After you enable the log analysis feature, a dedicated project is created for Security Center logs in the Simple Log Service console and a dedicated Logstore is created in the project. The full logs of Security Center are stored in the dedicated Logstore. This topic describes the log storage information that you need to know before you use the log analysis feature of Security Center.
After you enable the log analysis feature, you can view the dedicated project for Security Center logs and the dedicated Logstore in the Simple Log Service console. The project name is in the sas-log-Alibaba Cloud account ID-Region ID format, and the Logstore is named sas-log. Do not delete the project.
If the log analysis feature is not enabled, no dedicated project is created. If you use Security Center Basic or a different edition of Security Center for which you have not purchased log storage capacity, the dedicated project for Security Center logs does not exist in the Simple Log Service console.
If you accidentally delete the dedicated project, the The project is deleted. You must activate Log Service again. message appears, and log data in the project is deleted. To continue using the log analysis feature, perform the following operations: Log on to the Security Center console, go to the Log Analysis page, and then click Recreate a project. You cannot restore deleted log data.
Logstore limits
You cannot use Simple Log Service SDK or Simple Log Service API to write data into a Logstore or modify the attributes of the Logstore, such as the retention period.
To enable log analysis of Security Center, you must activate Simple Log Service and purchase log storage capacity.
The built-in reports may be updated in later versions.
Security Center Enterprise and Security Center Ultimate support 16 subtypes of logs. Security Center Anti-virus and Security Center Advanced support only 12 subtypes of host logs and security logs. Security Center Anti-virus and Security Center Advanced do not support network logs.
Regions for log storage
After you enable the log analysis feature, Simple Log Service automatically creates projects to store the log data of Security Center.
The following table describes the source regions of log data that is stored in these projects.
Region of the project | Source region of log data |
China (Hangzhou) | Regions in the Chinese mainland |
Singapore | Regions outside the Chinese mainland |