Enable log collection

Manually enable log collection

CloudLens for RDS supports collecting the audit log, error log, and slow query log. The procedure is similar for all log types. This section uses audit log collection as an example.

1. Log on to the Simple Log Service console.

2. In the Log Application area, on the Cloud Service Lens tab, click CloudLens for RDS.

3. If you are enabling the feature for the first time, complete the authorization as prompted.

   • A system role named AliyunLogArchiveRole is automatically created. CloudLens for RDS assumes this role to write logs.

   • A service-linked role named AliyunServiceRoleForSLSAudit is automatically created. CloudLens for RDS assumes this role to collect the ApsaraDB RDS audit log. For more information, see Manage the service-linked role AliyunServiceRoleForSLSAudit.

4. On the Data Import Management page, on the RDS Cluster Access tab, find the target ApsaraDB RDS instance and click Enable in the Audit Logs column.

5. In the Enable Audit Log Collection dialog box, select the destination project and logstore, and then click Confirm.

   After you enable collection, Simple Log Service starts to collect the audit log for the target ApsaraDB RDS instance.

   In the cluster list on the RDS Cluster Access page, the status in the Audit Log, Slow Query Log, and Error Log columns for the target instance changes to Collection Enabled.

Configure automatic collection

CloudLens for RDS supports collecting the audit log, error log, and slow query log. The procedure is similar for all log types. This section uses audit log collection as an example.

1. Log on to the Simple Log Service console.

2. In the Log Application area, on the Cloud Service Lens tab, click CloudLens for RDS.

3. On the Data Import Management page, click the Automatic Collection Configuration tab.

4. Turn on the Automatic Collection Configuration switch.

5. Click the icon. Create a Condition, an Automatic Collection Configuration, and an End node in sequence, then click Save in the upper-right corner. The Condition node is optional. The Automatic Collection Configuration and End nodes are required.

   Condition

   • Specify collection conditions using properties such as Alibaba Cloud account ID, region, instance ID, instance name, database type, database version, and tag.

   • In the lower-left corner of the dialog box, switch between Advanced Mode and Standard Mode. In Standard Mode, conditions are joined by the AND operator. In Advanced Mode, you can flexibly combine and nest conditions. For more information about the configuration rules, see Matching modes of a condition node.

   Automatic collection configuration

   Parameter	Description
   Automatic collection type	Select an automatic collection type. The following options are available: Custom Destination Logstore: Automatically collects the audit log of ApsaraDB RDS instances that meet the specified conditions to a destination logstore. If the destination storage (project, logstore) does not exist, it is automatically created. Keep collection settings: When you select Keep collection settings, you do not need to configure the Region, Project, LogStore, or conflict policy parameters. For matching instances where collection is disabled, it will not be automatically enabled. For matching instances where collection is already enabled, their destination logstore remains unchanged.
   Region	The system automatically selects the region of the target ApsaraDB RDS instance. This setting cannot be modified.
   Project	In the region where the ApsaraDB RDS instance resides, the system automatically creates a project named rds-xxx-${Alibaba Cloud account ID}-${region}. For example, rds-test-117918634953****-cn-hangzhou.
   Logstore	In the project named rds-xxx-${Alibaba Cloud account ID}-${region}, the system automatically creates a logstore named rds_log.
   Conflict policy	If your configured destination differs from the current one, the system applies the selected policy: Ignore: The current destination is kept. Overwrite: The configured destination is used.

6. This example configuration performs the following actions:

   1. Delivers the audit log from ApsaraDB RDS for MySQL instances with the tag env==prod to the rds_log logstore within the project named rds-prod-${Alibaba Cloud account ID}-${region}.

   2. Delivers the audit log from ApsaraDB RDS for MySQL instances with the tag env==test to the rds_log logstore within the project named rds-test-${Alibaba Cloud account ID}-${region}.

   3. For other ApsaraDB RDS instances, the destination for the audit log remains unchanged.

      The workflow for this automatic collection policy is configured as follows: The first condition node checks if database type is equal to mysql and tag.env is equal to prod. If the conditions are met, the automatic collection type is set to Custom Destination Logstore, the region is set to Same Region as the Collection Object, the project is set to rds-prod-${Alibaba Cloud account ID}-${region}, the logstore is set to rds_log, and the conflict policy is set to Overwrite. The second condition node checks if tag.env is equal to test. If this condition is met, a similar configuration is applied, but the project is set to rds-test-${Alibaba Cloud account ID}-${region}. The logstore and conflict policy settings are the same. If neither condition is met, the automatic collection type is set to Collection Remains Unchanged.

Related operations