If you enable the log collection feature for specific cloud services in Log Audit Service, you are charged additional fees for the cloud services. This topic describes the additional fees.
VPC
Billing
The public preview of the flow log feature ends on September 1, 2022. You are charged if you continue to use the flow log feature after this date. For more information, see Announcement on commercialization of the flow log feature.
When you collect flow logs, you are charged Simple Log Service usage fees and log generation fees. For more information, see Billing of flow logs.
Enable the collection of flow logs
After you enable the collection of Virtual Private Cloud (VPC) flow logs in Log Audit Service, Log Audit Service automatically completes the following operations:
Enable the flow log feature for the central account and the members that are configured for multi-account collection.
Enable the flow log feature for the VPCs that match the specified collection policy and store the collected flow logs in the dedicated project of Log Audit Service. By default, the flow log feature is enabled for all VPCs. For more information, see Configure log collection policies.
Disable the collection of flow logs
For more information about how to disable the collection of flow logs, see Disable log collection.
After you disable the collection of VPC flow logs in Log Audit Service, Log Audit Service automatically completes the following operations:
VPC stops generating flow log traffic for the related VPCs.
Log Audit Service stops collecting VPC flow logs and no longer stores the logs in the dedicated project.
If you delete the dedicated project and you do not disable the collection of VPC flow logs for the project, Log Audit Service cannot ensure that traffic stops being generated across VPCs at the same time. In this case, submit a ticket.
You can enable the collection of VPC flow logs by using Log Audit Service or the VPC console. The operations that you perform in Log Audit Service are independent of the operations that you perform in the VPC console. You can enable or disable the collection of VPC flow logs based on your business requirements. If you enable the flow log feature in Log Audit Service, you can disable the collection of flow logs only in Log Audit Service.
If you enable the flow log feature by using both Log Audit Service and the VPC console, you are charged twice. We recommend that you enable or disable the feature based on your business requirements.
ApsaraDB RDS
After you enable log collection for ApsaraDB RDS, the SQL Explorer or SQL Audit feature is automatically enabled on the ApsaraDB RDS instances that meet the requirements. ApsaraDB RDS for MySQL instances that do not run Basic Edition and ApsaraDB RDS for PostgreSQL instances that run High-availability Edition are supported. You are charged for the SQL Explorer or SQL Audit feature. For more information about the feature fees, see Billable items.
If you have enabled SQL Explorer Trial Edition for your ApsaraDB RDS instance, Log Audit Service automatically disables SQL Explorer Trial Edition and enables the official edition of the SQL Explorer feature after log collection is enabled.
By default, the logs that are generated by the SQL Explorer feature are stored for 30 days. You can change the log retention period in the ApsaraDB RDS console. For more information, see Modify the retention period of SQL audit logs. The log retention period is independent of the data retention period in Log Audit Service that is specified for the audit logs of your ApsaraDB RDS instance. The log retention period and data retention period do not affect each other.
If the log retention period that you specify in the ApsaraDB RDS console is less than 30 days, the logs cannot be delivered to Simple Log Service. Log Audit Service automatically changes the log retention period to 30 days.
If you have stopped collecting the audit logs of your ApsaraDB RDS instance and want to disable the SQL Explorer feature, you must disable the feature in the ApsaraDB RDS console. For more information, see Disable the SQL Explorer feature.
PolarDB
After you enable log collection for PolarDB, the SQL Explorer or SQL Audit feature is automatically enabled on the PolarDB clusters that meet the requirements. Only PolarDB for MySQL clusters are supported. You are charged for the SQL Explorer or SQL Audit feature. For more information about the feature fees, see Billable items.
If you have enabled SQL Explorer Trial Edition for your PolarDB for MySQL cluster, Log Audit Service automatically disables SQL Explorer Trial Edition and enables the official edition of the SQL Explorer feature after log collection is enabled.
By default, the logs that are generated by the SQL Explorer feature are stored for 30 days. You can change the log retention period in the ApsaraDB PolarDB console. For more information, see Change the retention period of SQL logs. The log retention period is independent of the data retention period in Log Audit Service that is specified for the audit logs of your PolarDB for MySQL cluster. The log retention period and data retention period do not affect each other.
If the log retention period that you specify in the ApsaraDB PolarDB console is less than 30 days, the logs cannot be delivered to Simple Log Service. Log Audit Service automatically changes the log retention period to 30 days.
If you have stopped collecting the audit logs of your PolarDB for MySQL cluster and want to disable the SQL Explorer feature, you must disable the feature in the ApsaraDB PolarDB console. For more information, see Disable the SQL Explorer and Audit feature.
DNS
Prerequisites
Alibaba Cloud DNS PrivateZone is activated. You can log on to the Alibaba Cloud DNS console of the new version to activate Alibaba Cloud DNS PrivateZone.
Billing
Starting December 21, 2023, the traffic analysis feature of Alibaba Cloud DNS PrivateZone is automatically enabled when you enable the collection of intranet private DNS logs in Log Audit Service. You are charged for the traffic analysis feature. For more information, see Upgrade announcement. If you do not want to pay for the traffic analysis feature, disable the collection of intranet private DNS logs.
When you collect intranet private DNS logs, you are charged Simple Log Service usage fees and traffic analysis fees. For more information, see Traffic analysis.
Enable the collection of intranet private DNS logs
After you enable the collection of intranet private DNS logs in Log Audit Service, Log Audit Service automatically performs the following operations:
Enable the traffic analysis feature for the VPCs that match the specified collection policy and store the collected intranet private DNS logs in the dedicated project of Log Audit Service. By default, the traffic analysis feature is enabled for all VPCs. For more information, see Configure log collection policies.
Disable the collection of intranet private DNS logs
For more information about how to disable the collection of intranet private DNS logs, see Disable log collection.
After you disable the collection of intranet private DNS logs in Log Audit Service, Log Audit Service stops collecting intranet private DNS logs and no longer stores the logs in the dedicated project.
To disable the traffic analysis feature, log on to the Alibaba Cloud DNS console and click Private DNS (PrivateZone) in the left-side navigation pane. Then, turn off Disable Traffic Analysis.