Compute
Elastic Cloud Server
Huawei Cloud Flexus
Bare Metal Server
Auto Scaling
Image Management Service
Dedicated Host
FunctionGraph
Cloud Phone Host
Huawei Cloud EulerOS
Networking
Virtual Private Cloud
Elastic IP
Elastic Load Balance
NAT Gateway
Direct Connect
Virtual Private Network
VPC Endpoint
Cloud Connect
Enterprise Router
Enterprise Switch
Global Accelerator
Management & Governance
Cloud Eye
Identity and Access Management
Cloud Trace Service
Resource Formation Service
Tag Management Service
Log Tank Service
Config
OneAccess
Resource Access Manager
Simple Message Notification
Application Performance Management
Application Operations Management
Organizations
Optimization Advisor
IAM Identity Center
Cloud Operations Center
Resource Governance Center
Migration
Server Migration Service
Object Storage Migration Service
Cloud Data Migration
Migration Center
Cloud Ecosystem
KooGallery
Partner Center
User Support
My Account
Billing Center
Cost Center
Resource Center
Enterprise Management
Service Tickets
HUAWEI CLOUD (International) FAQs
ICP Filing
Support Plans
My Credentials
Customer Operation Capabilities
Partner Support Plans
Professional Services
Analytics
MapReduce Service
Data Lake Insight
CloudTable Service
Cloud Search Service
Data Lake Visualization
Data Ingestion Service
GaussDB(DWS)
DataArts Studio
Data Lake Factory
DataArts Lake Formation
IoT
IoT Device Access
Others
Product Pricing Details
System Permissions
Console Quick Start
Common FAQs
Instructions for Associating with a HUAWEI CLOUD Partner
Message Center
Security & Compliance
Security Technologies and Applications
Web Application Firewall
Host Security Service
Cloud Firewall
SecMaster
Anti-DDoS Service
Data Encryption Workshop
Database Security Service
Cloud Bastion Host
Data Security Center
Cloud Certificate Manager
Edge Security
Situation Awareness
Managed Threat Detection
Blockchain
Blockchain Service
Web3 Node Engine Service
Media Services
Media Processing Center
Video On Demand
Live
SparkRTC
MetaStudio
Storage
Object Storage Service
Elastic Volume Service
Cloud Backup and Recovery
Storage Disaster Recovery Service
Scalable File Service Turbo
Scalable File Service
Volume Backup Service
Cloud Server Backup Service
Data Express Service
Dedicated Distributed Storage Service
Containers
Cloud Container Engine
SoftWare Repository for Container
Application Service Mesh
Ubiquitous Cloud Native Service
Cloud Container Instance
Databases
Relational Database Service
Document Database Service
Data Admin Service
Data Replication Service
GeminiDB
GaussDB
Distributed Database Middleware
Database and Application Migration UGO
TaurusDB
Middleware
Distributed Cache Service
API Gateway
Distributed Message Service for Kafka
Distributed Message Service for RabbitMQ
Distributed Message Service for RocketMQ
Cloud Service Engine
Multi-Site High Availability Service
EventGrid
Dedicated Cloud
Dedicated Computing Cluster
Business Applications
Workspace
ROMA Connect
Message & SMS
Domain Name Service
Edge Data Center Management
Meeting
AI
Face Recognition Service
Graph Engine Service
Content Moderation
Image Recognition
Optical Character Recognition
ModelArts
ImageSearch
Conversational Bot Service
Speech Interaction Service
Huawei HiLens
Video Intelligent Analysis Service
Developer Tools
SDK Developer Guide
API Request Signing Guide
Terraform
Koo Command Line Interface
Content Delivery & Edge Computing
Content Delivery Network
Intelligent EdgeFabric
CloudPond
Intelligent EdgeCloud
Solutions
SAP Cloud
High Performance Computing
Developer Services
ServiceStage
CodeArts
CodeArts PerfTest
CodeArts Req
CodeArts Pipeline
CodeArts Build
CodeArts Deploy
CodeArts Artifact
CodeArts TestPlan
CodeArts Check
CodeArts Repo
Cloud Application Engine
MacroVerse aPaaS
KooMessage
KooPhone
KooDrive
On this page

Logging

Updated on 2024-08-27 GMT+08:00

Scenarios

You can enable logging to facilitate analysis or audit as required. Access logs enable a bucket owner to analyze the property, type, or trend of requests to the bucket in depth. With logging enabled, OBS automatically logs access requests for the bucket, and writes the generated log files to the specified bucket.

You need to specify a bucket for storing log files when enabling logging for a bucket. Log files can be stored in any bucket in the region where the logged bucket resides, including the logged bucket itself. To better manage logs, you are advised to store log files in a bucket other than the logged bucket. If log files are stored in the logged bucket, OBS creates additional logs for writing log files to the bucket, which takes up extra storage space that will increase your costs and makes it more difficult for you to locate required logs.

NOTICE:
  • Uploading bucket logs to the target bucket incurs billable PUT requests. For details about the pricing, see Requests.
  • After logging is configured for a bucket, you can view the bucket's operation logs in the log storage bucket in approximately 15 minutes.

OBS can record bucket access requests in logs for request analysis and log audit.

Logs occupy some OBS storage space rented by users, incurring extra fees. For this reason, the default policy is that OBS does not collect bucket access logs.

The log files are generated and uploaded by OBS to the bucket where the logs are stored. Therefore, OBS requires the authorization to upload the generated log files. Therefore, before configuring logging for a bucket, you need to create an IAM agency for OBS and add this IAM agency when configuring logging for the bucket. By default, when configuring permissions for an IAM agency, you only need to grant the IAM agency the permission to upload log files to the bucket where log files are stored. In the following example, mybucketlogs is the name of the bucket for storing log files. If the default encryption function is enabled for the log storing bucket, the IAM agency also requires the KMS Administrator permissions in the region where the log storing bucket resides.

{
    "Version": "1.1",
    "Statement": [
        {
            "Action": [
                "obs:object:PutObject"
            ],
            "Resource": [
                "OBS:*:*:object:mybucketlogs/*"
            ],
            "Effect": "Allow"
        }
    ]
}

The following shows a sample access log record:

787f2f92b20943998a4fe2ab75eb09b8 bucket [13/Aug/2015:01:43:42 +0000] xx.xx.xx.xx 
787f2f92b20943998a4fe2ab75eb09b8 281599BACAD9376ECE141B842B94535B  REST.GET.BUCKET.LOCATION 
- "GET /bucket?location HTTP/1.1" 200 - 211 - 6 6 "-"  "HttpClient" - - 

The access log of each bucket contains the following information.

Table 1 Format of bucket access logs

Name

Example

Description

BucketOwner

787f2f92b20943998a4fe2ab75eb09b8

Account ID of the bucket owner

Bucket

bucket

Name of the bucket

Time

[13/Aug/2015:01:43:42 +0000]

Timestamp of the request (UTC)

Remote IP

xx.xx.xx.xx

Request IP address

Requester

787f2f92b20943998a4fe2ab75eb09b8

Requester ID

  • When an account initiates a request, this parameter value is the account ID. When an IAM user initiates a request, this parameter value is the ID of the account where the IAM user belongs.
  • When a request is initiated by an anonymous user, the value of this parameter is Anonymous.

RequestID

281599BACAD9376ECE141B842B94535B

Request ID

Operation

REST.GET.BUCKET.LOCATION

Name of the operation

See Table 2 for common operations and their description.

Key

-

Object name

Request-URI

GET /bucket?location HTTP/1.1

Request URI

HTTPStatus

200

Response code

ErrorCode

-

Error code

BytesSent

211

Size of the HTTP response, expressed in bytes

ObjectSize

-

Object size (bytes)

NOTE:
  • When OBS deletes an object, it does not log the object's size. In the object deletion log, the value of ObjectSize is 0.
  • If error code 4XX is returned, the value of ObjectSize is -, indicating that the specific object size is not displayed.

TotalTime

6

Processing time on the server (ms)

Turn-AroundTime

6

Total time for processing the request (ms)

NOTE:

This parameter can also be written as TotalTime.

Referer

-

Referer header of the request

User-Agent

HttpClient

User-Agent header of the request

VersionID

-

Version ID contained in a request

STSLogUrn

-

Federated authentication and agency information

StorageClass

STANDARD_IA

Current storage class of the object

TargetStorageClass

GLACIER

Storage class that the object will be transited to

DentryName

12456/file.txt

  • For a parallel file system, this field indicates an internal identifier of a file or directory. Its value consists of a parent directory inode number and a file or directory name.
  • For a bucket, the value of this field is -.

IAMUserID

8f3b8c53d29244a780084f2b8c106c32

ID of an IAM user.

When a request is initiated by an anonymous user, Anonymous is logged.

Table 2 Common operations

Operation

Description

Operation

Description

REST.GET.SERVICE

Lists buckets.

REST.GET.ENCRYPTION

Obtains the bucket encryption configuration.

REST.PUT.BUCKET

Creates a bucket.

REST.DELETE.ENCRYPTION

Deletes the bucket encryption configuration.

REST.HEAD.BUCKET

Views the bucket information.

REST.PUT.OTM_DIRECT_COLD_ACCESS

Configures direct reading for Archive objects in a bucket.

REST.GET.BUCKETVERSIONS

Lists objects in a bucket.

REST.GET.OTM_DIRECT_COLD_ACCESS

Obtains the direct reading configuration of a bucket.

REST.GET.BUCKET

Obtains the bucket metadata.

REST.DELETE.OTM_DIRECT_COLD_ACCESS

Deletes the direct reading configuration of a bucket.

REST.GET.BUCKET.LOCATION

Obtains the bucket location.

REST.PUT.BUCKET.WEBSITE

Configures static website hosting for a bucket.

REST.DELETE.BUCKET

Deletes a bucket.

REST.GET.BUCKET.WEBSITE

Obtains the static website hosting configuration of a bucket.

REST.PUT.POLICY

Configures a bucket policy.

REST.DEL.BUCKET.WEBSITE

Deletes the static website hosting configuration of a bucket.

REST.GET.POLICY

Obtains a bucket policy.

REST.PUT.BUCKET.CORS

Configures CORS for a bucket.

REST.DELETE.POLICY

Deletes a bucket policy.

REST.GET.BUCKET.CORS

Obtains the CORS configuration of a bucket.

REST.PUT.ACL

Configures an ACL for a bucket or an object.

REST.DEL.BUCKET.CORS

Deletes the CORS configuration of a bucket.

REST.GET.ACL

Obtains a bucket ACL or an object ACL.

REST.OPTIONS.BUCKET

Checks bucket OPTIONS.

REST.PUT.LOGGING_STATUS

Configures logging for a bucket.

REST.OPTIONS.OBJECT

Checks object OPTIONS.

REST.GET.LOGGING_STATUS

Obtains the bucket logging configuration.

REST.PUT.OBJECT

Uploads an object with PUT.

REST.PUT.BUCKET.LIFECYCLE

Configures a bucket lifecycle rule.

REST.POST.OBJECT

Uploads an object with POST.

REST.GET.LIFECYCLE

Obtains the lifecycle configuration of a bucket.

REST.COPY.OBJECT

Copies an object.

REST.DEL.LIFECYCLE

Deletes the lifecycle configuration of a bucket.

REST.GET.OBJECT

Obtains the object content.

REST.PUT.VERSIONING

Configures versioning for a bucket.

REST.HEAD.OBJECT

Obtains the object metadata.

REST.GET.VERSIONING

Obtains the bucket versioning status.

REST.DELETE.OBJECT

Deletes an object.

REST.GET.BUCKET.STORAGE.POLICY

Configures the default storage class for a bucket.

REST.TRANSITION.STORAGECLASS.OBJECT

Changes the storage class of an object.

REST.PUT.BUCKET.STORAGE.POLICY

Obtains the default storage class of a bucket.

OP_MULTIPLE_DELETEOBJECT

Batch deletes objects.

REST.PUT.REPLICATION

Configures cross-region replication for a bucket.

REST.POST.RESTORE

Restores an Archive object.

REST.DELETE.REPLICATION

Deletes the cross-region replication configuration of a bucket.

REST.APPEND.OBJECT

Appends data to an object.

REST.GET.REPLICATION

Obtains the cross-region replication configuration of a bucket.

REST.MODIFY.OBJECT.META

Modifies object metadata.

REST.PUT.TAGGING

Configures tags for a bucket.

REST.TRUNCATE.OBJECT

Truncates an object.

REST.GET.TAGGING

Obtains bucket tags.

REST.RENAME.OBJECT

Renames an object.

REST.DEL.TAGGING

Deletes bucket tags.

REST.GET.UPLOADS

Lists the initiated multipart uploads in a bucket.

REST.PUT.BUCKET_QUOTA

Configures a storage quota for a bucket.

REST.POST.UPLOADS

Initiates a multipart upload.

REST.GET.BUCKET.QUOTA

Queries the bucket storage quota.

REST.PUT.PART

Uploads a part.

REST.GET.BUCKET.STORAGEINFO

Obtains the information about the used space in a bucket.

REST.COPY.PART

Copies a part.

REST.PUT.BUCKET.INVENTORY

Configures inventories for a bucket.

REST.GET.UPLOAD

Lists uploaded parts.

REST.GET.BUCKET.INVENTORY

Obtains or lists bucket inventories.

REST.POST.UPLOAD

Assembles parts.

REST.DELETE.BUCKET.INVENTORY

Deletes bucket inventories.

REST.DELETE.UPLOAD

Cancels a multipart upload.

REST.PUT.CUSTOMDOMAIN

Configures a custom domain name for a bucket.

REST.CLEAR.EXPIRE.UPLOAD

Deletes expired segments.

REST.GET.CUSTOMDOMAIN

Obtains the custom domain name of a bucket.

REST.DELETE.CUSTOMDOMAIN

Deletes a custom domain name of a bucket.

REST.PUT.ENCRYPTION

Configures encryption for a bucket.

-

-

How to Use

You can configure logging on OBS Console, using APIs, or using SDKs.

Tool

Reference

OBS Console

Configuring Access Logging for a Bucket

SDKs

OBS supports software development kits (SDKs) in multiple languages. For details, see the corresponding developer guide on the SDK Overview page.

API

Configuring Logging for a Bucket

We use cookies to improve our site and your experience. By continuing to browse our site you accept our cookie policy. Find out more

Feedback

Feedback

Feedback

0/500

Selected Content

Submit selected content with the feedback