Configuring Bucket Log Analysis

This section describes how to configure log analysis and how to use this function to view logs.

Log analysis is available only in certain regions (for example, CN East 2). Refer to the console for the actual support status.

Important Notes

There is a delay of about 3 minutes. That is, request logs will appear on the Log Analysis page of the console about 3 minutes after requests are sent.

Constraints

A single bucket can be associated with only one log stream within a single log group. The OBS bucket, log group, and log stream must be in the same region.
The bucket creator and log stream creator must belong to the same account.
Dedicated OBS is not supported.

Permissions Configuration

The following permissions are required for using log analysis.

Action	Dependent Permission	Description	Authorization Method
Create a log group	lts:logGroup:createLogGroup	Required to create a new log group. Not required if an existing log group is used.	Granting Permissions Using IAM
Create a log stream	lts:logStream:createLogStream	Required to create a new log stream. Not required if an existing log stream is used.
List log streams	lts:logStream:listLogStream	Required to bind a log stream to a bucket.
Configure bucket log analysis	obs:bucket:PutBucketRealTimeLog	Required to enable log analysis and bind a log group and log stream to a bucket.	Granting permissions using IAM or bucket policies
Obtain bucket log analysis configuration	obs:bucket:GetBucketRealTimeLog	Required to obtain log analysis configuration of a bucket.
Delete bucket log analysis configuration	obs:bucket:deleteBucketRealTimeLog	Required to delete log analysis configuration of a bucket.

Log Analysis Fields

The following fields can be recorded and analyzed using log analysis.

Category	Field Name	Field Type	Example	Field Description
Time	time	string	10/Apr/2026:10:23:29	Access time. The format is dd/MMM/yyyy:HH:mm:ss.
Time	response_time (same as server_cost_time)	long	7	Total time spent by the server to process a request, in ms.
Protocol	http_type	string	https	Protocol type (http or https).
Protocol	ssl_protocol	string	TLSv1.2	SSL/TLS version (for example, TLSv1.2).
Request	http_method	string	GET	HTTP request method, such as GET, PUT, or POST.
	request_uri	string	/bucket?location	Complete request URI including parameters.
	referer	string	http://archives/test.html	HTTP Referer, used for hotlink protection.
	request_id	string	281599BACAD9376ECE141B842Bxxxxxx	Unique request ID.
	client_ip	string	10.6.220.80	Requester IP address.
	host	string	test.cn-north-4.obs.myhuaweicloud.com	Domain name or host name requested by a client.
	user_agent	string	obs-console	Client agent information.
	http_status	long	404	HTTP response status code, such as 200, 404, or 403.
	error_code	string	AccessDenied	Error response code defined by OBS.
	request_length	long	486	Total length of the request message, including the header and response body.
	response_body_length	long	351	Size of the response body (including only the response body), in bytes.
	content_length_in	long	1024	Length of uploaded data (including only the response body), in bytes.
	content_length_out	long	351	Length of downloaded data (including only the response body), in bytes.
	http_range	string	bytes=0-41	Requested range.
Identity	requester_id	string	787f2f92b20943998a4fe2ab75xxxxxx	Account ID of the request initiator.
	owner_id	string	1708423310948000	Account ID of the resource owner.
	principle_urn	string	APPIDxxxxxxx	User identity information. The format varies depending on the user type: IAM user: iam::<domain_id>:user:<username> Agency: sts::<domain_id>:assumed-agency:<agency-name>/<agency-session-name> Federated user: sts::<domain_id>:external-user:<idp_id>/<user-session-name> Cloud service: None Field descriptions in identity information: domain_id: Account ID username: IAM username agency-name: Agency name agency-session-name: agency session name idp_id: ID of the identity provider (IdP) in federated access scenarios user-session-name: session name in federated access scenarios
	source_identity	string	IDxxxxxx	The source_identity field when temporary security credentials are obtained. The value consists of 2–64 bytes. This field is supported only in new IAM versions.
	access_key	string	UDSIAMSTUBTESTXXXXXX	AK used for access.
Resource	bucket	string	test-bucket	Bucket name.
	bucket_location	string	cn-north-4	ID of the region where the bucket is located.
	object	string	obj1	Object name.
	object_size	string	123	Object size, in bytes.
	bucket_storage_type	string	standard	Storage class. OBS supports the following storage classes: STANDARD: Standard storage WARM: Infrequent Access storage COLD: Archive storage DEEP_ARCHIVE: Deep Archive storage CAUTION: Data stored in the Deep Archive storage class is not transferred across borders.
	vpc_id	string	77ca5f05-1eff-4f79-8c01-093e75xxxxxx	VPC ID
	vpc_addr	string	100.8x.0.1xx	IP address within the VPC.
	enterprise_project_id	string	bdef410c-f293-41e5-b976-7278e8xxxxxx	Enterprise project ID. The value contains 36 bytes, including letters (a to z) and digits (0 to 9).
Other	logging	string	TRUE	Whether log storage is enabled. TRUE: enabled FALSE: disabled
	operation	string	GET.OBJECT	API operation type (for example, GET.OBJECT or PUT.OBJECT)
	sign_type	string	V2	Signature type (V2 or V4 signature).

How to Use

Configuring Log Analysis on the Console

In the navigation pane of OBS Console, choose Buckets.
In the bucket list, click the desired bucket. The Objects page is displayed.
In the navigation pane, choose Log Management > Log Analysis. The Log Analysis page is displayed.
Click Configure Log Ingestion in the upper right corner of the page.

In the Configure Log Ingestion to LTS dialog box, set related parameters.

Figure 1 Configuring log ingestion to LTS
Click to enlarge

**Table 1** Parameters for log ingestion to LTS
Parameter	Description
Ingest Logs to LTS	Generated bucket logs will be ingested into Log Tank Service (LTS) for management, keyword searches, visualized log analysis, alerting, and log dumping. Once this function is enabled, the system ingests generated bucket logs into LTS for log search and analysis.
Log Types	The cloud service integrated with LTS. The OBS access logs option is selected by default and cannot be modified. To cancel this selection, deselect the Ingest Logs to LTS check box above.
Project	Select the project to which the log group and log stream belong. A project represents information about the region where the system is located, including the project ID, project number, and region. Select the project in the region where the bucket is located. To view the project list, see API Credentials.
Log Group	A log group is the basic unit for LTS to manage logs. It comprises log streams and categorizes them. A log group does not store any log data. It only helps with log stream management. Select the log group you created in LTS. If no log group is available, click Create Log Group to create one. For details, see Creating a Log Group.
Log Stream	LTS manages logs by log stream. After logs are collected, they are stored in different log streams based on their types for further management. Each log stream belongs to exactly one log group, while a log group can contain multiple log streams. Select the log stream you created in a log group. If no log stream is available, click Create Log Stream to create one. For details, see Creating a Log Stream.

Click OK.

After log analysis is configured, you can view the bucket's operation logs in the lower part of the Log Analysis page about 10 minutes later.

Viewing Bucket Access Logs on the Console

In the navigation pane of OBS Console, choose Buckets.
In the bucket list, click the desired bucket. The Objects page is displayed.
In the navigation pane, choose Log Management > Log Analysis. The Log Analysis page is displayed.
View the bucket access logs in the Log Details area.

Figure 2 Viewing access logs