All Products
Search
Document Center

Simple Log Service:Collection of Alibaba Cloud service logs

Last Updated:Jul 10, 2025

Simple Log Service can collect logs from multiple types of Alibaba Cloud services, such as elastic computing, storage, security, and database services. The logs record operational statistics, including user operations, running status, and business dynamics of Alibaba Cloud services.

Overview

Automatic collection mechanism

When you enable the log collection feature for an Alibaba Cloud service, the system automatically performs the following operations:

  1. Built-in Agent deployment: A log collection agent (such as Logtail) is pre-installed in the target cloud service instance. No manual installation is required.

  2. Simple Log Service configuration: The system automatically creates corresponding Logstores in Simple Log Service (SLS) to store logs from the cloud service.

  3. Real-time collection and storage: Log data is transmitted to Simple Log Service in real time through the agent and stored by service type.

Steps to stop billing

To stop billing for cloud service log collection, you need to perform operations on both data collection and storage resources:

  1. Disable log collection

    • Go to the console of the corresponding cloud service and turn off the Simple Log Service integration feature.

    • After collection is stopped, the agent will no longer transmit new logs.

  2. Clean up storage resources

    • Log on to the Simple Log Service console and delete the Project and Logstore for the corresponding cloud service.

    • Make sure to delete all linked instances to avoid incurring fees for storage space usage.

Collection of Alibaba Cloud service logs

Elastic computing

Cloud service

Enable/Disable

Default Project and Logstore

Log fields

Note

Elastic Compute Service (ECS)

Host text log collection

Custom

-

Select a custom Project and Logstore for storage.

ACK One

Enable control plane component logs and audit logs for ACK One master instances

  • Project:

    • Custom

    • k8s-log-Master instance ID

  • Logstore:

    • apiserver-Master instance ID

    • kcm-Master instance ID

    • application-controller-Master instance ID

    • cluster-operator-Master instance ID

    • audit-Master instance ID

-

The Project name starts with k8s-log, for example, a system-created Project named k8s-log-ab79abd******************f2a8f45, where ab79abd******************f2a8f45 represents the master instance ID. Fixed Logstores with the master instance ID are automatically created in this Project.

Enable/Disable GitOps control plane logs and audit logs for ACK One

  • Project: k8s-log-Master instance ID

  • Logstore: gitops-argocd-logstore

-

The Project name starts with k8s-log, for example, a system-created Project named k8s-log-ab79abd******************f2a8f45, where ab79abd******************f2a8f45 represents the master instance ID. A Logstore named gitops-argocd-logstore is created in this Project.

Enable/Disable workflow logs for ACK One

  • Project: k8s-log-Master instance ID

  • Logstore: workflow-logstore

-

The Project name starts with k8s-log, for example, a system-created Project named k8s-log-ab79abd******************f2a8f45, where ab79abd******************f2a8f45 represents the master instance ID. A Logstore named workflow-logstore is created in this Project.

ACK managed and dedicated clusters

Enable/Disable control plane component logs for ACK managed and dedicated clusters

  • Project:

    • Custom

    • k8s-log-Cluster ID

  • Logstore:

    • apiserver-Cluster ID

    • ccm-Cluster ID

    • scheduler-Cluster ID

    • kcm-Cluster ID

Default fields for ACK Pro control plane logs

The Project name starts with k8s-log, for example, a system-created Project named k8s-log-cb70fbd******************f2a8f45, where cb70fbd******************f2a8f45 represents the cluster ID. Fixed Logstores with the cluster ID are automatically created in this Project.

Collect Kubernetes cluster text logs (DaemonSet)

  • Project: k8s-log-Cluster ID

  • Logstore: config-operation-log

The Project name starts with k8s-log, for example, a system-created Project named k8s-log-cb70fbd******************f2a8f45, where cb70fbd******************f2a8f45 represents the cluster ID. A Logstore named config-operation-log is automatically created in this Project.

Enable/Disable container internal operation audit logs for ACK managed and dedicated clusters

  • Project: k8s-log-Cluster ID

  • Logstore: advaudit-Cluster ID

-

The Project name starts with k8s-log, and the Logstore name starts with advaudit. For example, a system-created Project named k8s-log-cb70fbd******************f2a8f45 and a Logstore named advaudit-cb70fbd******************f2a8f45 created in this Project. Here, cb70fbd******************f2a8f45 represents the cluster ID.

Enable Kubernetes event logs for ACK managed and dedicated clusters

  • Project:

    • Custom

    • k8s-log-Cluster ID

  • Logstore:

    • k8s-event

    • internal-alert-history

    • security-inspector-configaudit-Cluster ID

-

The Project name starts with k8s-log, for example, a system-created Project named k8s-log-cb70fbd******************f2a8f45, where cb70fbd******************f2a8f45 represents the cluster ID. Fixed Logstores with the cluster ID are automatically created in this Project.

Enable Nginx Ingress access logs for ACK managed and dedicated clusters

  • Project: k8s-log-Cluster ID

  • Logstore:

    • nginx-ingress

    • nginx-ingress-metrics-result

The Project name starts with k8s-log, for example, a system-created Project named k8s-log-cb70fbd******************f2a8f45, where cb70fbd******************f2a8f45 represents the cluster ID. Logstores named nginx-ingress and nginx-ingress-metrics-result are automatically created in this Project.

ACK serverless cluster

Enable/Disable control plane component logs for ACK Serverless

  • Project:

    • Custom

    • k8s-log-Cluster ID

  • Logstore:

    • apiserver-Cluster ID

    • ccm-Cluster ID

    • kcm-Cluster ID

-

The Project name starts with k8s-log, for example, a system-created Project named k8s-log-cb70fbd******************f2a8f45, where cb70fbd******************f2a8f45 represents the cluster ID. Fixed Logstores with the cluster ID are automatically created in this Project.

ACK Edge cluster

Enable/Disable control plane component logs for ACK Edge

  • Project:

    • Custom

    • k8s-log-Cluster ID

  • Logstore:

    • alb-Cluster ID

    • apiserver-Cluster ID

    • audit-Cluster ID

    • ccm-Cluster ID

    • controlplane-events-Cluster ID

    • k8s-event

    • kcm-Cluster ID

    • scheduler-Cluster ID

-

The Project name starts with k8s-log, for example, a system-created Project named k8s-log-cb70fbd******************f2a8f45, where cb70fbd******************f2a8f45 represents the cluster ID. Fixed Logstores with the cluster ID are automatically created in this Project.

WUYING Workspace

Enable operation logs for WUYING Workspace

  • Project: elastic-desktop-Custom

  • Logstore: elastic_desktop_Custom

-

The Project name starts with elastic-desktop, for example, a Project named elastic-desktop-test, and a Logstore named elastic_desktop_test is automatically created in this Project.

Function Compute 2.0

Enable access logs for Function Compute 2.0

  • Project:

    • Custom

    • aliyun-fc-cn-Region ID-Random ID

  • Logstore: function-log

Function Compute 2.0 metric fields

  • When you enable Simple Log Service when creating a service:

    • The system automatically creates a Project named aliyun-fc-cn-hangzhou-cc****d0-d**3-5**4-a**d-698******d7d, where the region ID is cn-hangzhou, indicating that it is created in the China (Hangzhou) region.

    • A Logstore named function-log is created by default.

  • If Simple Log Service is not enabled when creating a service, you need to manually select a custom Project and Logstore when updating the service.

Function Compute 3.0

Enable access logs for Function Compute 3.0

  • Project: serverless-cn-Region ID-Random ID

  • Logstore: default-logs

Function Compute 3.0 metric fields

  • When you create a function, the log feature is enabled by default.

    • The system automatically creates a Project named serverless-cn-hangzhou-cc****d0-d**3-5**4-a**d-698******d7d, where the region ID is cn-hangzhou, indicating that it is created in the China (Hangzhou) region.

    • A Logstore named default-logs is created by default.

  • If Simple Log Service is not enabled when creating a service, you need to manually select a custom Project and Logstore when updating the service.

Storage services

Cloud service

Enable/Disable

Default Project and Logstore

Log fields

Note

Object Storage Service (OSS)

Enable/Disable access logs for OSS

  • Project: oss-log-Alibaba Cloud account ID-Region ID

  • Logstore: oss-log-store

-

The system automatically creates a Project named oss-log-1290********9680-cn-hangzhou and a Logstore named oss-log-store in this Project. Here, 1290********9680 is your Alibaba Cloud account ID.

File Storage NAS

  • Project: nas-Alibaba Cloud account ID-Region ID

  • Logstore:

    • General-purpose NAS:

      • NFS protocol file system: nas-nfs

      • SMB protocol file system: nas-smb-access-log

    • Extreme NAS file system: nas-extreme-nfs

NAS log fields

The system automatically creates a Project named nas-1290********9680-cn-hangzhou, where 1290********9680 is your Alibaba Cloud account ID. Different Logstores are created in this Project based on the NAS type:

  • General-purpose NAS: nas-nfs (NFS protocol file system) or nas-smb-access-log (SMB protocol file system).

  • Extreme NAS file system: nas-extreme-nfs.

Elastic Block Storage

Enable/Disable access logs for EBS

  • Project: aliyun-product-data-Alibaba Cloud account ID-Region ID

  • Metricstore: ebs_disk_metric

EBS monitoring metrics

The system automatically creates a Project named aliyun-product-data-1290********9680-cn-hangzhou and a Metricstore named ebs_disk_metric in this Project. Here, 1290********9680 is your Alibaba Cloud account ID.

Security services

Cloud service

Enable/Disable

Default Project and Logstore

Log fields

Note

Anti-DDoS Pro and Anti-DDoS Premium

Enable full logs for DDoS

  • Anti-DDoS Pro (Chinese Mainland)

    • Project: ddoscoo-project-Alibaba Cloud account ID-cn-hangzhou

    • Logstore: ddoscoo-logstore

  • Anti-DDoS Premium (Outside Chinese Mainland)

    • Project: ddosdip-project-Alibaba Cloud account ID-ap-southeast-1

    • Logstore: ddosdip-logstore

Anti-DDoS Pro and Anti-DDoS Premium full log fields

The system automatically creates a Project named ddoscoo-project-1290********9680-cn-hangzhou and a Logstore named ddoscoo-logstore in this Project. Here, 1290********9680 is your Alibaba Cloud account ID, and cn-hangzhou indicates that the Anti-DDoS service is in the Chinese Mainland.

Anti-DDoS Origin

Enable Mitigation Logs for Anti-DDoS Origin

  • Project: ddosbgp-project-Alibaba Cloud account ID-cn-hangzhou

  • Logstore: ddosbgp-logstore

Anti-DDoS Origin log fields

The system automatically creates a Project named ddosbgp-project-1290********9680-cn-hangzhou and a Logstore named ddosbgp-logstore in this Project. Here, 1290********9680 is your Alibaba Cloud account ID.

Security Center

Enable logon logs for Security Center

  • Project: sas-log-Alibaba Cloud account ID-Region ID

  • Logstore: sas-log

The system automatically creates a Project named sas-log-1290********9680-cn-hangzhou and a Logstore named sas-log in this Project. Here, 1290********9680 is your Alibaba Cloud account ID.

WAF 2.0

Enable full logs for WAF 2.0

  • WAF instances in the Chinese mainland

    • Project: waf-project-Alibaba Cloud account ID-cn-hangzhou, located in China (Hangzhou).

    • Logstore: waf-logstore

  • WAF instances outside the Chinese mainland

    • Project: waf-project-Alibaba Cloud account ID-ap-southeast-1, located in Singapore.

    • Logstore: waf-logstore

WAF 2.0 log fields

The system automatically creates a Project named waf-project-1290********9680-cn-hangzhou and a Logstore named waf-logstore in this Project. Here, 1290********9680 is your Alibaba Cloud account ID, and the region is China (Hangzhou), indicating that the WAF instance is in the Chinese mainland.

WAF 3.0

Enable/Disable full logs for WAF 3.0

  • WAF instances in the Chinese mainland

    • Pay-as-you-go instances

      • Project: wafnew-project-Alibaba Cloud account ID-cn-hangzhou, located in China (Hangzhou).

      • Logstore: wafnew-logstore

    • Subscription instances

      • Project: wafng-project-Alibaba Cloud account ID-cn-hangzhou, located in China (Hangzhou).

      • Logstore: wafnew-logstore

  • WAF instances outside the Chinese mainland

    • Pay-as-you-go instances

      • Project: wafnew-project-Alibaba Cloud account ID-ap-southeast-1, located in Singapore.

      • Logstore: wafnew-logstore

    • Subscription instances

      • Project: wafng-project-Alibaba Cloud account ID-ap-southeast-1, located in Singapore.

      • Logstore: wafnew-logstore

WAF 3.0 log fields

The system automatically creates a Project named wafnew-project-1290********9680-cn-hangzhou and a Logstore named wafnew-logstore in this Project. Here, 1290********9680 is your Alibaba Cloud account ID, the region is China (Hangzhou), and the Project name starts with wafnew-project, indicating that it is a pay-as-you-go WAF instance in the Chinese mainland.

Cloud Firewall

Enable Traffic Logs of Cloud Firewall

  • Project: cloudfirewallnew-project-Alibaba Cloud account ID-Region ID

  • Logstore: cloudfirewallnew-logstore

Log fields of Cloud Firewall

The system automatically creates a project named cloudfirewallnew-project-1290********9680-cn-hangzhou and a Logstore named cloudfirewallnew-logstore in this project. The value 1290********9680 is your Alibaba Cloud account ID, and the region is China (Hangzhou).

ActionTrail

  • Project: custom project

  • Logstore: actiontrail_Trail name

ActionTrail event log fields

Select a custom Project and Logstore for storage.

When creating a trail, select a custom Project, and the system creates a Logstore named actiontrail_test001 in this Project, where test001 represents the name of the trail you created.

Enable Alibaba Cloud-initiated events for ActionTrail

Custom

Alibaba Cloud-initiated events fields

Select a custom Project and Logstore for storage.

Configuration audit

Enable audit logs for configuration audit

Custom

Configuration audit log fields

Select a custom Project and Logstore for storage.

Network services

Cloud service

Enable/Disable

Default Project and Logstore

Log fields

Note

Classic Load Balancer (CLB) Layer 7

Enable/Disable access logs for CLB

Custom

CLB access log fields

Select a custom Project and Logstore for storage.

Virtual Private Cloud (VPC)

Enable/Disable flow logs for VPC

Custom

VPC flow log fields

Select a custom Project and Logstore for storage.

Cloud Enterprise Network (CEN)

Enable/Disable flow logs for CEN

Custom

CEN flow log fields

Select a custom Project and Logstore for storage.

Smart Access Gateway (SAG)

Custom

SAG flow log fields

Select a custom Project and Logstore for storage.

Elastic IP Address (EIP)

Enable/Disable high-precision monitoring that is accurate to seconds for EIP

Custom

-

Select a custom Project and Logstore for storage.

API Gateway

Enable gateway logs for API Gateway

  • Project: aliyun-product-data-Alibaba Cloud account ID-Region ID

  • Logstore:

    • apig-access-log

    • apig-plugin-log

API Gateway log fields

The system automatically creates a Project named aliyun-product-data-<code data-init-id="9c7d0fbf40hrc" data-tag="code" id="061ddd61cfrkk">1290********9680-cn-hangzhou and Logstores named apig-access-log and apig-plugin-log in this Project to store access logs and plugin logs respectively. Here, 1290********9680 is your Alibaba Cloud account ID, and the region ID cn-hangzhou indicates that the region is China (Hangzhou).

Dynamic Route for CDN (DCDN)

Enable/Disable real-time logs for DCDN

  • Project:

    • Chinese Mainland: dcdn-edge-rtlog-cn-Random ID

    • Outside Chinese Mainland: dcdn-edge-rtlog-sg-Random ID

  • Logstore: dcdn-edge-rtlog

-

The system automatically creates a Project named dcdn-edge-rtlog-cn-02****c4 and a Logstore named dcdn-edge-rtlog in this Project. Here, 02****c4 is a random number, and the region cn indicates that the collection area is the Chinese Mainland.

Global Accelerator (GA)

Enable/Disable access logs for GA

Custom

GA log fields

Select a custom Project and Logstore for storage.

Database services

Cloud service

Enable/Disable

Default Project and Logstore

Log fields

Note

ApsaraDB RDS

Enable audit logs for ApsaraDB RDS

Custom

ApsaraDB RDS audit log fields

Select a custom Project and Logstore for storage.

Tair (Redis OSS-compatible)

Enable audit logs for Tair

  • Project: nosql-Alibaba Cloud account ID-Region ID

  • Logstore:

    • redis_audit_log_standard

    • redis_slow_run_log

-

The system automatically creates a Project named nosql-1290********9680-cn-hangzhou and Logstores named redis_audit_log_standard and redis_slow_run_log in this Project. Here, 1290********9680 is your Alibaba Cloud account ID, and the region ID cn-hangzhou indicates that the region is China (Hangzhou).

ApsaraDB for MongoDB

  • Project: nosql-Alibaba Cloud account ID-Region ID

  • Logstore:

    • mongo_audit_log_standard

    • mongo_slow_run_log

-

The system automatically creates a Project named nosql-1290********9680-cn-hangzhou and Logstores named mongo_audit_log_standard and mongo_slow_run_log in this Project. Here, 1290********9680 is your Alibaba Cloud account ID, and the region ID cn-hangzhou indicates that the region is China (Hangzhou).

Big data computing

Cloud service

Enable/Disable

Default Project and Logstore

Log fields

Note

Data Management (DMS)

Enable operation logs for DMS

Custom

DMS operation log fields

Select a custom Project and Logstore for storage.

E-MapReduce (EMR)

Enable/Disable operation logs for E-MapReduce (EMR)

  • Project: custom

  • Logstore: emr_EMR service name_log

-

Select a custom Project and Logstore for storage.

Cloud communication

Cloud service

Enable/Disable

Default Project and Logstore

Log fields

Note

Short Message Service (SMS)

Enable/Disable SMS logs for Short Message Service

  • Project: sms-log-Alibaba Cloud account ID

  • Logstore: sms-log

Short Message Service log fields

The system automatically creates a Project named sms-log-1290********9680 and a Logstore named sms-log in this Project. Here, 1290********9680 is your Alibaba Cloud account ID.

IoT

Cloud service

Enable/Disable

Default Project and Logstore

Log fields

Note

IoT Platform

Enable/Disable operational logs for IoT

  • Project: iot-log-Alibaba Cloud account ID-Region ID

  • Logstore: iot_logs

IoT operational log fields

The system automatically creates a Project named iot-log-1290********9680-cn-hangzhou and a Logstore named iot_logs in this Project. Here, 1290********9680 is your Alibaba Cloud account ID, and the region ID cn-hangzhou indicates that the region is China (Hangzhou).

Middleware

Cloud service

Enable/Disable

Default Project and Logstore

Log fields

Note

Microservices Engine (MSE)

Enable gateway logs for MSE

  • Project:

    • Custom

    • aliyun-product-data-Alibaba Cloud account ID-Region ID

  • Logstore: mse_gw_access_log

MSE gateway log delivery fields

The system automatically creates a Project named aliyun-product-data-1290********9680-cn-hangzhou and a Logstore named mse_gw_access_log in this Project. Here, 1290********9680 is your Alibaba Cloud account ID, and the region ID cn-hangzhou indicates that the region is China (Hangzhou).

Enterprise Distributed Application Service (EDAS)

Enable business logs for EDAS

Custom

-

Select a custom Project and Logstore for storage.

Service Mesh (ASM)

Enable control plane logs for Service Mesh

  • Project:

    • Custom

    • mesh-log-ASM instance ID

  • Logstore

    • istio-ASM instance ID

    • audit-ASM instance ID

-

The system automatically creates a Project named mesh-log-cbc49***********************5449b and Logstores named audit-cbc49***********************5449b and istio-cbc49***********************5449b in this Project. Here, cbc49***********************5449b is the ASM instance ID.

Observability monitoring

Cloud service

Enable/Disable

Default Project and Logstore

Log fields

Note

Prometheus

Enable usage logs for Prometheus

  • Project: workspace-default-cms-Alibaba Cloud account ID-Region ID

  • MetricStore:

    • Container cluster: aliyun-prom-Cluster ID

    • Others: aliyun-prom-Prometheus instance ID

Prometheus usage metrics

The system automatically creates a Project named workspace-default-cms-1290********9680-cn-hangzhou and a MetricStore named aliyun-prom-c4cb*************************d9a9 in this Project. Here, 1290********9680 is your Alibaba Cloud account ID, aliyun-prom-c4cb*************************d9a9 is the created Prometheus instance ID, and the region ID cn-hangzhou indicates that the region is China (Hangzhou).