Collection of Alibaba Cloud service logs

Simple Log Service can collect logs from multiple types of Alibaba Cloud services, such as elastic computing, storage, security, and database services. The logs record operational statistics, including user operations, running status, and business dynamics of Alibaba Cloud services.

Overview

Automatic collection mechanism

When you enable the log collection feature for an Alibaba Cloud service, the system automatically performs the following operations:

Built-in Agent deployment: A log collection agent (such as Logtail) is pre-installed in the target cloud service instance. No manual installation is required.
Simple Log Service configuration: The system automatically creates corresponding Logstores in Simple Log Service (SLS) to store logs from the cloud service.
Real-time collection and storage: Log data is transmitted to Simple Log Service in real time through the agent and stored by service type.

Steps to stop billing

To stop billing for cloud service log collection, you need to perform operations on both data collection and storage resources:

Disable log collection
- Go to the console of the corresponding cloud service and turn off the Simple Log Service integration feature.
- After collection is stopped, the agent will no longer transmit new logs.
Clean up storage resources
- Log on to the Simple Log Service console and delete the Project and Logstore for the corresponding cloud service.
- Make sure to delete all linked instances to avoid incurring fees for storage space usage.

Elastic computing

Cloud service	Enable/Disable	Default Project and Logstore	Log fields	Note
Elastic Compute Service (ECS)	Host text log collection	Custom	-	Select a custom Project and Logstore for storage.
ACK One	Enable control plane component logs and audit logs for ACK One master instances	Project: Custom k8s-log-Master instance ID Logstore: apiserver-Master instance ID kcm-Master instance ID application-controller-Master instance ID cluster-operator-Master instance ID audit-Master instance ID	-	The Project name starts with k8s-log, for example, a system-created Project named `k8s-log-ab79abd****************f2a8f45`, where `ab79abd****************f2a8f45` represents the master instance ID. Fixed Logstores with the master instance ID are automatically created in this Project.
	Enable/Disable GitOps control plane logs and audit logs for ACK One	Project: k8s-log-Master instance ID Logstore: gitops-argocd-logstore	-	The Project name starts with k8s-log, for example, a system-created Project named `k8s-log-ab79abd****************f2a8f45`, where `ab79abd****************f2a8f45` represents the master instance ID. A Logstore named `gitops-argocd-logstore` is created in this Project.
	Enable/Disable workflow logs for ACK One	Project: k8s-log-Master instance ID Logstore: workflow-logstore	-	The Project name starts with k8s-log, for example, a system-created Project named `k8s-log-ab79abd****************f2a8f45`, where `ab79abd****************f2a8f45` represents the master instance ID. A Logstore named `workflow-logstore` is created in this Project.
ACK managed and dedicated clusters	Enable/Disable control plane component logs for ACK managed and dedicated clusters	Project: Custom k8s-log-Cluster ID Logstore: apiserver-Cluster ID ccm-Cluster ID scheduler-Cluster ID kcm-Cluster ID	Default fields for ACK Pro control plane logs	The Project name starts with k8s-log, for example, a system-created Project named `k8s-log-cb70fbd****************f2a8f45`, where cb70fbd****************f2a8f45 represents the cluster ID. Fixed Logstores with the cluster ID are automatically created in this Project.
	Collect Kubernetes cluster text logs (DaemonSet)	Project: k8s-log-Cluster ID Logstore: config-operation-log	Default fields for container text logs Default fields for Kubernetes cluster standard output	The Project name starts with k8s-log, for example, a system-created Project named `k8s-log-cb70fbd****************f2a8f45`, where cb70fbd****************f2a8f45 represents the cluster ID. A Logstore named `config-operation-log` is automatically created in this Project.
	Enable/Disable container internal operation audit logs for ACK managed and dedicated clusters	Project: k8s-log-Cluster ID Logstore: advaudit-Cluster ID	-	The Project name starts with k8s-log, and the Logstore name starts with advaudit. For example, a system-created Project named `k8s-log-cb70fbd****************f2a8f45` and a Logstore named `advaudit-cb70fbd**************f2a8f45` created in this Project. Here, cb70fbd****************f2a8f45 represents the cluster ID.
	Enable Kubernetes event logs for ACK managed and dedicated clusters	Project: Custom k8s-log-Cluster ID Logstore: k8s-event internal-alert-history security-inspector-configaudit-Cluster ID	-	The Project name starts with k8s-log, for example, a system-created Project named `k8s-log-cb70fbd****************f2a8f45`, where cb70fbd****************f2a8f45 represents the cluster ID. Fixed Logstores with the cluster ID are automatically created in this Project.
	Enable Nginx Ingress access logs for ACK managed and dedicated clusters	Project: k8s-log-Cluster ID Logstore: nginx-ingress nginx-ingress-metrics-result	Metric fields extracted from Kubernetes Ingress access logs Fields in Kubernetes Nginx Ingress access logs	The Project name starts with k8s-log, for example, a system-created Project named `k8s-log-cb70fbd****************f2a8f45`, where cb70fbd****************f2a8f45 represents the cluster ID. Logstores named `nginx-ingress` and `nginx-ingress-metrics-result` are automatically created in this Project.
ACK serverless cluster	Enable/Disable control plane component logs for ACK Serverless	Project: Custom k8s-log-Cluster ID Logstore: apiserver-Cluster ID ccm-Cluster ID kcm-Cluster ID	-	The Project name starts with k8s-log, for example, a system-created Project named `k8s-log-cb70fbd****************f2a8f45`, where cb70fbd****************f2a8f45 represents the cluster ID. Fixed Logstores with the cluster ID are automatically created in this Project.
ACK Edge cluster	Enable/Disable control plane component logs for ACK Edge	Project: Custom k8s-log-Cluster ID Logstore: alb-Cluster ID apiserver-Cluster ID audit-Cluster ID ccm-Cluster ID controlplane-events-Cluster ID k8s-event kcm-Cluster ID scheduler-Cluster ID	-	The Project name starts with k8s-log, for example, a system-created Project named `k8s-log-cb70fbd****************f2a8f45`, where cb70fbd****************f2a8f45 represents the cluster ID. Fixed Logstores with the cluster ID are automatically created in this Project.
WUYING Workspace	Enable operation logs for WUYING Workspace	Project: elastic-desktop-Custom Logstore: elastic_desktop_Custom	-	The Project name starts with elastic-desktop, for example, a Project named `elastic-desktop-test`, and a Logstore named `elastic_desktop_test` is automatically created in this Project.
Function Compute 2.0	Enable access logs for Function Compute 2.0	Project: Custom aliyun-fc-cn-Region ID-Random ID Logstore: function-log	Function Compute 2.0 metric fields	When you enable Simple Log Service when creating a service: The system automatically creates a Project named `aliyun-fc-cn-hangzhou-cc**d0-d3-54-ad-698******d7d`, where the region ID is cn-hangzhou, indicating that it is created in the China (Hangzhou) region. A Logstore named `function-log` is created by default. If Simple Log Service is not enabled when creating a service, you need to manually select a custom Project and Logstore when updating the service.
Function Compute 3.0	Enable access logs for Function Compute 3.0	Project: serverless-cn-Region ID-Random ID Logstore: default-logs	Function Compute 3.0 metric fields	When you create a function, the log feature is enabled by default. The system automatically creates a Project named `serverless-cn-hangzhou-cc**d0-d3-54-ad-698******d7d`, where the region ID is cn-hangzhou, indicating that it is created in the China (Hangzhou) region. A Logstore named `default-logs` is created by default. If Simple Log Service is not enabled when creating a service, you need to manually select a custom Project and Logstore when updating the service.

Storage services

Cloud service	Enable/Disable	Default Project and Logstore	Log fields	Note
Object Storage Service (OSS)	Enable/Disable access logs for OSS	Project: oss-log-Alibaba Cloud account ID-Region ID Logstore: oss-log-store	-	The system automatically creates a Project named `oss-log-1290******9680-cn-hangzhou` and a Logstore named `oss-log-store` in this Project. Here, `1290******9680` is your Alibaba Cloud account ID.
File Storage NAS	Enable access logs for NAS Disable access logs for NAS	Project: nas-Alibaba Cloud account ID-Region ID Logstore: General-purpose NAS: NFS protocol file system: nas-nfs SMB protocol file system: nas-smb-access-log Extreme NAS file system: nas-extreme-nfs	NAS log fields	The system automatically creates a Project named `nas-1290******9680-cn-hangzhou`, where `1290******9680` is your Alibaba Cloud account ID. Different Logstores are created in this Project based on the NAS type: General-purpose NAS: `nas-nfs` (NFS protocol file system) or `nas-smb-access-log` (SMB protocol file system). Extreme NAS file system: `nas-extreme-nfs`.
Elastic Block Storage	Enable/Disable access logs for EBS	Project: aliyun-product-data-Alibaba Cloud account ID-Region ID Metricstore: ebs_disk_metric	EBS monitoring metrics	The system automatically creates a Project named `aliyun-product-data-1290******9680-cn-hangzhou` and a Metricstore named `ebs_disk_metric` in this Project. Here, `1290******9680` is your Alibaba Cloud account ID.

Security services

Cloud service	Enable/Disable	Default Project and Logstore	Log fields	Note
Anti-DDoS Pro and Anti-DDoS Premium	Enable full logs for DDoS	Anti-DDoS Pro (Chinese Mainland) Project: ddoscoo-project-Alibaba Cloud account ID-cn-hangzhou Logstore: ddoscoo-logstore Anti-DDoS Premium (Outside Chinese Mainland) Project: ddosdip-project-Alibaba Cloud account ID-ap-southeast-1 Logstore: ddosdip-logstore	Anti-DDoS Pro and Anti-DDoS Premium full log fields	The system automatically creates a Project named `ddoscoo-project-1290******9680-cn-hangzhou` and a Logstore named `ddoscoo-logstore` in this Project. Here, `1290******9680` is your Alibaba Cloud account ID, and `cn-hangzhou` indicates that the Anti-DDoS service is in the Chinese Mainland.
Anti-DDoS Origin	Enable Mitigation Logs for Anti-DDoS Origin	Project: ddosbgp-project-Alibaba Cloud account ID-cn-hangzhou Logstore: ddosbgp-logstore	Anti-DDoS Origin log fields	The system automatically creates a Project named `ddosbgp-project-1290******9680-cn-hangzhou` and a Logstore named `ddosbgp-logstore` in this Project. Here, `1290******9680` is your Alibaba Cloud account ID.
Security Center	Enable logon logs for Security Center	Project: sas-log-Alibaba Cloud account ID-Region ID Logstore: sas-log	Security Center security logs Vulnerability Log Baseline Log Alert Logs Cloud Platform Configuration Assessment Security Center network logs DNS Log Internal DNS logs Session Access Log Security Center host logs Process Network Login Brute Force Process Snapshot Log Account Snapshot Log Port Snapshot Log DNS Query	The system automatically creates a Project named `sas-log-1290******9680-cn-hangzhou` and a Logstore named `sas-log` in this Project. Here, `1290******9680` is your Alibaba Cloud account ID.
WAF 2.0	Enable full logs for WAF 2.0	WAF instances in the Chinese mainland Project: waf-project-Alibaba Cloud account ID-cn-hangzhou, located in China (Hangzhou). Logstore: waf-logstore WAF instances outside the Chinese mainland Project: waf-project-Alibaba Cloud account ID-ap-southeast-1, located in Singapore. Logstore: waf-logstore	WAF 2.0 log fields	The system automatically creates a Project named `waf-project-1290******9680-cn-hangzhou` and a Logstore named `waf-logstore` in this Project. Here, `1290******9680` is your Alibaba Cloud account ID, and the region is China (Hangzhou), indicating that the WAF instance is in the Chinese mainland.
WAF 3.0	Enable/Disable full logs for WAF 3.0	WAF instances in the Chinese mainland Pay-as-you-go instances Project: wafnew-project-Alibaba Cloud account ID-cn-hangzhou, located in China (Hangzhou). Logstore: wafnew-logstore Subscription instances Project: wafng-project-Alibaba Cloud account ID-cn-hangzhou, located in China (Hangzhou). Logstore: wafnew-logstore WAF instances outside the Chinese mainland Pay-as-you-go instances Project: wafnew-project-Alibaba Cloud account ID-ap-southeast-1, located in Singapore. Logstore: wafnew-logstore Subscription instances Project: wafng-project-Alibaba Cloud account ID-ap-southeast-1, located in Singapore. Logstore: wafnew-logstore	WAF 3.0 log fields	The system automatically creates a Project named `wafnew-project-1290******9680-cn-hangzhou` and a Logstore named `wafnew-logstore` in this Project. Here, `1290******9680` is your Alibaba Cloud account ID, the region is China (Hangzhou), and the Project name starts with wafnew-project, indicating that it is a pay-as-you-go WAF instance in the Chinese mainland.
Cloud Firewall	Enable Traffic Logs of Cloud Firewall	Project: cloudfirewallnew-project-Alibaba Cloud account ID-Region ID Logstore: cloudfirewallnew-logstore	Log fields of Cloud Firewall	The system automatically creates a project named `cloudfirewallnew-project-1290******9680-cn-hangzhou` and a Logstore named `cloudfirewallnew-logstore` in this project. The value `1290******9680` is your Alibaba Cloud account ID, and the region is China (Hangzhou).
ActionTrail	Enable operation event logs for ActionTrail Disable operation event logs for ActionTrail	Project: custom project Logstore: actiontrail_Trail name	ActionTrail event log fields	Select a custom Project and Logstore for storage. When creating a trail, select a custom Project, and the system creates a Logstore named `actiontrail_test001` in this Project, where `test001` represents the name of the trail you created.
ActionTrail	Enable Alibaba Cloud-initiated events for ActionTrail	Custom	Alibaba Cloud-initiated events fields	Select a custom Project and Logstore for storage.
Configuration audit	Enable audit logs for configuration audit	Custom	Configuration audit log fields	Select a custom Project and Logstore for storage.

Network services

Cloud service	Enable/Disable	Default Project and Logstore	Log fields	Note
Classic Load Balancer (CLB) Layer 7	Enable/Disable access logs for CLB	Custom	CLB access log fields	Select a custom Project and Logstore for storage.
Virtual Private Cloud (VPC)	Enable/Disable flow logs for VPC	Custom	VPC flow log fields	Select a custom Project and Logstore for storage.
Cloud Enterprise Network (CEN)	Enable/Disable flow logs for CEN	Custom	CEN flow log fields	Select a custom Project and Logstore for storage.
Smart Access Gateway (SAG)	Enable flow logs for SAG Stop, Disable flow logs for SAG	Custom	SAG flow log fields	Select a custom Project and Logstore for storage.
Elastic IP Address (EIP)	Enable/Disable high-precision monitoring that is accurate to seconds for EIP	Custom	-	Select a custom Project and Logstore for storage.
API Gateway	Enable gateway logs for API Gateway	Project: aliyun-product-data-Alibaba Cloud account ID-Region ID Logstore: apig-access-log apig-plugin-log	API Gateway log fields	The system automatically creates a Project named `aliyun-product-data-<code data-init-id="9c7d0fbf40hrc" data-tag="code" id="061ddd61cfrkk">1290******9680`-cn-hangzhou and Logstores named `apig-access-log` and `apig-plugin-log` in this Project to store access logs and plugin logs respectively. Here, `1290******9680` is your Alibaba Cloud account ID, and the region ID `cn-hangzhou` indicates that the region is China (Hangzhou).
Dynamic Route for CDN (DCDN)	Enable/Disable real-time logs for DCDN	Project: Chinese Mainland: dcdn-edge-rtlog-cn-Random ID Outside Chinese Mainland: dcdn-edge-rtlog-sg-Random ID Logstore: dcdn-edge-rtlog	-	The system automatically creates a Project named `dcdn-edge-rtlog-cn-02**c4` and a Logstore named `dcdn-edge-rtlog` in this Project. Here, `02**c4` is a random number, and the region `cn` indicates that the collection area is the Chinese Mainland.
Global Accelerator (GA)	Enable/Disable access logs for GA	Custom	GA log fields	Select a custom Project and Logstore for storage.

Database services

Cloud service	Enable/Disable	Default Project and Logstore	Log fields	Note
ApsaraDB RDS	Enable audit logs for ApsaraDB RDS	Custom	ApsaraDB RDS audit log fields	Select a custom Project and Logstore for storage.
Tair (Redis OSS-compatible)	Enable audit logs for Tair	Project: nosql-Alibaba Cloud account ID-Region ID Logstore: redis_audit_log_standard redis_slow_run_log	-	The system automatically creates a Project named `nosql-1290******9680-cn-hangzhou` and Logstores named `redis_audit_log_standard` and `redis_slow_run_log` in this Project. Here, `1290******9680` is your Alibaba Cloud account ID, and the region ID `cn-hangzhou` indicates that the region is China (Hangzhou).
ApsaraDB for MongoDB	Enable audit logs for MongoDB Disable audit logs for MongoDB	Project: nosql-Alibaba Cloud account ID-Region ID Logstore: mongo_audit_log_standard mongo_slow_run_log	-	The system automatically creates a Project named `nosql-1290******9680-cn-hangzhou` and Logstores named `mongo_audit_log_standard` and `mongo_slow_run_log` in this Project. Here, `1290******9680` is your Alibaba Cloud account ID, and the region ID `cn-hangzhou` indicates that the region is China (Hangzhou).

Big data computing

Cloud service

Enable/Disable

Default Project and Logstore

Log fields

Note

Data Management (DMS)

Enable operation logs for DMS

Custom

DMS operation log fields

Select a custom Project and Logstore for storage.

E-MapReduce (EMR)

Enable/Disable operation logs for E-MapReduce (EMR)

Project: custom
Logstore: emr_EMR service name_log

Select a custom Project and Logstore for storage.

Cloud communication

Cloud service	Enable/Disable	Default Project and Logstore	Log fields	Note
Short Message Service (SMS)	Enable/Disable SMS logs for Short Message Service	Project: sms-log-Alibaba Cloud account ID Logstore: sms-log	Short Message Service log fields	The system automatically creates a Project named `sms-log-1290******9680` and a Logstore named `sms-log` in this Project. Here, `1290******9680` is your Alibaba Cloud account ID.

IoT

Cloud service	Enable/Disable	Default Project and Logstore	Log fields	Note
IoT Platform	Enable/Disable operational logs for IoT	Project: iot-log-Alibaba Cloud account ID-Region ID Logstore: iot_logs	IoT operational log fields	The system automatically creates a Project named `iot-log-1290******9680-cn-hangzhou` and a Logstore named `iot_logs` in this Project. Here, `1290******9680` is your Alibaba Cloud account ID, and the region ID `cn-hangzhou` indicates that the region is China (Hangzhou).

Middleware

Cloud service	Enable/Disable	Default Project and Logstore	Log fields	Note
Microservices Engine (MSE)	Enable gateway logs for MSE	Project: Custom aliyun-product-data-Alibaba Cloud account ID-Region ID Logstore: mse_gw_access_log	MSE gateway log delivery fields	The system automatically creates a Project named `aliyun-product-data-1290******9680-cn-hangzhou` and a Logstore named `mse_gw_access_log` in this Project. Here, `1290******9680` is your Alibaba Cloud account ID, and the region ID `cn-hangzhou` indicates that the region is China (Hangzhou).
Enterprise Distributed Application Service (EDAS)	Enable business logs for EDAS	Custom	-	Select a custom Project and Logstore for storage.
Service Mesh (ASM)	Enable control plane logs for Service Mesh	Project: Custom mesh-log-ASM instance ID Logstore istio-ASM instance ID audit-ASM instance ID	-	The system automatically creates a Project named `mesh-log-cbc49*********************5449b` and Logstores named `audit-cbc49*******************5449b` and `istio-cbc49*******************5449b` in this Project. Here, `cbc49*********************5449b` is the ASM instance ID.

Observability monitoring

Cloud service

Enable/Disable

Default Project and Logstore

Log fields

Note

Prometheus

Enable usage logs for Prometheus

Project: workspace-default-cms-Alibaba Cloud account ID-Region ID
MetricStore:
- Container cluster: aliyun-prom-Cluster ID
- Others: aliyun-prom-Prometheus instance ID

Prometheus usage metrics

The system automatically creates a Project named workspace-default-cms-1290********9680-cn-hangzhou and a MetricStore named aliyun-prom-c4cb*************************d9a9 in this Project. Here, 1290********9680 is your Alibaba Cloud account ID, aliyun-prom-c4cb*************************d9a9 is the created Prometheus instance ID, and the region ID cn-hangzhou indicates that the region is China (Hangzhou).