Log management

Prerequisites

• The current account must have the AliyunSASFullAccess permission or an equivalent RAM policy to manage Log Management.

• To use standardized logs, both Log Management and Agentic SOC must be enabled.

• Log storage is available in selected regions only. Check the Log Management page for the list of supported regions.

Enable Log Management

Log Management can be enabled using either the subscription or pay-as-you-go billing method.

1. Log on to the .

2. In the left navigation pane, choose Detection and Response > Log Management. In the upper-left corner, select the region where your assets are located: Chinese Mainland or Outside Chinese Mainland.

   If you have purchased Agentic SOC log ingestion traffic on a subscription basis or enabled pay-as-you-go for Agentic SOC, the navigation entry changes to Agentic SOC > Log Management.

3. On the Log Management page, click Activate Subscription or Activate Pay-as-you-go.

   • Subscription: On the purchase page, under Agentic SOC, set Purchase or Not to Yes, select the log storage capacity, click Order Now, and complete the payment. See Purchase Security Center for available features and pricing.

   • Pay-as-you-go: In the dialog box, read the billing rules, select a storage region, and click Activate and Authorize.

   If you have already purchased Agentic SOC log ingestion traffic, click Enable Pay-as-you-go for Log Management in the upper-right corner of the page, or upgrade your service to add log storage capacity for Agentic SOC. See Upgrades and downgrades.

After enabling, return to the Log Management page and verify that the service status shows Active and Log Usage displays a non-zero value. Logs should begin appearing in the Log Service Logstore within a few minutes.

Disable Log Management

1. Log on to the .

2. In the left navigation pane, choose Agentic SOC > Log Management. In the upper-left corner, select the region where your assets are located: Chinese Mainland or Outside Chinese Mainland.

   Note

   If the Agentic SOC navigation entry is not visible in the left navigation pane, choose Detection and Response > Log Management instead.

3. On the Log Management page, verify that Log Usage shows 0 GB. If log usage is not 0, click Delete in the upper-right corner, wait for the logs to be cleared, then continue.

4. Disable the service based on your billing method:

   • Subscription

     • Method 1 — Downgrade:

       1. On the Overview page, click Change > Downgrade.

       2. On the Order Downgrade tab, set Log Storage Capacity in the Agentic SOC section to 0 GB.

       3. Accept the Security Center Service Agreement and click Order Now.

       4. In the left navigation pane, click Overview to return to the Security Center overview page.

     • Method 2 — Unsubscribe: Submit a to unsubscribe from your Security Center instance.

   • Pay-as-you-go: On the Overview page of the Security Center console, in the Pay-as-you-go section, turn off the Log Management switch.

     Warning

     Turning off the Log Management switch automatically disables log delivery and deletes the corresponding Logstore. Deleted log data cannot be recovered.

Using Agentic SOC log ingestion traffic without log storage capacity

If you have purchased Agentic SOC log ingestion traffic (subscription or pay-as-you-go) but have not purchased log storage capacity, you can query a subset of standardized logs on the Log Management page — specifically, logs from access policies where Standardization Method is set to Scan Query.

In this configuration:

• Security Center logs cannot be delivered or viewed.

• Standardized logs from Real-time Consumption access policies cannot be delivered or viewed.

For a full comparison of features available under different billing configurations, see Purchase and enable the Agentic SOC feature.

Enable log delivery

After you purchase log storage capacity, Agentic SOC enables delivery for all Security Center log types by default. If you have not purchased the corresponding value-added services (such as application protection or malicious file detection), the delivery switches for those log types remain disabled.

Click Log Settings on the Log Management page to view and update delivery status for each log type.

Query Security Center logs

Log query methods are the same as those in the Log Analysis feature. For more information, see Custom log query and analysis.

1. In the left navigation pane, choose Agentic SOC > Log Management. In the upper-left corner, select the region where your assets are located.

2. In the upper-left corner of the Log Management page, click Security Center Logs and select the log type to view.

   

3. Set a time range and use search statements to retrieve logs and view analysis results.

How delivery works

Standardized logs are produced when Agentic SOC normalizes ingested logs into a common schema. Delivery is automatic — you cannot enable or disable it manually. Delivery is triggered in two scenarios:

• When an access policy's Standardization Method is set to Real-time Consumption, Agentic SOC delivers the normalized logs to the corresponding Logstore, organized by standardized category. A log delivery task is created automatically when you create the access policy.

• When custom rules generate alert logs (such as EDR alert logs or firewall alert logs), those logs are also delivered automatically.

On the Standardized Log tab of the Log Settings panel, the Number of references column shows how many access policies with Real-time Consumption are associated with each standardized category and structure.

Query standardized logs

Agentic SOC supports searching logs by standardized structure and querying across multiple Logstores using datasets (StoreView). For cross-Logstore query and analysis examples, see Common query/analysis result examples.

Network logs

Agentic SOC ingests and normalizes four categories of network logs: DNS logs, Local DNS logs, Network Session logs, and Web logs. Each log type is standardized into a common schema with a dedicated EtlMetaName for identification and routing. All network logs follow the V2 standardized log format.

Modify the log retention period

The default retention period for delivered logs is 180 days. Modify it as needed to meet your compliance or cost requirements.

1. In the left navigation pane, choose Agentic SOC > Log Management. In the upper-left corner, select your region.

2. In the upper-right corner of the Log Management page, click Log Settings.

3. On the Security Center Logs or Standardized Log tab, click the icon in the Log Retention Period column to update the value.

Increase or delete storage capacity

On the Agentic SOC > Log Management page, you can view your current log usage and total purchased capacity.

• Scale Out: Click Scale Out to purchase additional log storage capacity. When capacity is exhausted, new logs cannot be delivered until more capacity is purchased.

• Delete: Click Delete to delete all stored logs. The deletion process takes 0–24 hours.

Reduce log delivery volume

If your log storage costs are high, you can reduce the volume of logs delivered to Simple Log Service (SLS) by identifying and disabling log types that are not critical to your security operations.

Security Center delivers multiple categories of host logs to SLS, including logon logs, network connection logs, and process startup logs. When log volume is high — for example, 80 ECS instances can generate 1.7 TB of logs over 30 days — storage costs for long retention periods such as 180 days can become significant.

Step 1: Identify high-volume log types in the SLS console

1. Log on to the Simple Log Service (SLS) console.

2. In the left navigation pane, find the Logstore associated with your Security Center project.

3. Use the __topic__ field to group and compare log volume by log type. The __topic__ field contains the log category identifier, which allows you to view the storage share of each log type.

4. Identify the log types that consume the most storage. Typical high-volume log types include:

   • Logon logs

   • Network connection logs

   • Process startup logs

Step 2: Disable unnecessary log types in Security Center

1. Log on to the .

2. In the left navigation pane, choose Agentic SOC > Log Management.

3. On the Log Management page, click Log Settings in the upper-right corner.

4. Based on your analysis from Step 1, locate the log types that generate the most storage volume, and turn off the toggle for each type you want to disable.

Why can't I enable pay-as-you-go billing for Log Management?

There are three common reasons:

Reason 1: You have an active subscription for Agentic SOC log storage or log analysis.

Unsubscribe from the existing subscription, then enable pay-as-you-go for Log Management.

Reason 2: Your Agentic SOC feature is on the 1.0 architecture.

Upgrade the Agentic SOC feature from 1.0 to 2.0, then enable pay-as-you-go for Log Management.

If you prefer not to upgrade to the 2.0 architecture, you can still use Log Management by purchasing log storage capacity on a subscription basis.

Reason 3: You purchased Agentic SOC log storage on or before April 26, 2024.

After upgrading to the 2.0 architecture, your original subscription capacity is preserved and Log Management continues to work normally. To switch from subscription to pay-as-you-go, follow the steps for Reason 1. For architecture upgrade details, see [Notice] Upgrade of the Agentic SOC feature.

What is the difference between Log Analysis and Log Management?

Both features provide security log query and analysis in Security Center, but they differ in scope and flexibility.

Use Log Management if you need standardized log storage, flexible billing, or configurable retention — for example, to meet classified protection compliance requirements.