Simple Log Service:CloudLens for ALB (formerly ALB Log Center)

CloudLens for ALB automatically aggregates real-time access logs and provides features such as intelligent inspection and real-time alerting.

• Centrally manage all ALB instances under your Alibaba Cloud account.

• Enable data collection for ALB access logs with a single click and manage the collection status of all instances.

• Store, query, and analyze ALB access logs in real time.

• Extract various metrics from raw access logs in real time. These metrics include page views (PVs), request success rate, average latency, P50 latency, P99 latency, and inbound and outbound traffic. You can also combine multiple dimensions, such as app_lb_id, host, and status.

• Access rich visual reports, such as a monitoring center, real-time monitoring, and instance inspection. You can subscribe to reports by email or through DingTalk groups.

• Use the intelligent inspection feature, which supports global and app_lb_id granularity inspections. You can also annotate anomalies directly in the visual reports.

• Customize alert configurations. You can send alert notifications through Message Center, text messages, email, voice calls, or DingTalk. You can also integrate with custom webhooks.

All assets are located in the project that you select. The assets in the project include the following:

• Logstore

  • An access log Logstore that you create to store Layer 7 access logs from ALB.

  • An inspection result Logstore that stores inspection results. After you enable data collection, a dedicated Logstore named access_log_logstore_name-metrics-result is automatically created.

  Important

  • Do not delete the Logstore for ALB Layer 7 access logs. If you do, logs cannot be collected and shipped to Simple Log Service.

  • Do not delete the indexes of some fields in the access log Logstore. If you do, metric transformation will fail.

• Metricstore

  A Metricstore that stores aggregated metric information. After you enable data collection, a dedicated Metricstore named access_log_logstore_name-metrics is automatically created.

  Note

  The Metricstore stores aggregated metrics. The data volume is much smaller than that of raw access logs, which makes it suitable for long-term storage.

• Aggregation rules

  Rule name	Time granularity	Aggregation dimension	Generated metric name
  total	10s	total	pv body_bytes_sent_avg body_bytes_sent_sum request_length_avg request_length_sum upstream_response_time_avg upstream_response_time_p50 upstream_response_time_p90 upstream_response_time_p99 request_time_avg request_time_p50 request_time_p90 request_time_p99
  app_lb_id	10s	app_lb_id	pv:app_lb_id body_bytes_sent_avg:app_lb_id body_bytes_sent_sum:app_lb_id request_length_avg:app_lb_id request_length_sum:app_lb_id upstream_response_time_avg:app_lb_id upstream_response_time_p50:app_lb_id upstream_response_time_p90:app_lb_id upstream_response_time_p99:app_lb_id request_time_avg:app_lb_id request_time_p50:app_lb_id request_time_p90:app_lb_id request_time_p99:app_lb_id
  app_lb_id_host_status	10s	app_lb_id+host+status	pv:app_lb_id:host:status body_bytes_sent_avg:app_lb_id:host:status body_bytes_sent_sum:app_lb_id:host:status request_length_avg:app_lb_id:host:status request_length_sum:app_lb_id:host:status upstream_response_time_avg:app_lb_id:host:status upstream_response_time_p50:app_lb_id:host:status upstream_response_time_p90:app_lb_id:host:status upstream_response_time_p99:app_lb_id:host:status request_time_avg:app_lb_id:host:status request_time_p50:app_lb_id:host:status request_time_p90:app_lb_id:host:status request_time_p99:app_lb_id:host:status

• Inspection rules

  Rule name	Inspection algorithm	Inspection metric
  alb-patrol-total	Time2Graph	pv body_bytes_sent_avg body_bytes_sent_sum request_length_avg request_length_sum upstream_response_time_avg upstream_response_time_p50 upstream_response_time_p90 upstream_response_time_p99 request_time_avg request_time_p50 request_time_p90 request_time_p99
  alb-patrol-alb	Time2Graph	pv:alb body_bytes_sent_avg:alb body_bytes_sent_sum:alb request_length_avg:alb request_length_sum:alb upstream_response_time_avg:alb upstream_response_time_p50:alb upstream_response_time_p90:alb upstream_response_time_p99:alb request_time_avg:alb request_time_p50:alb request_time_p90:alb request_time_p99:alb

• Dedicated dashboards

  Dashboard name	Associated Logstore or Metricstore	Description
  Monitoring Overview	access_log_logstore_name-metrics	Displays an overview of ALB instance monitoring metrics. The metrics include core indicators, error codes, traffic, anomalies, PVs, request success rate, and average latency.
  Monitoring Center	access_log_logstore_name-metrics access_log_logstore_name	Displays real-time monitoring data for the ALB instance. The data includes PVs, request success rate, average latency, number of 4xx requests, status distribution, traffic, P50 latency, P90 latency, P99 latency, top requested hosts, top latency hosts, top failure rate hosts, top requested URLs, top latency URLs, top failure rate URLs, top requested backends, top latency backends, and top failure rate backends.
  Real-time Monitoring	access_log_logstore_name	Displays monitoring information at a one-second granularity to help you identify transient jitter and anomalies. The information includes QPS, access latency, upstream latency, success rate, request traffic, response body traffic, 2xx status codes, 3xx status codes, error status codes, upstream 2xx status codes, upstream 3xx status codes, and upstream error status codes.
  Instance Inspection	access_log_logstore_name-metrics access_log_logstore_name-metrics-result	Automatically detects anomalies in the ALB instance based on machine learning algorithms provided by Simple Log Service. The metrics include total anomalies, high-severity anomalies, anomaly severity distribution, medium-severity anomalies, low-severity anomalies, anomaly metric distribution, anomaly list, and anomalies.
  Access Overview	access_log_logstore_name	Displays the overall status of the ALB instance. The metrics include PVs vs. yesterday, PVs vs. last week, UVs vs. yesterday, UVs vs. last week, PV distribution, UV distribution, today's PVs, 7-day PVs, top 10 provinces by access, mobile client ratio, top 10 hosts by access, top 10 user agents by access, and top IP addresses by access.