Configuring Logging for a Bucket

Function

By default, bucket logging is disabled when you create or access a bucket. You can enable bucket logging by turning on the log configuration management switch. OBS logs all the requests for the bucket and stores the logs either in the logged bucket or another bucket that belongs to the same account and region as the logged bucket. You can search and analyze these logs to trace and locate abnormal events. For more information about bucket logging, see Configuring Logging for a Bucket.

Constraints

• You can store logs in the logged bucket or another bucket. However, the log storage bucket and logged bucket must belong to the same account and region.
• By default, buckets in the Infrequent Access or Archive storage class cannot be used to store log files. Stored log files occupy storage space in the bucket and are billed the same way as user-stored data.

Authorization

Authorization required for calling this API

To call this API, you must be the bucket owner or have the permission to configure logging for a bucket. You are advised to use IAM or bucket policies for authorization. For details about OBS authorization methods, see Differences Between OBS Permissions Control Methods.

• If you use IAM for authorization, you need to use either role/policy-based authorization or identity policy-based authorization and configure the required permissions:
  • If you use role/policy-based authorization (IAM v3 APIs in the old IAM version), you must have the obs:bucket:PutBucketLogging permission. For details, see Creating a Custom IAM Policy.
  • If you use identity policy-based authorization (IAM v5 APIs in the new IAM version), you must have the obs:bucket:putBucketLogging permission, as shown in the following table. For details, see Creating a Custom IAM Identity Policy.

    Action	Access Level	Resource Type (*: Required)	Condition Key	Alias	Dependencies
    obs:bucket:putBucketLogging	Write	bucket *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-	-
    		-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain

• If you use bucket policies for authorization, you must have the obs:bucket:PutBucketLogging permission. For details, see Creating a Custom Bucket Policy.

URI

PUT /

Calling Method

For details, see Calling APIs. Before calling this API, calculate the API signature and add it to the request.

You can debug this API in API Explorer.

Request Syntax

The following is an example request. Replace BucketName with your bucket name and RegionID with the ID of the region where your bucket resides. You can obtain the region ID by referring to Supported Regions.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

PUT /?logging HTTP/1.1 
Host: BucketName.obs.RegionID.myhuaweicloud.com 
Date: GMT Date
Authorization: SignatureValue
<?xml version="1.0" encoding="UTF-8"?>
<BucketLoggingStatus>
  <Agency>agency-name</Agency>
  <LoggingEnabled>
    <TargetBucket>mybucketlogs</TargetBucket>
    <TargetPrefix>mybucket-access_log-/</TargetPrefix>
        <TargetGrants>
      <Grant>
        <Grantee>
          <ID>domainID</ID>
        </Grantee>
        <Permission>READ</Permission>
      </Grant>
    </TargetGrants>
  </LoggingEnabled>
</BucketLoggingStatus>

URI Parameters

Request Headers

This request uses common headers. For details, see Table 3.

Request Body

Naming Rules for Access Log Objects

1

<TargetPrefix>YYYY-mm-DD-HH-MM-SS-<UniqueString>

• <TargetPrefix> is a user-defined prefix for log file names, corresponding to the TargetPrefix element in the request body.
  • If <TargetPrefix> ends with /, log files that you can see on the console are stored in the <TargetPrefix> folder, and log file names are in the format of YYYY-mm-DD-HH-MM-SS-<UniqueString>. OBS does not have the concept of folders, so it simulates folders by adding slashes (/) to object names. Therefore, API calls display full object names <TargetPrefix>YYYY-mm-DD-HH-MM-SS-<UniqueString> as log file names.

    Example object name:

    1	bucket-log/2015-06-29-12-22-07-N7MXLAF1BDG7MPDV

    • bucket-log/ is the user-defined prefix.
    • 2015-06-29-12-22-07 is the log generation timestamp.
    • N7MXLAF1BDG7MPDV is a string auto-generated by OBS.
  • If <TargetPrefix> does not end with /, log files that you see on the console are stored directly in the target bucket's root directory, and log file names are in the format of <TargetPrefix>YYYY-mm-DD-HH-MM-SS-<UniqueString>. API calls still display full object names <TargetPrefix>YYYY-mm-DD-HH-MM-SS-<UniqueString> as log file names.

    Example object name:

    1	bucket-log2015-06-29-12-22-07-N7MXLAF1BDG7MPDV

    • bucket-log is the user-defined prefix.
    • 2015-06-29-12-22-07 is the log generation timestamp.
    • N7MXLAF1BDG7MPDV is a string auto-generated by OBS.
• YYYY-mm-DD-HH-MM-SS indicates the log generation timestamp.
• <UniqueString> indicates a string auto-generated by OBS.

Bucket Access Log Format

Log entries are space-delimited, with fields containing spaces enclosed in double quotes. The following shows an example access log of the target bucket:

1

787f2f92b20943998a4fe2ab75eb09b8 bucket [13/Aug/2015:01:43:42 +0000] xx.xx.xx.xx 787f2f92b20943998a4fe2ab75eb09b8 281599BACAD9376ECE141B842B94535B  REST.GET.BUCKET.LOCATION - "GET /bucket?location HTTP/1.1" 200 - 211 - 6 6 "-"  "HttpClient" - -  

Each access log contains the following information:

Response Syntax

1
2
3

HTTP/1.1 status_code
Date: date
Content-Length: length

Response Headers

This response uses common headers. For details, see Table 1.

Response Body

This response does not contain a response body.

Error Responses

No special errors. You can find all errors in Error Code Overview.

Sample Request

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

PUT /?logging HTTP/1.1
User-Agent: curl/7.29.0
Host: examplebucket.obs.region.myhuaweicloud.com
Accept: */*
Date: Wed, 01 Jul 2015 02:40:06 GMT
Authorization: OBS H4IPJX0TQTHTHEBQQCEC:mCOjER/L4ZZUY9qr6AOnkEiwvVk=
Content-Length: 528

<?xml version="1.0" encoding="UTF-8"?>
<BucketLoggingStatus>
  <Agency>agencyGrantPutLogging</Agency>
  <LoggingEnabled>
    <TargetBucket>log-bucket</TargetBucket>
    <TargetPrefix>mybucket-access_log-/</TargetPrefix>
    
    <TargetGrants>
      <Grant>
        <Grantee>
          <ID>783fc6652cf246c096ea836694f71855</ID>
        </Grantee>
        <Permission>READ</Permission>
      </Grant>
    </TargetGrants>
  </LoggingEnabled>
</BucketLoggingStatus>

Sample Response

1
2
3
4
5
6

HTTP/1.1 200 OK
Server: OBS
x-obs-request-id: BF26000001643663CE53B6AF31C619FD
x-obs-id-2: 32AAAQAAEAABSAAkpAIAABAAAQAAEAABCT9CjuOx8cETSRbqkm35s1dL/tLhRNdZ
Date: Wed, 01 Jul 2015 02:40:06 GMT
Content-Length: 0

Sample Request: Disabling Bucket Log Dump

PUT /?logging HTTP/1.1
Authorization: OBS H4IPJX0TQTHTHEBQQCEC:iqSPeUBl66PwXDApxjRKk6hlcN4=
User-Agent: curl/7.29.0
Host: examplebucket.obs.region.myhuaweicloud.com
Date: Wed, 01 Jul 2015 02:37:22 GMT
Content-Type: application/xml

<BucketLoggingStatus>
</BucketLoggingStatus>

Sample Response: Disabling Bucket Log Dump

HTTP/1.1 200 OK
x-obs-id-2: 32AAAQAAEAABSAAgAAEAABAAAQAAEAABCSalxuWjLa91ewuXRoIcCKZFjFgCrYn0
x-obs-request-id: 0000018A2BC32FB6D2C62C9689DD14B3
Server: OBS
Content-Length: 0
Date: Wed, 01 Jul 2015 02:37:22 GMT

Using SDKs to Call APIs

You are advised to use OBS SDKs to call APIs. SDKs encapsulate APIs to simplify development. You can call SDK API functions to access OBS without manually calculating signatures.

Helpful Links

• To use obsutil to configure logging for a bucket, see Log Files.
• For more information about bucket logging, see Configuring Logging for a Bucket.
• For details about the billing items involved in API operations, see Billing Items.