diff --git a/etc/logs_dev.yaml b/etc/logs_dev.yaml
index b39bc27..e79adf3 100644
--- a/etc/logs_dev.yaml
+++ b/etc/logs_dev.yaml
@@ -20,12 +20,12 @@ Ingest:
   trap_listen_addr: "0.0.0.0:9162"
   rule_refresh_secs: 30
 
-AlertForward:
-  enabled: true
-  base_url: https://ops-api.apinb.com
-  internal_key: "ops-alert"
-  default_policy_id: 0
-
-ResourceEvent:
-  hmac_secret: "replace-with-dc-control-shared-secret"
-  max_skew_secs: 300
+AlertForward:
+  enabled: true
+  base_url: https://ops-api.apinb.com
+  internal_key: ${LOGS_ALERT_SECRET}
+  default_policy_id: 0
+
+ResourceEvent:
+  hmac_secret: ${DC_CONTROL_LOGS_EVENT_SECRET}
+  max_skew_secs: 300
diff --git a/etc/logs_prod.yaml b/etc/logs_prod.yaml
index b39bc27..e79adf3 100644
--- a/etc/logs_prod.yaml
+++ b/etc/logs_prod.yaml
@@ -20,12 +20,12 @@ Ingest:
   trap_listen_addr: "0.0.0.0:9162"
   rule_refresh_secs: 30
 
-AlertForward:
-  enabled: true
-  base_url: https://ops-api.apinb.com
-  internal_key: "ops-alert"
-  default_policy_id: 0
-
-ResourceEvent:
-  hmac_secret: "replace-with-dc-control-shared-secret"
-  max_skew_secs: 300
+AlertForward:
+  enabled: true
+  base_url: https://ops-api.apinb.com
+  internal_key: ${LOGS_ALERT_SECRET}
+  default_policy_id: 0
+
+ResourceEvent:
+  hmac_secret: ${DC_CONTROL_LOGS_EVENT_SECRET}
+  max_skew_secs: 300
diff --git a/internal/config/config.go b/internal/config/config.go
index 3420230..9f2bb46 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -1,51 +1,58 @@
-package config
-
-import (
-	"net"
-
-	"git.apinb.com/bsm-sdk/core/conf"
-)
-
-var Spec SrvConfig
-
-type AlertForwardConf struct {
-	BaseURL         string `yaml:"base_url"`
-	InternalKey     string `yaml:"internal_key"`
-	Enabled         bool   `yaml:"enabled"`
-	DefaultPolicyID uint   `yaml:"default_policy_id"`
-}
-
-type IngestConf struct {
-	SyslogListenAddr string `yaml:"syslog_listen_addr"`
-	TrapListenAddr   string `yaml:"trap_listen_addr"`
-	RuleRefreshSecs  int    `yaml:"rule_refresh_secs"`
-}
-
-type ResourceEventConf struct {
-	// HMACSecret 用于校验 dc-control 推送签名（X-Event-Signature）。
-	HMACSecret string `yaml:"hmac_secret"`
-	// MaxSkewSecs 允许事件时间与服务端时间的最大偏差（秒）。
-	MaxSkewSecs int `yaml:"max_skew_secs"`
-}
-
-type SrvConfig struct {
-	conf.Base      `yaml:",inline"`
-	Databases      *conf.DBConf            `yaml:"Databases"`
-	MicroService   *conf.MicroServiceConf  `yaml:"MicroService"`
-	Rpc            map[string]conf.RpcConf `yaml:"Rpc"`
-	Gateway        *conf.GatewayConf       `yaml:"Gateway"`
-	Apm            *conf.ApmConf           `yaml:"APM"`
-	Etcd           *conf.EtcdConf          `yaml:"Etcd"`
-	AlertForward   *AlertForwardConf       `yaml:"AlertForward"`
-	Ingest         IngestConf              `yaml:"Ingest"`
-	ResourceEvent  ResourceEventConf       `yaml:"ResourceEvent"`
-}
-
-func New(srvKey string) {
-	conf.New(srvKey, &Spec)
-	Spec.Port = conf.CheckPort(Spec.Port)
-	Spec.BindIP = conf.CheckIP(Spec.BindIP)
-	Spec.Addr = net.JoinHostPort(Spec.BindIP, Spec.Port)
-	conf.NotNil(Spec.Service, Spec.Cache)
-	conf.PrintInfo(Spec.Addr)
-}
+package config
+
+import (
+	"net"
+	"strings"
+
+	"git.apinb.com/bsm-sdk/core/conf"
+)
+
+var Spec SrvConfig
+
+type AlertForwardConf struct {
+	BaseURL         string `yaml:"base_url"`
+	InternalKey     string `yaml:"internal_key"`
+	Enabled         bool   `yaml:"enabled"`
+	DefaultPolicyID uint   `yaml:"default_policy_id"`
+}
+
+type IngestConf struct {
+	SyslogListenAddr string `yaml:"syslog_listen_addr"`
+	TrapListenAddr   string `yaml:"trap_listen_addr"`
+	RuleRefreshSecs  int    `yaml:"rule_refresh_secs"`
+}
+
+type ResourceEventConf struct {
+	// HMACSecret 用于校验 dc-control 推送签名（X-Event-Signature）。
+	HMACSecret string `yaml:"hmac_secret"`
+	// MaxSkewSecs 允许事件时间与服务端时间的最大偏差（秒）。
+	MaxSkewSecs int `yaml:"max_skew_secs"`
+}
+
+type SrvConfig struct {
+	conf.Base     `yaml:",inline"`
+	Databases     *conf.DBConf            `yaml:"Databases"`
+	MicroService  *conf.MicroServiceConf  `yaml:"MicroService"`
+	Rpc           map[string]conf.RpcConf `yaml:"Rpc"`
+	Gateway       *conf.GatewayConf       `yaml:"Gateway"`
+	Apm           *conf.ApmConf           `yaml:"APM"`
+	Etcd          *conf.EtcdConf          `yaml:"Etcd"`
+	AlertForward  *AlertForwardConf       `yaml:"AlertForward"`
+	Ingest        IngestConf              `yaml:"Ingest"`
+	ResourceEvent ResourceEventConf       `yaml:"ResourceEvent"`
+}
+
+func New(srvKey string) {
+	conf.New(srvKey, &Spec)
+	Spec.Port = conf.CheckPort(Spec.Port)
+	Spec.BindIP = conf.CheckIP(Spec.BindIP)
+	Spec.Addr = net.JoinHostPort(Spec.BindIP, Spec.Port)
+	Spec.ResourceEvent.HMACSecret = strings.TrimSpace(Spec.ResourceEvent.HMACSecret)
+	conf.NotNil(Spec.Service, Spec.Cache, Spec.ResourceEvent.HMACSecret)
+	if Spec.AlertForward != nil && Spec.AlertForward.Enabled {
+		Spec.AlertForward.BaseURL = strings.TrimSpace(Spec.AlertForward.BaseURL)
+		Spec.AlertForward.InternalKey = strings.TrimSpace(Spec.AlertForward.InternalKey)
+		conf.NotNil(Spec.AlertForward.BaseURL, Spec.AlertForward.InternalKey)
+	}
+	conf.PrintInfo(Spec.Addr)
+}