Monitor Simple Log Service with CloudLens for SLS

Updated at:

CloudLens for SLS lets you monitor and manage SLS assets such as projects and Logstores, improving management efficiency and providing visibility into resource consumption.

Background information

After you enable CloudLens for SLS, SLS collects global logs (audit logs, error logs, and metrics) and operational logs (important logs from the original instance logs and job operational logs) by default. These logs are free of charge.

  • If this is the first time you enable CloudLens for SLS, Global Logs are stored in a project named log-service-{Alibaba Cloud primary account ID}-{region}, where region is the Global Log Storage Region that you select when you enable CloudLens for SLS. Operation Logs are stored in a project named log-service-{Alibaba Cloud primary account ID}-{region}, where region is the region of the project. For a list of supported region values, see Usage notes.

    Important

    If you delete the project that stores operational logs, SLS automatically creates a new one.

  • If you have already enabled CloudLens for SLS, your existing region and project settings are used.

The following example shows how to use CloudLens for SLS when a project quota is exceeded. Usage notes for CloudLens for SLS.

1. Enable CloudLens for SLS

  1. Log on to the Log Service console.
  2. In the Log Application section, click the Cloud Service Lens tab, and then click CloudLens for SLS.

  3. On the Data Import Management page, click the SLS Collection Policies tab and follow the on-screen instructions to enable the feature. The system automatically grants the AliyunServiceRoleForSLSAudit service-linked role to CloudLens for SLS, allowing it to collect global logs and operational logs. For more information, see Manage the AliyunServiceRoleForSLSAudit service-linked role.

2. View monitoring results

After you enable log collection, SLS automatically generates dashboards from the collected logs.

2.1 View project quotas

  1. In the left-side navigation pane, click Asset Overview.

  2. On the Project Asset Overview tab, click Details in the Quota column for the target project. Adjust resource quotas.

2.2 View project quota usage

In the left-side navigation pane, choose Report Center > Quota Monitoring. A project's quota covers logstores, dashboards, shards, alerts, machine groups, and Logtail configurations.

Quota monitoring

3. Set up alerts

Enable alerts to receive notifications when a project quota is exceeded.

  1. In the left-side navigation pane, click Anomaly Detection.

  2. Configure the built-in action policy for CloudLens for SLS.

    1. On the Alert Center page, select the target project, and then choose Notification Policy > Action Policy. Click Modify in the Actions column for the SLS Lens Built-in Action Policy.

    2. In the Edit Policy dialog box, configure the following parameters and then click Confirm. Notification channel descriptions.

      Set Channel to SMS and Recipient Type to Static Recipient, and then select a Recipient. Set Content Template to SLS Lens Built-in Content Template and Sending Period to Any Time. To add other notification channels, click Add Notification Channel at the bottom.

  3. Create an alert monitoring rule.

    1. On the Alert Rules tab, click Create from Template.

    2. In the right-side panel, click the Project Quota Exceeded Monitoring card.

      To find the template card, select the SLS Lens Quota Monitoring category from the category list on the left.

    3. In the Parameter Settings dialog box, configure Destination as described below, use the default values for the other parameters, and then click OK. Standard mode.

      For Output Target, select the Event Library, CloudMonitor Event Center, and SLS Notification checkboxes, and ensure they are enabled. Set Alert Policy to Standard Mode and Action Policy to sls.app.sls_lens.builtin.

  4. An alert triggers when the threshold is exceeded.

    When project quota overruns exceed the threshold, you receive an SMS similar to the following:

    [Alibaba Cloud] Simple Log Service Alert: 1 alert in total. Alert details:
    Alibaba Cloud account: 165*******3050
    Alert Title: Too many project quota overruns
    Alert Content: In the past 1 minute, 3 quota overrun errors occurred in project ****. This number exceeds the preset monitoring threshold. Please check for anomalies.
    Alert Severity: High