Simple Log Service:Install, run, upgrade, and uninstall Logtail

One-click installation

Simple Log Service can install Logtail on an ECS instance with one click. The installation relies on the orchestration capability of CloudOps Orchestration Service (OOS), so you do not need to log on to the ECS instance and run the installation steps manually. If you log on with an Alibaba Cloud account, you have all required permissions by default and can perform the operations directly.

If you log on as a RAM user, ask the Alibaba Cloud account owner to grant you permissions to manage OOS resources. The account owner can use a system policy or a custom policy to create a RAM user and grant permissions to the RAM user:

• System policies:

  • AliyunOOSFullAccess: grants full permissions to manage CloudOps Orchestration Service (OOS).

  • AliyunECSFullAccess: grants permissions to manage ECS.

• Custom policies: If you have strict data security requirements, you can create a custom policy for fine-grained authorization. The following policy grants permissions to manage OOS resources:

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:DescribeTagKeys",
                "ecs:DescribeTags",
                "ecs:DescribeInstances",
                "ecs:DescribeInvocationResults",
                "ecs:RunCommand",
                "ecs:DescribeInvocations",
                "ecs:InvokeCommand"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "oos:ListTemplates",
                "oos:StartExecution",
                "oos:ListExecutions",
                "oos:GetExecutionTemplate",
                "oos:ListExecutionLogs",
                "oos:ListTaskExecutions"
            ],
            "Resource": "*"
        }
    ]
}

To install Logtail on an ECS instance and create and configure a machine group at the same time, perform the following steps:

1. Log on to the Simple Log Service console. Click the project that manages your log resources to view the list of LogStores. Click the icon before the name of the LogStore that stores the logs to expand it, click the icon that appears after Data Collection, select a text log template in the dialog box, and then click Integrate Now.

   Simple Log Service provides multiple text log templates, such as regular expression, single-line, and multi-line templates. The templates differ only in their log parsing plug-ins. All other configurations are identical. You can also add or remove log parsing plug-ins in a template. Select a template based on the characteristics of the logs that you want to collect, or select any text log template and then configure the plug-ins based on the characteristics of your logs.

2. On the Machine Group Configurations page, select Servers and ECS as the installation environment, and then click Create Machine Group.

3. In the Create Machine Group panel, select one or more ECS instances that reside in the same region as the project, click Install and Create Machine Group, wait for the installation to finish, specify the Name of the machine group, and then click OK.

   If the installation fails or remains in the waiting state, check whether the ECS instances reside in the same region as the project.

4. After the installation, go to the Resources > Machine Groups page, click the machine group that you created, and check the Heartbeat status in the Machine Group Configurations > Machine Group Status section. A heartbeat status of OK indicates that the machine group was created.

Manual installation

Select a Logtail download method and installation method based on the operating system and the CPU architecture of your server.

In the sample code, ${region_id} is the region where the Simple Log Service project resides. Replace it with the actual region ID by referring to Supported regions. For example, the ${region_id} for China (Hangzhou) is cn-hangzhou.

Before you install Logtail, consider the following items:

• Logtail 2.0 compatibility: If your machine has a low specification or runs an older operating system, Logtail 2.0 may cause compatibility issues that prevent the software from running properly. In this case, we recommend that you download version 1.8.7 from https://logtail-release-cn-hangzhou.oss-cn-hangzhou.aliyuncs.com/linux64/1.8.7/logtail.sh and run the ./logtail.sh install ${region_id} -v 1.8.7 command to install it.

Linux

• The following versions of Linux x86-64 (64-bit) servers are supported. - Alibaba Cloud Linux 2 and 3

  • Anolis OS 7 and 8 - CentOS Linux 6, 7, and 8 - Debian GNU/Linux 8, 9, 10, 11, and 12

  • Red Hat Enterprise Linux 6, 7, 8, and 9

  • openSUSE 15.1, 15.2, and 42.3

  • SUSE Linux Enterprise Server 11, 12, and 15 - Ubuntu 14.04, 16.04, 18.04, 20.04, 22.04, and 24.0 - Other Linux operating systems that are based on glibc 2.5 or later. Logtail 2.0 or later requires glibc 2.6 or later.

  • The CPU must support the sse4_2 and avx instruction sets for Logtail 2.0 or later. - The following versions of Linux ARM (64-bit) servers are supported. - Alibaba Cloud Linux 3.2 for ARM - Anolis OS 8.2 for ARM or later - CentOS 8.4 for ARM

  • Debian 11.2 and 12.2 for ARM - Ubuntu 20.04, 22.04, and 24.04 for ARM

  • The minimum required CPU architecture is ARMv8.2-A for Logtail 2.0 or later.

Servers that can access the internet (ARM and x86-64)

For servers that can access the internet, download Logtail directly:

# Download over an internal network
wget http://logtail-release-${region_id}.oss-${region_id}-internal.aliyuncs.com/linux64/logtail.sh -O logtail.sh; 
# Download over the internet
wget http://logtail-release-${region_id}.oss-${region_id}.aliyuncs.com/linux64/logtail.sh -O logtail.sh;

Select an installation command based on your network conditions:

# Install over the internet.
chmod +x logtail.sh; ./logtail.sh install ${region_id}-internet
# If your servers are in on-premises data centers outside the Chinese mainland or are provided by cloud vendors outside the Chinese mainland, data transfer over the internet may cause high network latency and unstable transfer. We recommend that you use transfer acceleration to transfer data.
chmod +x logtail.sh; ./logtail.sh install ${region_id}-acceleration
# Install over an internal network. This method applies to on-premises data centers that are connected to an internal network.
chmod +x logtail.sh; ./logtail.sh install ${region_id}

ARM servers that are offline

For offline servers, first download the installation script and the installation package on a server that can access the internet:

wget http://logtail-release-${region_id}.oss-${region_id}.aliyuncs.com/linux64/logtail.sh; wget http://logtail-release-${region_id}.oss-${region_id}.aliyuncs.com/linux64/aarch64/logtail-linux64.tar.gz

Copy the installation script and the installation package to the server on which you want to install Logtail, and then select an installation command based on your network conditions:

# Install over the internet.
chmod +x logtail.sh; ./logtail.sh install-local ${region_id}-internet
# If your servers are in on-premises data centers outside the Chinese mainland or are provided by cloud vendors outside the Chinese mainland, data transfer over the internet may cause high network latency and unstable transfer. We recommend that you use transfer acceleration to transfer data.
chmod +x logtail.sh; ./logtail.sh install-local ${region_id}-acceleration

x86-64 servers that are offline

For offline servers, first download the installation script and the installation package on a server that can access the internet:

wget http://logtail-release-${region_id}.oss-${region_id}.aliyuncs.com/linux64/logtail.sh; wget http://logtail-release-${region_id}.oss-${region_id}.aliyuncs.com/linux64/logtail-linux64.tar.gz

Copy the installation script and the installation package to the server on which you want to install Logtail, and then select an installation command based on your network conditions:

# Install over the internet.
chmod +x logtail.sh; ./logtail.sh install-local ${region_id}-internet
# If your servers are in on-premises data centers outside the Chinese mainland or are provided by cloud vendors outside the Chinese mainland, data transfer over the internet may cause high network latency and unstable transfer. We recommend that you use transfer acceleration to transfer data.
chmod +x logtail.sh; ./logtail.sh install-local ${region_id}-acceleration

Windows

The following Windows versions are supported: - Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, and 2025 - Microsoft Windows 7 - Microsoft Windows 10 - Microsoft Windows Server Version 1909 - Microsoft Windows Server Version 2004

Download the installation package that matches the architecture of your server and the region of your project:

Extract the installation package, run Windows PowerShell as an administrator, and go to the logtail_installer directory, which is the directory to which you extracted the installation package. Select an installation command based on your network conditions:

# Install over the internet.
.\logtail_installer.exe install ${region_id}-internet
# If your servers are in on-premises data centers outside the Chinese mainland or are provided by cloud vendors outside the Chinese mainland, data transfer over the internet may cause high network latency and unstable transfer. We recommend that you use transfer acceleration to transfer data.
.\logtail_installer.exe install ${region_id}-acceleration

Linux

Start Logtail

sudo /etc/init.d/ilogtaild start

Stop Logtail

sudo /etc/init.d/ilogtaild stop

Windows

1. Log on to the target server.

2. Choose Start > Control Panel > Tools > Service.

3. In the Service dialog box, find the required service.

   • For version 0.x.x.x, select the LogtailWorker service.

   • For version 1.0.0.0 or later, select the LogtailDaemon service.

4. Right-click the service and select the required operation, such as Start, Stop, or Restart.

Linux

Check the Logtail status on Linux

Run the sudo /etc/init.d/ilogtaild status command to check the Logtail status. If the system returns ilogtail is running, Logtail is installed. If Logtail is not running, uninstall it and then install it again.

Check the Logtail version on Linux

Logtail stores its version information in the logtail_version field of the /usr/local/ilogtail/app_info.json file. Run the following command to view the Logtail version information.

cat /usr/local/ilogtail/app_info.json

The following result is returned:

{
   "logtail_version" : "0.16.30",
}

Windows

Check the Logtail status on Windows

Check the Logtail status to determine whether Logtail is installed on the target server.

1. Open the Run window, enter services.msc, and open the Services window.

2. Check the running status of the LogtailDaemon service, which applies to Logtail 1.0.0.0 or later, or the LogtailWorker service, which applies to Logtail 0.x.x.x.

   A status of Running indicates that Logtail is installed.

Check the Logtail version on Windows

You can check the Logtail version in the logtail_version field of the app_info.json file in the installation path.

For example, the following content indicates that the Logtail version is 1.0.0.0.

{
    "logtail_version" : "1.0.0.0"
}

Linux

Before you upgrade Logtail on a Linux server, consider the following items:

• Upgrade command: To upgrade Logtail, use the upgrade command. If you use the install command, an overwrite installation is performed and the original configurations are lost.

• Service interruption: During the upgrade, Logtail stops for a short period of time. After the upgrade is complete, Logtail starts automatically and is registered as a startup item. The upgrade overwrites only the required files. Configuration files and checkpoint files are retained, which ensures that no logs are lost during the upgrade.

  In the sample code, ${region_id} is the region where the Simple Log Service project resides. Replace it with the actual region ID by referring to Supported regions. For example, the ${region_id} for China (Hangzhou) is cn-hangzhou.

Select a Logtail upgrade method from the following table:

The following information indicates that the upgrade is successful.

stop successfully
Stop logtail successfully.
Upgrading logtail files ...
Upgrade logtail files successfully.
Starting logtail ...
ilogtail is running
Upgrade logtail successfully.
{
        "UUID" : "XXXXXXXX-XXXX",
        "compiler" : "GCC 9.3.1",
        "hostname" : "xxx",
        "instance_id" : "XXXXXXXX-XXXX_172.16.0.75_1730950372",
        "ip" : "172.16.0.75",
        "logtail_version" : "2.0.8",
        "os" : "Linux; 5.10.134-13.an8.x86_64; #1 SMP Mon Jan 9 10:39:46 CST 2023; x86_64",
        "update_time" : "2024-11-07 11:32:52"
}

Windows

The upgrade procedure is the same as the installation procedure. Download and extract the latest installation package, and then perform the installation steps.

Linux

Obtain the ${region_id} of the region where your Simple Log Serviceproject resides. Replace ${region_id} and then run the following command to uninstall Logtail.

For the ${region_id} of each region, see Supported regions. For example, the ${region_id} for China (Hangzhou) is cn-hangzhou.

wget http://logtail-release-${region_id}.oss-${region_id}.aliyuncs.com/linux64/logtail.sh -O logtail.sh; chmod +x logtail.sh; ./logtail.sh uninstall

Windows

Run Windows PowerShell or cmd as an administrator, go to the logtail_installer directory, which is the directory to which you extracted the installation package, and then run the following command.

.\logtail_installer.exe uninstall

After the uninstallation is complete, the Logtail installation directory is deleted, but some configurations are retained in the C:\LogtailData directory. You can delete them manually based on your requirements. The retained information includes:

• checkpoint: stores the checkpoint information of all Logtail plug-ins. This file exists only after you use Logtail plug-ins.

• user_config.d: the directory that stores local collection configurations. Files that have the .json extension are considered collection configurations. The format is similar to /usr/local/ilogtail/user_log_config.json.

• logtail_check_point: stores the checkpoint information of the main Logtail component.

• users: stores the user identifier files that you configured.

ACK clusters

This operation applies only to dedicated Kubernetes clusters and managed Kubernetes clusters.

Install the Logtail component for an existing ACK cluster

1. Log on to the Container Service Management Console

2. On the Clusters page, choose More > Operations > Add-ons in the rightmost column of the destination cluster.

3. On the Logs and Monitoring tab, find logtail-ds and then click Install.

   After the installation is complete, Simple Log Service automatically creates a project named k8s-log-${your_k8s_cluster_id}.

Install the Logtail component when you create an ACK cluster

1. Log on to the Container Service Management Console

2. In the left-side navigation pane, click Clusters.

3. On the Clusters page, click Create Cluster.

4. On the Component Configurations configuration step, select Enable Log Service.

After you select Enable Log Service, a message that prompts you to create a project appears. For more information about how Simple Log Service organizes logs, see Project. You can create a project in one of the following two ways:

• Select Project: You can select an existing project to manage the collected container logs.

• Create Project: Simple Log Service automatically creates a project to manage the collected container logs. ClusterID is the unique identifier of the Kubernetes cluster that you create.

  In the Log Service section, select Enable Log Service. After you select Create a new project, the system automatically creates a project named k8s-log-{ClusterID}.

After the installation is complete, the following Simple Log Service resources are automatically created in the selected project.

Self-managed clusters

1. Log on to your Kubernetes cluster and select a command based on the region to download Logtail and its dependent components.

   # Regions in the Chinese mainland
   wget https://logtail-release-cn-hangzhou.oss-cn-hangzhou.aliyuncs.com/kubernetes/0.5.5/alibaba-cloud-log-all.tgz; tar xvf alibaba-cloud-log-all.tgz; chmod 744 ./alibaba-cloud-log-all/k8s-custom-install.sh
   # Regions outside the Chinese mainland
   wget https://logtail-release-ap-southeast-1.oss-ap-southeast-1.aliyuncs.com/kubernetes/0.5.5/alibaba-cloud-log-all.tgz; tar xvf alibaba-cloud-log-all.tgz; chmod 744 ./alibaba-cloud-log-all/k8s-custom-install.sh

2. Modify the ./alibaba-cloud-log-all/values.yaml configuration file.

   The configuration file contains the following parameters:

   # ===================== Required content =====================
   # The name of the destination project.
   SlsProjectName: 
   # The region to which the project belongs.
   Region: 
   # The ID of the Alibaba Cloud account to which the project belongs. Enclose the ID in double quotation marks ("").
   AliUid: "11099"
   # The AccessKey ID and AccessKey secret of the Alibaba Cloud account or the RAM user. The AliyunLogFullAccess permission is required.
   AccessKeyID: 
   AccessKeySercret: 
   # The custom cluster ID. The ID can contain only letters, digits, and hyphens (-).
   ClusterID: 
   # ==========================================================
   # Specifies whether to enable the components related to metric collection. Valid values: true and false. Default value: true.
   SlsMonitoring: true
   # The network type. Valid values: Internet and Intranet. Default value: Internet.
   Net: Internet
   # Specifies whether the container runtime is containerd. Valid values: true and false. Default value: false.
   SLS_CONTAINERD_USED: true

   Parameter	Description
   SlsProjectName	The name of the project to which Logtail uploads logs.
   Region	The ID of the region where your project resides. For example, the region ID of China (Hangzhou) is cn-hangzhou.
   AliUid	The ID of the Alibaba Cloud account to which the project belongs. The ID must be enclosed in double quotation marks (""), for example, AliUid: "11**99".
   AccessKeyID	The AccessKey ID of the Alibaba Cloud account to which the project belongs. We recommend that you use the AccessKey pair of a RAM user and grant the AliyunLogFullAccess permission to the RAM user.
   AccessKeySercret	The AccessKey secret of the Alibaba Cloud account to which the project belongs. We recommend that you use the AccessKey pair of a RAM user and grant the AliyunLogFullAccess permission to the RAM user.
   ClusterID	The custom cluster ID. The ID can contain only letters, digits, and hyphens (-). This parameter corresponds to ${your_k8s_cluster_id} in the subsequent operations. Do not configure the same cluster ID for different Kubernetes clusters.
   SlsMonitoring	Specifies whether to enable cluster metric data collection. Valid values: true (default), which enables cluster metric data collection, and false, which disables cluster metric data collection.
   Net	The network type that Logtail uses to transfer data. If your cluster is not connected to the Alibaba Cloud internal network, use the internet. Valid values: Internet (default), which is the internet, and Intranet, which is an internal network.
   SLS_CONTAINERD_USED	Specifies whether the container runtime is containerd. Valid values: true, which indicates that the container runtime is containerd, and false (default), which indicates that the container runtime is not containerd. In a self-managed Kubernetes cluster that uses containerd as the container runtime, logs may not be collected by Logtail if this parameter is not enabled.

3. Install Logtail and its dependent components.

   You can run the echo "$(uname -s | tr '[:upper:]' '[:lower:]')-$(uname -m)" command to query the OS-architecture of your host. The k8s-custom-install.sh script supports the following OS-architecture combinations: linux-386, linux-amd64, linux-arm, linux-arm64, linux-ppc64le, linux-s390x, and darwin-amd64.

   bash k8s-custom-install.sh; kubectl apply -R -f result

   values.yaml file that you modified.

ACK clusters

In most cases, we recommend that you use the automatic upgrade method. If you modified parameters, such as environment variables, in the DaemonSet of logtail-ds or in the Deployment of alibaba-log-controller, use the manual upgrade method to prevent your modifications from being reset.

Automatic upgrade

1. Log on to the Container Service Management Consol.

2. On the Logs and Monitoring tab, find logtail-ds and then click Upgrade.

3. In the Update dialog box, click OK.

After you perform the upgrade, you can check the status of the logtail-ds pods in the Container Service management console. If all logtail-ds pods are in the Running state, the upgrade is successful.

Manual upgrade

A manual upgrade covers logtail-ds and alibaba-log-controller. In most cases, you only need to upgrade logtail-ds to obtain the collection capabilities of the new Logtail version. To obtain the collection capabilities provided by the new Logtail CRD, you must upgrade alibaba-log-controller. The following steps use logtail-ds as an example.

1. Log on to the Container Service Management Console

2. Choose Workloads > DaemonSets.

   Note

   To upgrade alibaba-log-controller, choose Workloads > Deployments. Then, find alibaba-log-controller in the kube-system namespace and complete the upgrade.

3. Set Namespace to kube-system, and then click Edit for logtail-ds.

4. Check whether the following environment variables exist.

   If the ALIYUN_LOGTAIL_CONFIG, ALIYUN_LOGTAIL_USER_ID, and ALIYUN_LOGTAIL_USER_DEFINED_ID environment variables do not exist, your Logtail version may be too early. Upgrade Logtail.

5. For Image Version, click Select Image Version.

6. In the Image Version dialog box, click the latest version, and then click OK.

7. On the right side of the page, click Update.

   After you perform the upgrade, you can check the status of the logtail-ds pods in the Container Service management console. If all logtail-ds pods are in the Running state, the upgrade is successful.

Self-managed clusters

We recommend that you upgrade by installing the latest Logtail component. If you update only the image version number of some components, such as logtail-ds or alibaba-log-controller, the upgrade may fail.

To complete the automatic upgrade, install the Logtail component again.

ACK clusters

1. Log on to the Container Service Management Console

2. On the Logs and Monitoring tab, find logtail-ds and then click Uninstall.

3. Follow the on-screen instructions to click OK and complete the uninstallation.

Self-managed clusters

Run the kubectl delete -R -f result command to uninstall installed components such as logtail-ds and alibaba-log-controller.

This command recursively deletes all resources in the result directory. Use it with caution if the directory contains other resources.