Configure Cloud Config log collection

Background

• Cloud Config is a resource audit service that provides capabilities such as tracking resource configuration history and compliance auditing. For more information, see What is Cloud Config?.

• Log Audit Service is built on Log Service (SLS) and uses a multi-project center to manage log data. It lets you centralize, query, and analyze logs from various cloud services in compliance with regional data regulations. For more information, see Overview of Log Audit Service.

Overview

Prerequisites

• Activate Log Service (SLS). For more information, see Use Logtail to collect and analyze text logs from ECS instances.

• Activate Cloud Config. For instructions, see Activate Cloud Config.

Step 1: Associate a project

1. Log on to the Log Service console and create a Project and a Logstore. The name of the Logstore must start with the prefix cloudconfig_. For example, create a Project named sample-config-cn-hangzhou in the China (Hangzhou) region and a Logstore named cloudconfig_sample.

2. In the Log Application section, on the Audit & Security tab, click Log Audit Service (New Version).

3. On the Log Audit Service page, click Associate Project. In the dialog box, select the Project to associate and click Associate.

   Note

   Log Audit Service ships Cloud Config logs to the associated Project.

   The dialog box includes three fields: Region, Project, and Notes.

4. On the Log Audit Service page, click the name of the associated Project.

5. On the Cloud Service tab, select Cloud Config and click Enable Now.

Step 2: Create a data shipping rule

1. In the Cloud Config > Enable pane, review the requirements for the data shipping rule, and then click Cloud Config console.

   You can use any name for the rule. Channel Type must be Log Service (SLS), and all options for Content must be selected. The destination Logstore name must start with the cloudconfig_ prefix. To enable log collection for Cloud Config, the Project you associated with Log Audit Service must contain a Logstore whose name starts with the cloudconfig_ prefix.

2. In the Cloud Config console, use the following settings to create a data shipping rule named sample-config.

   Set Channel Type to Log Service (SLS) and select Configuration Change History, Resource Non-compliance Event, and Scheduled Resource Snapshot for the Content. For Log Project Source, select Select an existing Log Service project in the current account. Then, set Log Project Region to China (Hangzhou), select the Project named sample-config-cn-hangzhou and the Logstore named cloudconfig_sample. Set Minimum Risk Level of Events to All and Events of Specified Resource Types to All resource types. After you configure the settings, click OK.

3. After you create the data shipping rule, its details appear.

   The Delivery Task Name is sample-config, Channel Type is Log Service (SLS), and Status is Enabled. The Logstore is cloudconfig_sample, the Project is sample-config-cn-hangzhou, and the Region is China (Hangzhou). The Content includes Configuration Change History, Scheduled Resource Snapshot, and Resource Non-compliance Event. Minimum Risk Level of Events is set to All, and Events of Specified Resource Types is set to All resource types. In the upper-right corner of the page, you can click Edit, Disable, or Delete.

Step 3: Query and analyze logs

1. Return to the Log Audit Service page and click the name of your Project. On the Cloud Service tab, find Cloud Config in the Enabled Cloud Services list and click View.

2. On the Query & Analysis > Cloud Config Logs page, query and analyze the collected logs.

   Note

   After you create a data shipping rule in the Cloud Config console, the index for the destination Logstore is not enabled by default. This can cause errors when you first access the Logstore. Enable the index for the Logstore. For more information, see Create an index.

   Enter a query statement in the search bar and click Search & Analyze. The results appear on the Raw Logs tab.

References

• To learn how to enable an index for a Logstore, see Create an index. To learn how to query and analyze logs, see Quick start for query and analysis.

• This topic uses Cloud Config to demonstrate how to integrate a cloud service with Log Audit Service. For information about other cloud services, including their log types, default Project names, default Logstore names, and billing details, see Notes on collecting logs from cloud services.