Overview

The logging feature allows you to record detailed access information of a specified source bucket and save the information to a specified bucket as logs to facilitate bucket management.

In the destination bucket, the log path is:

destination bucket/path prefix{YYYY}/{MM}/{DD}/{time}_{random}_{index}

Logs are generated every 5 minutes (one record per line). Each record contains multiple fields, and fields are separated by a space. A single log file can be up to 256 MB. If the size of a log generated in 5 minutes is larger than 256 MB, this log will be segmented into multiple log files. The logging fields supported are as follows:

Note：

• Currently, COS offers the logging feature only in the Beijing, Shanghai, Guangzhou, Nanjing, Chongqing, Chengdu, Hong Kong (China), Singapore, Toronto, Silicon Valley, and Mumbai regions.
• The destination bucket and source bucket must reside in the same region.
• The destination bucket that stores logs can be the source bucket itself (not recommended).
• Currently, logs will be generated only when the bucket is accessed through XML APIs and XML API-based SDKs or tools, not via JSON APIs or JSON API-based SDKs or tools.
• Depending on customer needs and business development, COS may add new fields to the access logs. Please be sure to prepare for this when parsing the logs.

Enabling Log Management

Using the Console

You can quickly enable logging in the console. For detailed directions, please see Setting Logging.

Using APIs

To enable logging for a bucket using APIs, follow the steps below:

1. Create a log role.
2. Grant the log role permissions.
3. Enable logging.

1. Create a log role

Create a log role. For more information, see CreateRole.
Here, roleName must be CLS_QcsRole.
policyDocument must be:

{
"version": "2.0",
"statement": [{
    "action": "name/sts:AssumeRole",
    "effect": "allow",
    "principal": {
        "service": "cls.cloud.tencent.com"
    }
}]
}

2. Grant the log role permissions

Grant the log role permissions. For more information about the API, please see AttachRolePolicy.
Here, policyName is set to QcloudCOSAccessForCLSRole, roleName is the CLS_QcsRole in step 1, or the roleID returned when roleName was created.

3. Enable logging

Call the API to enable logging. For more information about the API, please see PUT Bucket logging. Note that the destination bucket to store the logs should be in the same region as the source bucket.