Updated on 2024-08-27 GMT+08:00

Logging

Scenarios

You can enable logging to facilitate analysis or audit as required. Access logs enable a bucket owner to analyze the property, type, or trend of requests to the bucket in depth. With logging enabled, OBS automatically logs access requests for the bucket, and writes the generated log files to the specified bucket.

You need to specify a bucket for storing log files when enabling logging for a bucket. Log files can be stored in any bucket in the region where the logged bucket resides, including the logged bucket itself. To better manage logs, you are advised to store log files in a bucket other than the logged bucket. If log files are stored in the logged bucket, OBS creates additional logs for writing log files to the bucket, which takes up extra storage space that will increase your costs and makes it more difficult for you to locate required logs.

  • Uploading bucket logs to the target bucket incurs billable PUT requests. For details about the pricing, see Requests.
  • After logging is configured for a bucket, you can view the bucket's operation logs in the log storage bucket in approximately 15 minutes.

OBS can record bucket access requests in logs for request analysis and log audit.

Logs occupy some OBS storage space rented by users, incurring extra fees. For this reason, the default policy is that OBS does not collect bucket access logs.

The log files are generated and uploaded by OBS to the bucket where the logs are stored. Therefore, OBS requires the authorization to upload the generated log files. Therefore, before configuring logging for a bucket, you need to create an IAM agency for OBS and add this IAM agency when configuring logging for the bucket. By default, when configuring permissions for an IAM agency, you only need to grant the IAM agency the permission to upload log files to the bucket where log files are stored. In the following example, mybucketlogs is the name of the bucket for storing log files. If the default encryption function is enabled for the log storing bucket, the IAM agency also requires the KMS Administrator permissions in the region where the log storing bucket resides.

{
    "Version": "1.1",
    "Statement": [
        {
            "Action": [
                "obs:object:PutObject"
            ],
            "Resource": [
                "OBS:*:*:object:mybucketlogs/*"
            ],
            "Effect": "Allow"
        }
    ]
}

The following shows a sample access log record:

787f2f92b20943998a4fe2ab75eb09b8 bucket [13/Aug/2015:01:43:42 +0000] xx.xx.xx.xx 
787f2f92b20943998a4fe2ab75eb09b8 281599BACAD9376ECE141B842B94535B  REST.GET.BUCKET.LOCATION 
- "GET /bucket?location HTTP/1.1" 200 - 211 - 6 6 "-"  "HttpClient" - - 

The access log of each bucket contains the following information.

Table 1 Format of bucket access logs

Name

Example

Description

BucketOwner

787f2f92b20943998a4fe2ab75eb09b8

Account ID of the bucket owner

Bucket

bucket

Name of the bucket

Time

[13/Aug/2015:01:43:42 +0000]

Timestamp of the request (UTC)

Remote IP

xx.xx.xx.xx

Request IP address

Requester

787f2f92b20943998a4fe2ab75eb09b8

Requester ID

  • When an account initiates a request, this parameter value is the account ID. When an IAM user initiates a request, this parameter value is the ID of the account where the IAM user belongs.
  • When a request is initiated by an anonymous user, the value of this parameter is Anonymous.

RequestID

281599BACAD9376ECE141B842B94535B

Request ID

Operation

REST.GET.BUCKET.LOCATION

Name of the operation

See Table 2 for common operations and their description.

Key

-

Object name

Request-URI

GET /bucket?location HTTP/1.1

Request URI

HTTPStatus

200

Response code

ErrorCode

-

Error code

BytesSent

211

Size of the HTTP response, expressed in bytes

ObjectSize

-

Object size (bytes)

NOTE:
  • When OBS deletes an object, it does not log the object's size. In the object deletion log, the value of ObjectSize is 0.
  • If error code 4XX is returned, the value of ObjectSize is -, indicating that the specific object size is not displayed.

TotalTime

6

Processing time on the server (ms)

Turn-AroundTime

6

Total time for processing the request (ms)

NOTE:

This parameter can also be written as TotalTime.

Referer

-

Referer header of the request

User-Agent

HttpClient

User-Agent header of the request

VersionID

-

Version ID contained in a request

STSLogUrn

-

Federated authentication and agency information

StorageClass

STANDARD_IA

Current storage class of the object

TargetStorageClass

GLACIER

Storage class that the object will be transited to

DentryName

12456/file.txt

  • For a parallel file system, this field indicates an internal identifier of a file or directory. Its value consists of a parent directory inode number and a file or directory name.
  • For a bucket, the value of this field is -.

IAMUserID

8f3b8c53d29244a780084f2b8c106c32

ID of an IAM user.

When a request is initiated by an anonymous user, Anonymous is logged.

Table 2 Common operations

Operation

Description

Operation

Description

REST.GET.SERVICE

Lists buckets.

REST.GET.ENCRYPTION

Obtains the bucket encryption configuration.

REST.PUT.BUCKET

Creates a bucket.

REST.DELETE.ENCRYPTION

Deletes the bucket encryption configuration.

REST.HEAD.BUCKET

Views the bucket information.

REST.PUT.OTM_DIRECT_COLD_ACCESS

Configures direct reading for Archive objects in a bucket.

REST.GET.BUCKETVERSIONS

Lists objects in a bucket.

REST.GET.OTM_DIRECT_COLD_ACCESS

Obtains the direct reading configuration of a bucket.

REST.GET.BUCKET

Obtains the bucket metadata.

REST.DELETE.OTM_DIRECT_COLD_ACCESS

Deletes the direct reading configuration of a bucket.

REST.GET.BUCKET.LOCATION

Obtains the bucket location.

REST.PUT.BUCKET.WEBSITE

Configures static website hosting for a bucket.

REST.DELETE.BUCKET

Deletes a bucket.

REST.GET.BUCKET.WEBSITE

Obtains the static website hosting configuration of a bucket.

REST.PUT.POLICY

Configures a bucket policy.

REST.DEL.BUCKET.WEBSITE

Deletes the static website hosting configuration of a bucket.

REST.GET.POLICY

Obtains a bucket policy.

REST.PUT.BUCKET.CORS

Configures CORS for a bucket.

REST.DELETE.POLICY

Deletes a bucket policy.

REST.GET.BUCKET.CORS

Obtains the CORS configuration of a bucket.

REST.PUT.ACL

Configures an ACL for a bucket or an object.

REST.DEL.BUCKET.CORS

Deletes the CORS configuration of a bucket.

REST.GET.ACL

Obtains a bucket ACL or an object ACL.

REST.OPTIONS.BUCKET

Checks bucket OPTIONS.

REST.PUT.LOGGING_STATUS

Configures logging for a bucket.

REST.OPTIONS.OBJECT

Checks object OPTIONS.

REST.GET.LOGGING_STATUS

Obtains the bucket logging configuration.

REST.PUT.OBJECT

Uploads an object with PUT.

REST.PUT.BUCKET.LIFECYCLE

Configures a bucket lifecycle rule.

REST.POST.OBJECT

Uploads an object with POST.

REST.GET.LIFECYCLE

Obtains the lifecycle configuration of a bucket.

REST.COPY.OBJECT

Copies an object.

REST.DEL.LIFECYCLE

Deletes the lifecycle configuration of a bucket.

REST.GET.OBJECT

Obtains the object content.

REST.PUT.VERSIONING

Configures versioning for a bucket.

REST.HEAD.OBJECT

Obtains the object metadata.

REST.GET.VERSIONING

Obtains the bucket versioning status.

REST.DELETE.OBJECT

Deletes an object.

REST.GET.BUCKET.STORAGE.POLICY

Configures the default storage class for a bucket.

REST.TRANSITION.STORAGECLASS.OBJECT

Changes the storage class of an object.

REST.PUT.BUCKET.STORAGE.POLICY

Obtains the default storage class of a bucket.

OP_MULTIPLE_DELETEOBJECT

Batch deletes objects.

REST.PUT.REPLICATION

Configures cross-region replication for a bucket.

REST.POST.RESTORE

Restores an Archive object.

REST.DELETE.REPLICATION

Deletes the cross-region replication configuration of a bucket.

REST.APPEND.OBJECT

Appends data to an object.

REST.GET.REPLICATION

Obtains the cross-region replication configuration of a bucket.

REST.MODIFY.OBJECT.META

Modifies object metadata.

REST.PUT.TAGGING

Configures tags for a bucket.

REST.TRUNCATE.OBJECT

Truncates an object.

REST.GET.TAGGING

Obtains bucket tags.

REST.RENAME.OBJECT

Renames an object.

REST.DEL.TAGGING

Deletes bucket tags.

REST.GET.UPLOADS

Lists the initiated multipart uploads in a bucket.

REST.PUT.BUCKET_QUOTA

Configures a storage quota for a bucket.

REST.POST.UPLOADS

Initiates a multipart upload.

REST.GET.BUCKET.QUOTA

Queries the bucket storage quota.

REST.PUT.PART

Uploads a part.

REST.GET.BUCKET.STORAGEINFO

Obtains the information about the used space in a bucket.

REST.COPY.PART

Copies a part.

REST.PUT.BUCKET.INVENTORY

Configures inventories for a bucket.

REST.GET.UPLOAD

Lists uploaded parts.

REST.GET.BUCKET.INVENTORY

Obtains or lists bucket inventories.

REST.POST.UPLOAD

Assembles parts.

REST.DELETE.BUCKET.INVENTORY

Deletes bucket inventories.

REST.DELETE.UPLOAD

Cancels a multipart upload.

REST.PUT.CUSTOMDOMAIN

Configures a custom domain name for a bucket.

REST.CLEAR.EXPIRE.UPLOAD

Deletes expired segments.

REST.GET.CUSTOMDOMAIN

Obtains the custom domain name of a bucket.

REST.DELETE.CUSTOMDOMAIN

Deletes a custom domain name of a bucket.

REST.PUT.ENCRYPTION

Configures encryption for a bucket.

-

-

How to Use

You can configure logging on OBS Console, using APIs, or using SDKs.

Tool

Reference

OBS Console

Configuring Access Logging for a Bucket

SDKs

OBS supports software development kits (SDKs) in multiple languages. For details, see the corresponding developer guide on the SDK Overview page.

API

Configuring Logging for a Bucket