After creating an alarm policy, the logging service defaults to enabling the alarm service logging function and logging the entire life cycle of the alarm. All alarm service logs are stored in the tls_alarm -log log topic under the tls_servicetls_alarm -log log topic under the tls_service -project log project. For the detailed description of the alarm service log, see Execution logs for alarm policies and Alarm event logs.

You can view and analyze the alarm service logs in the tls_alarm -log log topic, for example by executing the following statement to count the number of times each monitoring policy triggered an alarm in the last day.

search analysis statement

ReachTrigger:true | SELECT ProjectName, AlarmName, count(*) AS num GROUP by ProjectName, AlarmName ORDER BY num DESC

Search analysis results

The alarm service log is only stored for 30 days. How can I extend the storage time?

Alarm service logs including Execution logs for alarm policies and Alarm event logs are stored in the tls_alarm-log log topic under the tls_servicetls_alarm-log log topic under the tls_service-project log project, the log topic does not incur storage and other basic costs, its log storage time is fixed to 30 days, does not support modification. If you want to store longer, you can copy the service logs to other log topics through data processing and set a longer log storage duration.

Notice

Data processing and storage for other log topics will incur costs such as data processing traffic and log storage space. Please refer to the description of billing items Billing items based on pay-by-feature mode.

Last updated: 2026.07.30 17:29:25

Public security network record in Beijing: No. 11010802032137