Updated on 2026-08-21 GMT+08:00

Viewing OBS Traces

This section describes how to view or export traces generated in the last seven days on the CTS console and how to view traces that have been transferred to OBS buckets or LTS.

Example CTS Traces

The following uses bucket creation (management trace) and object upload (data trace) as examples to describe the content of trace files stored in CTS, OBS, and LTS. For more examples of CTS traces, see Example Traces.

The trace list only displays OBS management traces (such as bucket creation). To view OBS data traces (such as object upload), you need to create a data tracker, configure the tracker to transfer traces to OBS or LTS, and then view the traces in OBS or LTS. The following shows an example of an OBS bucket creation trace in the trace list.

Creating a bucket

{
  "code": "200",
  "domain_id": "aaaaaaaaaaaaaaaaaa",
  "event_type": "system",
  "project_id": "bbbbbbbbbbbbbbbbbb",
  "read_only": false,
  "resource_name": "test003zcy",
  "resource_type": "bucket",
  "service_type": "OBS",
  "source_ip": "x.x.x.x",
  "trace_id": "cccccccccccccccccccc",
  "trace_name": "createBucket",
  "trace_rating": "normal",
  "trace_type": "Others",
  "tracker_name": "system",
  "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36",
  "user": {
    "access_key_id": "dddddddddddd",
    "account_id": "eeeeeeeeeeeeeeeeee",
    "domain": {
      "id": "ffffffffffffffffff",
      "name": "Test_name"
    },
    "invoked_by": [
      "service.console"
    ],
    "name": "ggggggggggggggggggg/testname",
    "principal_id": "ggggggggggggggggggg:testname",
    "principal_urn": "sts::ggggggggggggggggggg:external-user:ggggggggggggggggggg/testname",
    "session_context": {
      "attributes": {
        "creationDate": "1779956903340",
        "mfa_authenticated": "false"
      },
      "federation_data": {
        "group_Ids": [
          "hhhhhhhhhhhhhhhhhhh",
          "iiiiiiiiiiiiiiiiiiii"
        ],
        "identity_provider": "ggggggggggggggggggg",
        "protocol": "saml"
      }
    },
    "type": "ExternalUser",
    "id": "ggggggggggggggggggg"
  },
  "time": 1779956940605,
  "record_time": 1779956940605
}

If you have configured trace transfer to OBS, you can view traces in OBS buckets.

When traces are transferred to OBS, the user field is serialized into a string, which needs to be deserialized for parsing.

Creating a bucket

[{"code":200,"domain_id":"aaaaaaaaaaaaaaaaaa","event_type":"system","project_id":"bbbbbbbbbbbbbbbbbb","read_only":false,"record_time":1779961459823,"resource_name":"test003zcy","resource_type":"bucket","service_type":"OBS","source_ip":"x.x.x.x","time":1779961459823,"trace_id":"cccccccccccccccccccc","trace_name":"createBucket","trace_rating":"normal","trace_type":"Others","tracker_name":"system","user":"{\"access_key_id\":\"dddddddddddd\",\"account_id\":\"eeeeeeeeeeeeeeeeee\",\"domain\":{\"id\":\"ffffffffffffffffff\",\"name\":\"Test_name\"},\"invoked_by\":[\"service.console\"],\"name\":\"ggggggggggggggggggg/testname\",\"principal_id\":\"ggggggggggggggggggg:testname\",\"principal_urn\":\"sts::ggggggggggggggggggg:external-user:ggggggggggggggggggg/testname\",\"session_context\":{\"attributes\":{\"creationDate\":\"1779961225561\",\"mfa_authenticated\":\"false\"},\"federation_data\":{\"group_Ids\":[\"hhhhhhhhhhhhhhhhhhh\",\"iiiiiiiiiiiiiiiiiiii\"],\"identity_provider\":\"ggggggggggggggggggg\",\"protocol\":\"saml\"}},\"type\":\"ExternalUser\",\"id\":\"ggggggggggggggggggg\"}","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36"}]

Uploading objects

[{"code":200,"content_length":3,"event_type":"data","project_id":"bbbbbbbbbbbbbbbbbb","read_only":false,"record_time":1779961398474,"request_id":"kkkkkkkkkkkkkkkkkk","resource_name":"test003zcy:test.txt","resource_type":"OBJECT","service_type":"OBS","source_ip":"x.x.x.x","time":1779961398474,"total_time":43,"trace_id":"cccccccccccccccccccc","trace_name":"PUT.OBJECT","trace_rating":"normal","trace_type":"Others","user":"{\"domain\":{\"id\":\"ffffffffffffffffff\",\"name\":\"Test_name\"},\"id\":\"ggggggggggggggggggg\",\"name\":\"testname\"}"}]

If you have configured trace transfer to LTS, you can view traces in LTS log streams.

The OBS traces displayed on the LTS console differ in format from those on the CTS console and those transferred to OBS buckets. The following figures show the differences.

Creating a bucket
Uploading objects

Key Fields in CTS Traces

For details about the key fields in CTS traces, see Trace Structure.

Notes and Constraints

For details about the constraints on CTS, see CTS Notes and Constraints.

Prerequisites

You have registered with Huawei Cloud and completed real-name authentication.
If you already have one, skip this step. If you do not have one, do as follows:
1. Visit the Huawei Cloud official website and click Sign Up.
2. Sign up for a HUAWEI ID and enable Huawei Cloud services.
  After the signup, you will be redirected to your personal information page.
3. Complete real-name authentication for your individual or enterprise account.
Permissions have been granted to the account.
If you log in to the console using a Huawei Cloud account, skip this step.

If you log in to the console as an IAM user, first contact your CTS administrator (account owner or a user in the admin user group) to obtain the CTS FullAccess permission. For details, see Assigning Permissions to an IAM User.

Querying Traces

(Optional) Step 1: Create a Data Tracker

When you enable CTS, the system automatically creates a management tracker to track management traces. Only one management tracker can be created. To track data traces, you need to create a data tracker. For details about the maximum number of data trackers that can be created for an account, see CTS Notes and Constraints.

You can create a maximum of two data trackers for the same bucket, provided that their tracked operation types do not overlap. For example, if you create a data tracker for a bucket to track both read and write operations, you cannot create a second tracker for it, because the first one already covers all operations on the bucket. Creating a second one will result in overlapping operation types.

For details about how to create a data tracker, see Creating a Tracker.

Step 2: View Historical Traces

Viewing CTS Traces Generated in the Last Seven Days in the Trace List

If trace transfer is not configured for the management tracker, you can view CTS traces generated in the last seven days in the trace list.

Go to the Trace List page of the CTS console.
In the time range drop-down list above the trace list, select a desired query time range: Last 1 hour, Last 1 day, or Last 1 week. You can also select Custom to specify a custom time range within the last seven days.

Figure 1 Viewing OBS traces in the trace list
On the Trace List page, use advanced search to query traces. You can click the search box on the right and combine one or more filters.
(Optional) Export traces, refresh the list, and set the information to be displayed in the list.
- Click Export to export all traces in the query result as an XLSX file. The file can contain up to 5,000 records.
- Click to view the latest information about traces.
- Click to customize the information to be displayed in the trace list. If Auto wrapping is enabled (), excess text will move down to the next line; otherwise, the text will be truncated. By default, this function is disabled.

Viewing Historical Traces in an OBS Bucket

On the configuration page of a management or data tracker, you can enable and configure Transfer to OBS. Then, traces will be periodically transferred to an OBS bucket. For details, see Transferring CTS Traces to OBS and Viewing Them.

Figure 2 Viewing historical traces in an OBS bucket
Click to enlarge

Viewing Historical Traces in an LTS Log Stream

On the configuration page of a management or data tracker, you can enable and configure Transfer to LTS. Then, traces will be periodically transferred to an LTS log stream. For details, see Transferring CTS Traces to LTS and Viewing Them.

Figure 3 Viewing historical traces in an LTS log stream
Click to enlarge

References

Disabling or Deleting a Tracker

You can click Disable in the Operation column of a tracker to disable the tracker. After the tracker is disabled, the system will stop recording operations, but you can still view existing operation records.
You can click Delete in the Operation column of a tracker to delete the tracker. Deleting a tracker does not affect existing operation records. After you enable CTS again, you can still view the existing operation records.

Querying OBS Traces Using CTS APIs

CTS can track OBS management and data operations. You can use the trace list query API of CTS to view operation records.

CTS Application Examples

You can use the following examples to learn how to query a specific trace:

Use CTS to audit the creation and deletion operations for OBS bucket policies from the last two weeks. For details, see Security Auditing.
Use CTS to locate an object upload failure on the live network. For details, see Fault Locating.
Use CTS to view all operation records for an OBS bucket. For details, see Resource Tracking.

Why Cannot I Find Traces in the CTS Trace List?

By default, CTS uses only the management tracker named System, which is automatically created by the system, to record management traces. It does not record data traces. To enable CTS to record data traces, you need to create a data tracker. For details about management and data traces, see OBS Operations That Can Be Recorded by CTS.

For OBS, operations for buckets are management traces, and operations for objects in buckets are data traces. If you do not create a data tracker, operations for objects in buckets will not be recorded in the CTS trace list. For details about how to create a data tracker, see (Optional) Step 1: Create a Data Tracker.

Parent Topic: Using CTS to Audit OBS