chinese Mainland or Outside Chinese Mainland.
In the upper-right corner of the Log Analysis page, click Advanced Management of Simple Log Service.
You are redirected to the Simple Log Service console, where you can perform additional operations. For more information, see Set alerts, Notification methods, and Data shipping.

Note
Simple Log Service also provides APIs for writing and querying log data, and for managing Projects and Logstores. For more information, see Simple Log Service API.

Appendix: Log report details

Host logs

Logon center

Chart name	Type	Default time range	Description	Example
Logon count	Single value comparison	1 hour (relative)/Day-over-day	Shows the total logon count and its percentage change compared to the same period on the previous day.	10.0, 10%
Number of logged-on devices	Single value comparison	Today (to the hour)/Day-over-day	Shows the count of unique host devices with logon events and its percentage change compared to the previous day.	10, -10%
Number of unique logon source IPs	Single value comparison	Today (to the hour)/Day-over-day	Shows the count of unique logon source IPs for device logons and its percentage change compared to the previous day.	10, 10%
Number of unique logon usernames	Single value comparison	Today (to the hour)/Day-over-day	Shows the count of unique logon usernames for device logons and its percentage change compared to the previous day.	10, 10%
Endpoint logon trend	Line and column chart	Today (to the hour)	Shows the hourly trends of the number of devices with logon events and the total logon count.	None
Logon method trend	Stacked area chart	Today (to the hour)	Shows the hourly trend of logon counts by logon method, such as RDP and SSH, measured in counts per hour.	None
Logon method distribution	Pie chart	4 hours (relative)	Shows the distribution of logon methods, such as RDP and SSH.	None
Device distribution	Map (global)	4 hours (relative)	Maps the geographic distribution of devices with a public IP address that have logon events.	None
Logon source distribution	Map (global)	4 hours (relative)	Maps the geographic distribution of logon sources, ranked by logon count, for logons to devices with a public IP address.	None
Unique logon source distribution	Map (global)	4 hours (relative)	Maps the geographic distribution of unique logon sources for logons to devices with a public IP address.	None
Top 10 users by logon count	Pie chart	4 hours (relative)	Shows the top 10 usernames ranked by logon count.	None
Top 10 ports by logon count	Pie chart	4 hours (relative)	Shows the top 10 destination ports ranked by logon count.	None
Top 30 users and sources by logon count	Table	4 hours (relative)	Ranks the top 30 users and sources by logon count. This list provides details for each entry, including source network, source IP, username, logon method, the number of unique devices accessed, and the total logon count.	None

Process center

Chart name	Type	Default time range	Description	Example
process startup count	single value comparison	1 hour (relative)/Day-over-day	The total number of process startup events and the day-over-day percentage change.	10.0 thousand, 0.01%
number of related devices	single value comparison	Today (to the hour)/Day-over-day	The number of Process Report that contain process startup events, and the increase or decrease compared to the previous day.	10.0, 0.01%
number of unique started process names	single value comparison	Today (to the hour)/Day-over-day	The number of unique process names started, and the increase or decrease compared to the previous day.	10.0, 0.01%
number of endpoint devices	line and column chart	Today (to the hour)	The hourly trend of the number of devices with process startups and the number of unique started process names. Unit: count/hour.	N/A
process startup trend	line chart	Today (to the hour)	The hourly trend of the average number of processes started per device. Unit: count/hour.	N/A
public device distribution	map (global)	Today (to the hour)	The geographic distribution of public devices that started processes.	N/A
distribution of process startups on public devices	map (global)	Today (to the hour)	The geographic distribution of process startup events on public devices.	N/A
Top 20 processes by startup count	table	Today (to the hour)	The top 20 processes ranked by startup count. The list includes the process name, process path, and startup count.	N/A
Top 20 processes by Bash triggers	table	Today (to the hour)	The top 20 processes ranked by the number of triggers. The list includes the parent process name and the total trigger count.	N/A
Top 30 Java files by process startup count	table	Today (to the hour)	The top 30 Java files ranked by the number of processes they started. The list includes the JAR file name, JAR file path, and total startup count.	N/A
Top 30 clients by process startup count	table	Today (to the hour)	The top 30 clients ranked by the number of processes they started. The list includes the client, its total startup count, and its most frequent command line, along with the corresponding process name, count, and percentage.	N/A

Network connectivity center

Chart name	Chart type	Default time range	Description	Example
Connection event count	Single Value Comparison	1 hour (relative) / Day-over-day	The total number of network connection change events on devices, and the day-over-day percentage change.	10.0, -0.01%
Number of related devices	Single Value Comparison	Today (on the hour) / vs. Previous Day	The number of unique host devices with connection change events, and the percentage change compared to the previous day.	10.0, 0.01%
Number of unique processes	Single Value Comparison	Today (on the hour) / vs. Previous Day	The number of unique process names with network connection change events, and the percentage change compared to the previous day.	10.0, 0.01%
Number of unique source IPs	Single Value Comparison	Today (on the hour) / vs. Previous Day	The number of unique source IPs with network connection change events, and the percentage change compared to the previous day.	10.0, 0.01%
Number of unique destination IPs	Single Value Comparison	Today (on the hour) / vs. Previous Day	The number of unique destination IPs with network connection change events, and the percentage change compared to the previous day.	1.0k, 0.01%
Network connection trend	Dual Line Chart	1 hour (relative)	Shows the hourly trend of the number of devices involved in connection events and the total number of connection events. Unit: count/hour.	N/A
Connection type trend	Dual Line Chart	1 hour (relative)	Shows the hourly trend of inbound and outbound connection events. Unit: count/hour.	N/A
Connection type distribution	Pie Chart	1 hour (relative)	Shows the proportion of inbound versus outbound connection events.	N/A
Protocol type distribution	Pie Chart	1 hour (relative)	Shows the proportion of connection events by protocol (e.g., TCP and UDP).	N/A
Public device distribution	Map (Global)	1 hour (relative)	Shows the geographic distribution of public devices with network connection change events.	N/A
Public device event distribution	Map (Global)	1 hour (relative)	Shows the geographic distribution of network connection change events on public devices.	N/A
Outbound connection destination distribution	Map (Global)	1 hour (relative)	Shows the geographic distribution of outbound connection destinations.	N/A
Inbound connection source distribution	Map (Global)	1 hour (relative)	Shows the geographic distribution of inbound connection sources.	N/A
Top 30 devices with the most outbound connections	Table	1 hour (relative)	Lists the top 30 devices ranked by the number of outbound connection change events. The table includes the device, number of outbound connection events, number of unique connection destinations, and examples.	N/A
Top 30 devices with the most inbound connections	Table	1 hour (relative)	Lists the top 30 devices ranked by the number of inbound connection change events. The table includes the device, listening IP, number of inbound connection events, number of listening ports, and examples.	N/A
Top 30 devices with the most outbound connection destinations	Table	1 hour (relative)	Lists the top 30 devices ranked by the number of outbound connection destinations. The table includes the device, number of outbound connection events, number of unique connection destinations, and examples.	N/A
Top 30 listening ports with the most inbound connections	Table	1 hour (relative)	Lists the top 30 listening ports ranked by the number of inbound connection change events. The table includes the listening port, number of inbound connection events, and examples.	N/A
Top 30 processes with the most outbound connections	Table	1 hour (relative)	Lists the top 30 processes ranked by the number of outbound connection change events. The table includes the process name, number of outbound connection events, number of related devices, and example paths.	N/A
Top 30 processes with the most inbound connections	Table	1 hour (relative)	Lists the top 30 processes ranked by the number of inbound connection change events. The table includes the process name, number of inbound connection events, number of related devices, and example paths.	N/A

Security log

Baseline center

Chart name	Type	Default time range	Description	Example
Number of affected clients	single value comparison	Today (to the hour)/Day-over-day	The number of unique host devices with baseline issues, and the increase or decrease compared to the previous day.	10.0, 0.01%
Number of new baselines	single value comparison	Today (to the hour)/Day-over-day	Number of new baseline events, and the increase or decrease compared to yesterday.	10.0, -0.01%
Number of verified baselines	single value comparison	Today (to the hour)/Day-over-day	Verify the number of baseline events, and the increase or decrease compared to the previous day.	10.0, -0.01%
Number of high-priority baselines	single value comparison	Today (to the hour)/Day-over-day	The number of high-priority baseline events that have occurred, and the increase or decrease compared to the entire previous day.	10.0, 0.01%
Baseline operation trend	flow chart	Today (to the hour)	Shows the hourly count of baseline operations, such as new and verified.	None
Baseline subtype trend	flow chart	Today (to the hour)	Shows the hourly count of baseline subtypes, such as system account security and registry.	None
Baseline status trend	flow chart	Today (to the hour)	Shows the hourly count of baseline statuses, such as unfixed and fixed.	None
Baseline operation distribution	doughnut chart	Today (to the hour)	Shows the distribution of baseline operations, such as new and verified.	None
Baseline subtype distribution	doughnut chart	Today (to the hour)	Shows the distribution of baseline subtypes, such as system account security and registry.	None
Baseline status distribution	doughnut chart	Today (to the hour)	Shows the distribution of the latest baseline statuses, such as unfixed, fixed, and failed to fix. Important If a baseline on a server has multiple status changes, only the latest status is used.	None
Top 10 new baselines	doughnut chart	Today (to the hour)	Shows the top 10 baselines most frequently detected as new across all devices.	None
Top 10 verified baselines	doughnut chart	Today (to the hour)	Shows the top 10 baselines most frequently verified across all devices.	None
Top 20 clients by baseline event	Table	Today (to the hour)	Lists the top 20 devices ranked by the number of baseline events. The list includes the client name, total baseline events, and counts of new, verified, and high- or medium-priority baselines.	None

Vulnerability center

Chart name	Type	Default time range	Description	Example
Number of affected clients	single value comparison	Today (to the hour)/Day-over-day	The number of Vulnerable Servers, and the increase or decrease compared to the previous day.	10.0, 0.01%
Number of new vulnerabilities	single value comparison	Today (to the hour)/Day-over-day	The number of new security vulnerability events, and the increase or decrease compared to the previous day.	10.0, 0.01%
Number of verified vulnerabilities	single value comparison	Today (to the hour)/Day-over-day	Check the number of security vulnerability events, and the increase or decrease compared with the previous day.	10.0, -0.01%
Number of fixed vulnerabilities	single value comparison	Today (to the hour)/Day-over-day	Number of fixed security vulnerability events, and the increase or decrease compared to the previous day.	10.0, -0.01%
Vulnerability operation trend	flow chart	Today (to the hour)	Shows the hourly count of vulnerability operations, such as new and verified.	None
Vulnerability type trend	flow chart	Today (to the hour)	Shows the hourly count of vulnerability types, such as Windows vulnerability, Linux vulnerability, and Web-CMS vulnerability.	None
Vulnerability status trend	flow chart	Today (to the hour)	Shows the hourly count of vulnerability statuses, such as unfixed and fixed.	None
Vulnerability operation distribution	doughnut chart	Today (to the hour)	Shows the distribution of vulnerability operations, such as new and verified.	None
Vulnerability type distribution	doughnut chart	Today (to the hour)	Shows the distribution of vulnerability types, such as Windows vulnerability, Linux vulnerability, and Web-CMS vulnerability.	None
Vulnerability status distribution	doughnut chart	Today (to the hour)	Shows the distribution of the latest vulnerability statuses, such as unfixed, fixed, and failed to fix. Important If a vulnerability on a machine has multiple status changes, only the latest status is used.	None
Top 10 new vulnerabilities	doughnut chart	Today (to the hour)	Shows the top 10 vulnerabilities most frequently detected as new across all devices.	None
Top 10 verified vulnerabilities	doughnut chart	Today (to the hour)	Shows the top 10 vulnerabilities most frequently verified across all devices.	None
Top 10 fixed vulnerabilities	doughnut chart	Today (to the hour)	Shows the top 10 vulnerabilities most frequently fixed across all devices.	None
Top 20 clients by vulnerability event	Table	Today (to the hour)	Lists the top 20 devices ranked by the number of vulnerability events. The list includes the client name, total vulnerability events, and counts of new, verified, and fixed vulnerabilities, along with a breakdown by vulnerability type.	None

Alert center

Chart name	Type	Default time range	Description	Example
Number of affected clients	single value comparison	Today (to the hour)/Day-over-day	The number of Host Log with security alerts, and the increase or decrease compared to yesterday.	10.0, 0.01%
Number of new alerts	single value comparison	Today (to the hour)/Day-over-day	The number of new security alert events, and the increase or decrease compared to yesterday.	10.0, -0.01%
Number of handled alerts	single value comparison	Today (to the hour)/Day-over-day	The number of security alert events handled, and the change compared to the previous day.	10.0, 0.01%
Number of high-priority alerts	single value comparison	Today (to the hour)/Day-over-day	The number of critical security alert events, and the increase or decrease compared to the previous day.	10.0, -0.01%
Alert operation trend	flow chart	Today (to the hour)	Shows the hourly count of alert operations, such as new and handled.	None
Alert level trend	flow chart	Today (to the hour)	Shows the hourly count of alert levels, such as critical, suspicious, and informational.	None
Alert status trend	flow chart	Today (to the hour)	Shows the hourly count of alert statuses, such as unfixed and fixed.	None
Alert operation distribution	doughnut chart	Today (to the hour)	Shows the distribution of alert operations, such as new and handled.	None
Alert level distribution	doughnut chart	Today (to the hour)	Shows the distribution of alert levels, such as critical, suspicious, and informational.	None
Alert status distribution	doughnut chart	Today (to the hour)	Shows the distribution of the latest alert statuses, such as unfixed, fixed, and failed to fix. Important If an alert on a machine has multiple status changes, only the latest status is used.	None
Top 10 new alerts	doughnut chart	Today (to the hour)	Shows the top 10 alerts most frequently detected as new across all devices.	None
Top 10 handled alerts	doughnut chart	Today (to the hour)	Shows the top 10 alerts most frequently handled across all devices.	None
Top 20 clients by alert event	Table	Today (to the hour)	Lists the top 20 devices ranked by the number of alert events. The list includes the client name, total alert events, counts of new and handled events, counts of critical and suspicious events, and a breakdown by alert type.	None

FAQ

Why did my log export task fail?

Possible causes and solutions include:
- Your query returned more than 20 million logs.
- The query statement is too complex, causing a calculation timeout. Try narrowing the time range or simplifying the query statement, and then try again.
Why is there no data in my report?

To troubleshoot this issue, follow these steps:
1. On the Log Analysis page, ensure the Enable switch is on.
2. Verify that you selected the correct time range.
3. After you enable the feature, allow 5 to 10 minutes for data delivery and processing.