Configuring Logging for a Bucket

1. In the Logging dialog box, click Create Agency to jump to the Agencies page on the Identity and Access Management console.
2. Click Create Agency. On the displayed page, configure the parameters related to the agency for uploading logs. Keep the default settings for other parameters.

   Table 2 Parameters

   Parameter	Description
   Agency Name	The name of the agency to be created The agency name cannot be left blank.
   Agency Type	Selecting Cloud service grants permissions to an account or cloud service to operate resources within the account. In this example, you need to create an agency for uploading logs, so select Cloud service here.
   Cloud Service	Select the cloud service to which you want to grant permissions to operate resources in your account. This parameter is mandatory when you set Agency Type to Cloud service. Select Object Storage Service (OBS) for Cloud Service.

3. Click OK. In the Agency Created dialog box that is displayed, click Cancel. If the newly created agency appears in the agency list, the agency is created successfully.
4. Create a custom policy that grants OBS permissions to the agency. If a suitable policy already exists, skip this step.
   1. In the navigation pane of the IAM console, choose Permissions > Policies/Roles.
   2. On the Policies/Roles page, click Create Custom Policy in the upper right corner.
   3. On the Create Custom Policy page, configure the parameters as described below. Keep the default settings for other parameters.
      Figure 3 Configuring a custom policy
      
      • Policy Name: Enter a name that is easy to remember.
      • Select service: Select Object Storage Service (OBS).
      • Actions: Select obs:object:PutObject.
      • Resources: Select Specific.

        object: Select Specify resource path. The resource path format is OBS:*:*:object:bucket-name/object-name.

        Replace bucket-name with the name of the log storage bucket. For example, OBS:*:*:object:piccomp/* indicates all objects in the log storage bucket piccomp.

   4. Click OK. If the created custom policy appears in the list, it was created successfully.

5. Apply the created custom policy to the agency.
   1. In the navigation pane of the IAM console, choose Agencies.
   2. Click Authorize in the Operation column of the agency created in 2.
   3. On the Select Policy/Role page, select the custom policy created in 4 and click Next.
   4. On the Select Scope page, select All resources and click OK.
   5. In the Information dialog box that is displayed, click OK.
   6. On the Finish page, click Finish.

6. (Optional) If the log storage bucket has server-side encryption enabled, add the KMS Administrator permission for the bucket's region to the agency.
   1. In the navigation pane of the IAM console, choose Agencies.
   2. Click Authorize in the Operation column of the agency created in 2.
   3. On the Select Policy/Role page, search for and select KMS Administrator. Then, click Next.
   4. Select Region-specific projects for Scope, and select the projects in the region where the log storage bucket resides.
   5. Click OK.

1. In the Logging dialog box, click View Agencies to go to the Agencies page on the IAM console.
2. Click Go to New Console in the upper right corner. In the navigation pane of the new IAM console, choose Agencies.
3. Click Create Trust Agency.
4. Enter an agency name.
5. Set Agency Type to Cloud service.
6. Select Object Storage Service for Cloud Service.
7. Choose a maximum session duration.
8. Click OK.
9. Click Authorize. For details about the authorization, see Creating an Agency for Uploading Logs.
10. Go back to the Agencies page on the new IAM console.
11. Search for the newly created agency and click Modify in the Operation column.
12. Click the Trust Policy tab and then Edit Trust Policy. The trust policy is as follows:

    {
    	"Version": "5.0",
    	"Statement": [
    		{
    			"Action": [
    				"sts:agencies:assume",
    				"sts::tagSession"
    			],
    			"Effect": "Allow",
    			"Principal": {
    				"Service": [
    					"service.OBS"
    				]
    			}
    		}
    	]
    }

13. Click OK to save the policy.

OBS does not record interrupted requests. If you initiate a request through an API or SDK, check the returned value to identify the cause of the interruption.

Possible causes include:

• CDN caching: If a CDN acceleration domain is configured and the requested data is cached at a CDN PoP, the PoP returns the data directly to the client. The request does not reach OBS, so no OBS log is generated. To view these requests, download CDN logs. For details, see Log Management.
• Client-side interruption: If the request is interrupted before reaching OBS due to client network issues or other reasons, OBS cannot record it. If you initiate a request through an API or SDK, check the returned value to identify the cause of the interruption.
• Log storage failures: Network or configuration issues may prevent logs from being written to the OBS bucket.
• Incorrect bucket queried: For example, you have configured bucket A to store logs, but you are querying request records in bucket B.

OBS does not periodically delete log files stored in OBS buckets. To periodically delete OBS log files, configure a lifecycle rule to remove them. For details, see Using Lifecycle Rules to Delete or Transition Objects.