Help Center/ Object Storage Service/ User Guide/ Monitoring and Logging/ Using Logging to Record OBS Logs/ Configuring Logging for a Bucket
Updated on 2026-09-23 GMT+08:00
View PDF
Share

Configuring Logging for a Bucket

When a bucket is accessed, OBS logs all requests to the bucket. After log storage is enabled for the bucket, OBS stores the logs either in the logged bucket or in another bucket that belongs to the same account and region. You can search and analyze these logs to trace and locate abnormal events. This section describes how to configure logging, verify the logging configuration, and disable logging for a bucket.

Configuring Log Storage for a Bucket

You can use OBS Console, APIs, or SDKs to configure log storage for a bucket. You cannot use OBS Browser+ or obsutil to do so.

Using OBS Console

  1. In the navigation pane of OBS Console, choose Buckets.
  2. In the bucket list, click the desired bucket. The Objects page is displayed.
  3. In the navigation pane, choose Overview.
  4. In the Basic Configurations area, click Log Storage. The Log Storage dialog box is displayed.

    Alternatively, choose Log Management > Log Storage in the navigation pane. The Log Storage page is displayed.

  5. Enable Log Storage. Configure related parameters.

    Figure 1 Log storage
    Table 1 Parameters for configuring logging for the bucket

    Parameter

    Description

    Save Logs To

    Select a bucket to store the log files of the source bucket.

    You can use the source bucket or another bucket as the log storage bucket. If you select another bucket, it must belong to the same account and region as the source bucket.

    After a log storage bucket is specified, OBS grants the log delivery user group the required write and ACL read permissions for that bucket.

    Log File Name Prefix

    The prefix of each log file name. By default, OBS assigns the bucket-name-log/ prefix. This prefix represents a folder (for storing log files) in the bucket's root directory.

    Each log file follows this naming format:

    <log-file-name-prefix>YYYY-mm-DD-HH-MM-SS-<UniqueString>

    • <log-file-name-prefix> is the log file name prefix you specify here.
      • If <log-file-name-prefix> ends with a slash (/), the log files are stored in a folder named after the prefix (without the trailing slash) in the target bucket. Each log file is named YYYY-mm-DD-HH-MM-SS-<UniqueString>. Example: 2025-06-03-07-18-11-WKK0T9O74VAWMHB7
      • If <log-file-name-prefix> does not end with a slash /, the log files are stored in the root directory of the target bucket. Each log file is named <log-file-name-prefix>YYYY-mm-DD-HH-MM-SS-<UniqueString>. Example: example-bucket-a-log2025-06-03-07-18-11-WKK0T9O74VAWMHB7
    • YYYY-mm-DD-HH-MM-SS indicates when the log file was generated. The fields in it represent the year, month, day, hour, and minute, respectively.
    • <UniqueString> indicates a string assigned by OBS.

    IAM Agency

    An agency is required to grant OBS the permissions needed to upload log files to the log storage bucket.

    • By default, the agency only needs the upload permission (obs:object:PutObject) for the log storage bucket.
    • If the log storage bucket has server-side encryption enabled, the agency also requires the KMS Administrator permission for the region where the bucket is located.

    You can choose an existing IAM agency from the drop-down list or click Create Agency to create one.

    For details about creating an agency, see Creating an Agency for Uploading Logs.

    Log Grouping (Optional)

    Specify the frequency for grouping bucket logs.

    You can leave this parameter blank or select Do not configure, Hourly, or Daily:

    • If you leave this parameter blank or select Do not configure, the system stores all generated bucket logs in a single folder.
    • If you select Hourly, the system automatically stores bucket logs generated each hour in a separate folder.
    • If you select Daily, the system automatically stores bucket logs generated each day in a separate folder.

  6. Click OK.

    After log storage is configured for a bucket, its operation logs will appear in the log storage bucket in about 15 minutes.

Using APIs

Configuring Logging for a Bucket

Using SDKs

Java

Python

C

Go

BrowserJS

.NET

Android

iOS

PHP

Node.js

Verifying the Log Storage Configuration of a Bucket

After configuring Log Storage for a bucket, you can use OBS Console, APIs, SDKs, or obsutil to verify the configuration. You can check whether OBS has generated log files and whether you have access to them. You cannot use OBS Browser+ to do so.

Using OBS Console

  1. In the navigation pane of OBS Console, choose Buckets.
  2. In the bucket list of OBS Console, click the log storage bucket to go to the Objects page.
  3. Check for existing log files.

    Check whether any log files or the folder derived from the log file name prefix appear in the object list, based on the configured prefix and log file naming rules.

    Figure 2 Checking for the log folder or log files

  4. Verify that you can access the log files.

    1. In the object list or in the log folder, click the name of a log file to open its Basic Information page.
    2. Click next to the link to copy the log file link.
    3. Open this link in a browser.

Using APIs

  1. Check for existing log files.

    List all objects in the bucket. Then, check whether any log files appear in the results based on the configured file name prefix and the log file naming rules.

  2. Download log files.

    Download log files.

Using SDKs

  1. Check for existing log files.

    Use any of the following SDKs to list all objects in the bucket. Then, check whether any log files appear in the results based on the configured file name prefix and log file naming rules.

    Java

    Python

    C

    Go

    BrowserJS

    .NET

    Android

    iOS

    PHP

    Node.js
  2. Download log files.

    Use any of the following SDKs to download log files.

    Java

    Python

    C

    Go

    BrowserJS

    .NET

    Android

    iOS

    PHP

    Node.js

Using the CLI Tool - obsutil

  1. Check for existing log files.

    List all objects in the bucket. Then, check whether any log files appear in the results based on the configured file name prefix and the log file naming rules.

  2. Download log files.

    Download log files.

Disabling Log Storage for a Bucket

Uploading and storing bucket logs incurs costs for PUT requests and storage. If you no longer need to record logs, disable logging for the bucket. After logging is disabled, OBS stops generating new logs, but any existing logs in the log storage bucket are retained.

You can use OBS Console to disable log storage for a bucket. You cannot use APIs, SDKs, OBS Browser+, or obsutil to do so.

Using OBS Console

  1. In the navigation pane of OBS Console, choose Buckets.
  2. In the bucket list, click the desired bucket. The Objects page is displayed.
  3. In the navigation pane, choose Overview.
  4. In the Basic Configurations area, click Log Storage. The Log Storage dialog box is displayed.
  5. Select Disable and then click OK.

References

If you are using the old IAM console, see Creating an Agency for Uploading Logs. If you are using the new IAM console, see Creating a Trust Agency for Uploading Logs.

Creating an Agency for Uploading Logs

  1. In the Log Storage dialog box, click Create Agency. The Create Agency dialog box is displayed on the right.
  2. Enter an agency name. The agency name cannot be left blank.
  3. (Optional) Create a custom policy that grants OBS permissions to the agency. If a suitable policy already exists, skip this step.

    1. In the navigation pane of the IAM console, choose Permissions > Policies/Roles.
    2. On the Policies/Roles page, click Create Custom Policy in the upper right corner.
    3. On the Create Custom Policy page, configure the parameters as described below. Keep the default settings for other parameters.
      Figure 3 Configuring a custom policy
      • Policy Name: Enter a name that is easy to remember.
      • Select service: Select Object Storage Service (OBS).
      • Actions: Select obs:object:PutObject.
      • Resources: Select Specific.

        object: Select Specify resource path. The resource path format is OBS:*:*:object:bucket-name/object-name.

        Replace bucket-name with the name of the log storage bucket. For example, OBS:*:*:object:piccomp/* indicates all objects in the log storage bucket piccomp.

    4. Click OK. If the created custom policy appears in the list, it was created successfully.

  4. Grant related permissions to the agency.

    Select Custom policy from the first drop-down list under Authorization. In the custom policy list, select the policy created in 3.

    If Replicate KMS encrypted objects is selected, the agency also needs the KMS CMKFullAccess permission for the regions where the source and destination buckets are located.

  5. Click OK.

    The agency drop-down list is automatically populated with the newly created agency. To view agency authorization details, click Check authorization details in the agency drop-down list.

  6. (Optional) If the log storage bucket has server-side encryption enabled, add the KMS Administrator permission for the bucket's region to the agency.

    1. In the navigation pane of the IAM console, choose Agencies.
    2. Click Authorize in the Operation column of the agency created in 1.
    3. On the Select Policy/Role page, search for and select KMS Administrator. Then, click Next.
    4. Select Region-specific projects for Scope, and select the projects in the region where the log storage bucket resides.
    5. Click OK.

Creating a Trust Agency for Uploading Logs

  1. In the Log Storage dialog box, click Create Agency. The Create Agency dialog box is displayed on the right.
  2. Enter an agency name.
  3. Authorize the agency. For details, see Creating an Agency for Uploading Logs.
  4. Go back to the Agencies page on the new IAM console.
  5. Search for the newly created agency and click Modify in the Operation column.
  6. Click the Trust Policy tab and then Edit Trust Policy. The trust policy is as follows: 

    {
	"Version": "5.0",
	"Statement": [
		{
			"Action": [
				"sts:agencies:assume",
				"sts::tagSession"
			],
			"Effect": "Allow",
			"Principal": {
				"Service": [
					"service.OBS"
				]
			}
		}
	]
}

  7. Click OK to save the policy.

Are Interrupted Requests Recorded in OBS Bucket Logs?

OBS does not record interrupted requests. If you initiate a request through an API or SDK, check the returned value to identify the cause of the interruption.

Why Cannot I Find Request Records in the OBS Bucket Logs?

Possible causes include:

  • CDN caching: If a CDN acceleration domain is configured and the requested data is cached at a CDN PoP, the PoP returns the data directly to the client. The request does not reach OBS, so no OBS log is generated. To view these requests, download CDN logs. For details, see Log Management.
  • Client-side interruption: If the request is interrupted before reaching OBS due to client network issues or other reasons, OBS cannot record it. If you initiate a request through an API or SDK, check the returned value to identify the cause of the interruption.
  • Log storage failures: Network or configuration issues may prevent logs from being written to the OBS bucket.
  • Incorrect bucket queried: For example, you have configured bucket A to store logs, but you are querying request records in bucket B.

Are OBS Logs Periodically Deleted?

OBS does not periodically delete log files stored in OBS buckets. To periodically delete OBS log files, configure a lifecycle rule to remove them. For details, see Using Lifecycle Rules to Delete or Transition Objects.

Parent Topic: Using Logging to Record OBS Logs