Evaluating Alibaba Cloud SLS as an Incident-Response Logging Architecture

Alibaba Cloud's Simple Log Service (SLS) offers a comprehensive observability platform that enables the collection, processing, querying, analysis, visualization, and alerting of logs, metrics, traces, and events. The platform is designed to address the challenge of effectively using logs during production incidents, rather than simply serving as an archive of application output.

A common oversight in observability is treating centralized logging as the ultimate goal. While centralizing logs provides a location for data storage, it does not automatically solve subsequent questions such as which fields should be searchable, how logs from different services should be structured, what should trigger alerts, how to differentiate isolated errors from developing incidents, log retention periods, and the speed at which an engineer can transition from an alert to relevant evidence.

Alibaba's LoongCollector is a next-generation observability data collector designed to bring Kubernetes logs into SLS. It supports multiple collection models, including DaemonSet and Sidecar approaches. DaemonSet mode involves running a LoongCollector instance on each Kubernetes node, automatically creating a new instance when a new node is added.

In contrast, the Sidecar model places a dedicated LoongCollector container alongside the application container within a pod, providing stronger workload isolation and fine-grained control over collection configuration at the expense of additional resources per pod.

The choice between these two collection models depends on the operating model. Large environments with similar logging requirements may benefit from node-level collection, while applications with specialized logging requirements or stronger isolation needs may favor the Sidecar model. From an SRE perspective, the decision should be based on operational requirements rather than convenience alone.

Once logs are collected, SLS can transform them into structured data, making them more searchable and analyzable. For example, a Java stack trace or HTTP access log can be parsed into key-value pairs, allowing engineers to ask more insightful questions during incidents. This transformation turns raw logs into structured data, enabling operational analysis and turning centralized logging into a reliable component of the reliability engineering process.