tencent cloud

Overview

The logging feature allows you to record the access information of a source bucket and save it to a destination bucket as logs.

In the destination bucket, the log path is:

destination bucket/path prefix{YYYY}/{MM}/{DD}/{time}_{random}_{index}

Logs are generated every 5 minutes (one record per line). Each record contains multiple fields, and fields are separated by a space. The file size for a log file is up to 256 MB. If the log file reaches the file size limit in 5 minutes, a new log file will be created. The logging fields supported are as follows:

Note：

• Currently, COS offers the logging feature only in the Beijing, Shanghai, Guangzhou, Nanjing, Chongqing, Chengdu, Hong Kong (China), Singapore, Toronto, Silicon Valley, and Mumbai regions.
• The destination bucket and source bucket must reside in the same region.
• The destination bucket that stores logs can be the source bucket itself (not recommended).
• Currently, logs will be generated only when the bucket is accessed through XML APIs and XML API-based SDKs or tools, not via JSON APIs or JSON API-based SDKs or tools.
• Depending on customer needs and business development, COS may add new fields to the access logs. Be sure to prepare for this when parsing the logs.

Enabling Logging

Using the console

You can quickly enable logging in the console. For detailed directions, see Setting Logging.

Using APIs

To enable logging for a bucket using APIs, follow the steps below:

1. Create a log role.
2. Grant the log role permissions.
3. Enable logging.

1. Create a log role

Create a log role. For more information, see CreateRole.
Here, roleName must be CLS_QcsRole.
policyDocument must be:

{
"version": "2.0",
"statement": [{
    "action": "name/sts:AssumeRole",
    "effect": "allow",
    "principal": {
        "service": "cls.cloud.tencent.com"
    }
}]
}

2. Grant the log role permissions

Grant the log role permissions. For more information about the API, see AttachRolePolicy.
Here, policyName is set to QcloudCOSAccessForCLSRole, roleName is the CLS_QcsRole in step 1, or the roleID returned when roleName was created.

3. Enable logging

Call the API to enable logging. For more information about the API, see PUT Bucket logging. Note that the destination bucket to store the logs should be in the same region as the source bucket.