Transfer Falco container runtime alerts to Logstore

Limits

In Log Audit Service, Logtail supports collecting Falco alerts only from Kubernetes and Docker environments.

1. Install Falco

To install Falco, see Falco installation documentation.

2. Configure Logtail components

2.1 Install the Logtail component

To install Logtail components in Alibaba Cloud Kubernetes clusters and self-managed Kubernetes clusters, see Install Logtail components in an ACK cluster and Install Logtail components in a self-managed Kubernetes cluster.

2.2 Configure Logtail

1. Log on to the Simple Log Service console. In the Log Application area, on the Audit & Security tab, click Log Audit Service (New Version).

2. On the Log Audit Service (New Version) page, click an associated project. Alternatively, click Associate Project to associate a project with Log Audit Service.

   The page displays a list of associated projects with columns for Project, Description, Region, and Actions. In the Actions column, you can click Details to view project information or click Disassociate to remove the association.

3. In the left navigation bar, select Data Collection > Runtime, click Create Logtail Configuration, and then click Falco from the drop-down list.

4. On the Machine Group Configurations page, select the target Machine Groups, and click Next.

   In the Source Machine Groups pane, select a machine group and click > to move it to the Applied Machine Groups pane.

5. On the Logtail Configurations page, the parameters are configured by default. Click Complete at the bottom of the page.

   Important

   By default, Falco exports container runtime alerts as container stdout and stderr. Simple Log Service allows you to collect container stdout and stderr in DaemonSet mode. For more information, see Use the Simple Log Service console to collect container stdout and stderr in DaemonSet mode. If Falco exports container runtime alerts to a fixed file, you can collect the alerts from the file in DaemonSet mode. For more information, see Use the Simple Log Service console to collect container text logs in DaemonSet mode.

2.3 Verify the configuration

After the Logtail component is configured, Simple Log Service automatically creates the following resources in the associated project:

1. A Logtail collection configuration named falco-pipelineconfig.

   In the left-side navigation pane, choose Data Collection > Runtime to view the configuration in the Logtail configuration list.

2. A Logstore named falco-log.

   In the left-side navigation pane, click Runtime and select the Falco tab to view this Logstore and its query interface.

3. Query and analyze logs

In the left navigation bar, select Query and Analysis > Runtime, and click the Falco tab. For descriptions of the log fields collected by Falco, see Falco Runtime Log Field Descriptions. For the search syntax, see Search Syntax and Features.

The falco-log Logstore opens, displaying its query interface. In the search bar, enter a query statement to view the Falco runtime logs.