Overview

The log management records the detailed access information of the specified source bucket and store the information as log files in the specified bucket to facilitate bucket management.

In the destination bucket, the log path is:

{Destination bucket}/{Path prefix} {YYYY}/{MM}/{DD}/{time}_{random}_{index}.gz

The log is generated every 5 minutes, one record is a row, each record contains multiple fields, and the fields are separated by spaces. It should be noted that a single log file can be up to 256MB. If you generate more than 256MB of logs in these 5 minutes, your log will be split into multiple log files. The currently supported log fields are as follows:

Note：

• Currently, COS offers the logging feature only in the Beijing, Shanghai, Guangzhou, Nanjing, Chongqing, Chengdu, Hong Kong (China), Singapore, Toronto, Silicon Valley, and Mumbai regions.
• The log management feature requires the source bucket and destination bucket to be in the same region.
• The destination bucket for storing the logs can be the source bucket itself, but this is not recommended.
• Currently, logs will be generated only when the bucket is accessed through XML APIs and XML API-based SDKs or tools, not via JSON APIs or JSON API-based SDKs or tools.
• Depending on customer needs and business development, COS may add new fields to the access logs. Please be sure to prepare for this when parsing the logs.

Enabling Log Management

Using the Console

You can quickly enable the log management feature in the console. For instructions, see the Console Guide - Setting Log Management.

Using the API

To enable the log management feature for the specified bucket using API, follow the steps below:

1. Create a log role.
2. Grant the log role permissions.
3. Enable log management.

1. Create a log role

Create a log role. For more information, see CreateRole.
Here, roleName must be CLS_QcsRole.
policyDocument must be:

{
    "version": "2.0",
    "statement": [{
        "action": "name/sts:AssumeRole",
        "effect": "allow",
        "principal": {
            "service": "cls.cloud.tencent.com"
        }
    }]
}

2. Grant the log role permissions

Grant the log role permissions. For specific API information, see AttachRolePolicy.
Here, the policyName is QcloudCOSAccessForCLSRole; the roleName is CLS_QcsRole as in step 1, or, the roleID returned upon the creation of roleName, for this regard.

3. Enable log management

Call the API to enable the log management feature. For specific API information, see PUT Bucket logging, where the destination bucket storing the logs is required to be in the same region as the source bucket.