This topic describes all fields of Object Storage Service (OSS) logs.

Types of OSS logs

Table 1. Types of OSS logs
Log type Description
Access logs Record all access to the corresponding OSS buckets. Log Service collects logs of this type in real time.
Batch deletion logs Record the OSS objects deleted in batch deletion operations. Log Service collects logs of this type in real time.
Note When you call the DeleteObjects API operation, a request record is generated in an access log. The information about the objects that you requested to delete is stored in the HTTP body of a request. Therefore, a hyphen (-) is used to indicate the corresponding object in the access log. To retrieve a list of the deleted objects, check the corresponding batch deletion log. You can use the request_id parameter to associate the batch deletion request with the objects that you want to delete.
Hourly metering logs Record hourly metering statistics in a specific bucket to support analysis. A delay of several hours exists between log generation and log collection.

OSS built-in logging and OSS access logging

Log Service provides the OSS access logging feature to record, collect, store, and analyze access data, data deleted in batch deletion operations, and hourly metering data of OSS. OSS built-in logging is a built-in feature of OSS, which is also used to record and store access data of OSS.

OSS access logs provided by Log Service contain all information about OSS access operations. However, these logs have different log fields from OSS built-in logs. The following table lists the differences of fields between the two types of logs.
Field of OSS built-in logs Field of OSS access logs (Log Service) Description
Remote IP client_ip The IP address from which a request originates. The proxy or the client's firewall may block this field.
Time time The time when OSS receives a request.
Request-URI request-uri The requested URL, including the query-string parameter.
HTTP Status http_status The HTTP status code that OSS returns.
SentBytes response_body_length The traffic consumed when a user downloads logs from OSS.
RequestTime (ms) response_time The time consumed to complete a request, in milliseconds.
Referer referer The HTTP header that identifies the address of the web page which is linked to the resource being requested.
User-Agent User-Agent The user-agent header in an HTTP request.
HostName host The domain name that is requested.
Request ID request_id The unique ID used to identify a request.
LoggingFlag logging_flag Indicates whether the access logging feature has been enabled.
Requester Aliyun ID requester_id The Alibaba Cloud ID of the requester. The value of this field is a hyphen (-) for anonymous access.
Operation operation The type of a request.
Bucket bucket The name of the bucket that is requested.
Key Object The key that is requested.
Note The object field of Log Service is URL encoded.
ObjectSize object_size The size of an object.
Server Cost Time (ms) server_cost_time The time consumed by the OSS server to process a request, in milliseconds.
Error Code error_code The error code that OSS returns.
Request Length request_length The length of a request, in bytes.
UserID owner_id The ID of a bucket owner.
Delta DataSize delta_data_size The variation of the size of a bucket. The value of this field is a hyphen (-) if the bucket size does not change.
Sync Request sync_request Indicates whether the request is forwarded to the origin of Content Delivery Network (CDN). The value of this field is a hyphen (-) if this is not a back-to-origin request.

Access log

Table 2. Access log
Field Description Example
access_id The AccessKey ID of the user's Alibaba Cloud account. mEEJX**********
__topic__ The name of the topic in a log. The value of this field is fixed to oss_access_log. -
time The time when OSS receives a request. Use the value of __time__ if a timestamp is required. 27/Feb/2018:13:58:45
owner_id The Alibaba Cloud ID of the bucket owner. 12345678
User-Agent The user-agent header in an HTTP request. curl/7.15.5
logging_flag Indicates whether logging has been enabled to periodically export logs to OSS buckets. true
bucket The name of a bucket. bucket123
content_length_in The value of Content-Length in a request header, in bytes. 12345
content_length_out The value of Content-Length in a response header, in bytes. 12345
Object The URL encoded object of the request. You can use select url_decode(object) to decode the object when querying logs. data%2Fcur_file.txt
object_size The size of a requested object, in bytes. 1234
operation The type of an access operation. For more information about access types and descriptions, see Access types. GetObject
bucket_location The cluster where a bucket is located. The field values are in the format of oss-<region>-id. oss-cn-beijing-f
request_uri The URL encoded URI of the request, including the query-string parameter. You can use select url_decode(request_uri) to decode the URI when querying logs. /1518085703067732%2Fcur_file.txt HTTP/1.1
error_code The error code that OSS returns. For more information about error codes and descriptions, see OSS error response. NoSuchKey
request_length The size of an HTTP request, including the header, in bytes. 376
client_ip The IP address from which a request originates. 1.2.3.4
response_body_length The size of the body in an HTTP response, excluding the header. 123
http_method The method of an HTTP request. GET
referer The HTTP header that identifies the address of the web page which is linked to the resource being requested. http://www.abc.com
requester_id The Alibaba Cloud ID of the requester. The value of this field is a hyphen (-) for anonymous access. 12345678
request_id The request ID that can be used by OSS technical support to troubleshoot issues. 5A7C39674857FB9FFFFFF
response_time The response time of a request, in milliseconds. 123
server_cost_time The time consumed by the OSS server to process a request, in milliseconds. 123
http_type The type of an HTTP request. The value of this field is HTTP or HTTPS. http
sign_type The type of a signature. For more information about signature types and descriptions, see Signature types. NormalSign
http_status The status code of an HTTP connection returned by the OSS server. 200
sync_request The type of a synchronization request. For more information about synchronization request types and descriptions, see Synchronization request types. cn
bucket_storage_type The type of bucket storage. For more information about bucket storage types and descriptions, see Bucket storage types. standard
host The domain name that is requested. bucket123.oss-cn-beijing.aliyuncs.com
vpc_addr The virtual IP address (VIP) that corresponds to the domain name that you requested. The data type of this field is in Integer. This field can be used by OSS technical support to troubleshoot issues. 1234567890
vpc_id The ID of the Virtual Private Cloud (VPC) ID when the requester accessed. This field can be used by OSS technical support to troubleshoot issues. 1234
delta_data_size The variation of the size of an object. The value of this field is 0 if the object size does not change. The value of this field is a hyphen (-) for requests other than uploads. 280
acc_access_region For a request in CDN, this field is the domain name corresponding to the region where the requested access point is located. Otherwise, The value of this field is a hyphen (-). cn-hangzhou

Batch deletion logs

When you call the DeleteObjects API operation, a request record is generated in an access log. The information about the objects that you requested to delete is stored in the HTTP body of a request. Therefore, a hyphen (-) is used to indicate the corresponding object in the access log. To retrieve a list of the deleted objects, check the corresponding batch deletion log. The following table lists the fields and descriptions of batch deletion logs. You can use the request_id parameter to associate the batch deletion request with the objects that you want to delete.

Table 3. Batch deletion logs
Field Description Example
__topic__ The name of the topic in a log. The value of this field is oss_batch_delete_log. -
client_ip The IP address from which a request originates. 1.2.3.4
user_agent The user-agent header in an HTTP request. curl/7.15.5
bucket The name of a bucket. bucket123
error_code The error code that OSS returns. For more information about error codes and descriptions, see OSS error response. NoSuchKey
request_length The size of an HTTP request, including the header, in bytes. 376
response_body_length The size of the body in an HTTP response, excluding the header. 123
Object The URL encoded object of the request. You can use select url_decode(object) to decode the object when querying logs. data%2Fcur_file.txt
object_size The size of a request object, in bytes. 1234
operation The type of an access operation. For more information about access types and descriptions, see Access types. GetObject
bucket_location The cluster where a bucket is located. The field values are in the format of oss-<region>-id. oss-cn-beijing-f
http_method The method of an HTTP request. POST
referer The HTTP header that identifies the address of the web page which is linked to the resource being requested. http://www.abc.com
request_id The request ID that can be used by OSS technical support to troubleshoot issues. 5A7C39674857FB9FFFFFF
http_status The status code of an HTTP connection returned by the OSS server. 200
sync_request The type of a synchronization request. For more information about synchronization request types and descriptions, see Synchronization request types. cdn
request_uri The URL encoded URI of a request, including the query-string parameter. You can use select url_decode(request_uri) to decode the URI when querying logs. /1518085703067732%2Fcur_file.txt HTTP/1.1
host The domain name that is requested. bucket123.oss-cn-beijing.aliyuncs.com
logging_flag Indicates whether logging has been enabled to periodically export logs to OSS buckets. true
server_cost_time The time consumed by the OSS server to process a request, in milliseconds. 123
owner_id The Alibaba Cloud ID of the bucket owner. 12345678
requester_id The Alibaba Cloud ID of the requester. The value of this field is a hyphen (-) for anonymous access. 12345678
delta_data_size The variation of the size of an object. The value of this field is 0 if the object size does not change. The value of this field is a hyphen (-) for requests other than uploads. 280

Hourly metering logs

This type of logs record hourly metering statistics in a specific bucket to support analysis. A delay of several hours exists between log generation and log collection.

Table 4. Hourly metering log
Field Description Example
__topic__ The name of the topic in a log. The value of this field is oss_metering_log. -
owner_id The Alibaba Cloud ID of the bucket owner. 12345678
bucket The name of a bucket. bucket123
cdn_in The CDN inbound traffic, in bytes. 123
cdn_out The CDN outbound traffic, in bytes. 123
get_request The number of GET requests. 123
intranet_in The inbound traffic of the internal network, in bytes. 123
intranet_out The outbound traffic of the internal network, in bytes. 123
network_in The Internet inbound traffic, in bytes. 123
network_out The Internet outbound traffic, in bytes. 123
put_request The number of PUT requests. 123
storage_type The type of bucket storage. For more information about bucket storage types and descriptions, see Bucket storage types. standard
storage The storage capacity of a bucket, in bytes. 123
metering_datasize The size of metering data in non-standard storage. 123
process_img_size The size of a processed image, in bytes. 123
process_img The name of a processed image. 123
sync_in The synchronous inbound traffic, in bytes. 123
sync_out The synchronous outbound traffic, in bytes. 123
start_time The timestamp when a metering operation starts. 1518084000
end_time The timestamp when a metering operation ends. The metering data is hourly collected. 1518087600
region The region where a bucket is located. cn-beijing
bucket_location The cluster where a bucket is located. The field values are in the format of oss-<region>-id. oss-cn-beijing-f

Operation types

Table 5. Operation types
Operation Description
AbortMultiPartUpload Stops a multipart upload.
AppendObject Appends an object.
CommitTransition Commits a transition.
CompleteUploadPart Completes a multipart upload.
CopyObject Copies an object.
DeleteBucket Deletes a bucket.
DeleteLiveChannel Deletes a LiveChannel.
DeleteObject Deletes an object.
DeleteObjects Deletes multiple objects.
ExpireObject Makes an object expire.
GetBucket Queries objects.
GetBucketAcl Obtains permissions of a bucket.
GetBucketCors Queries the cross-origin resource sharing (CORS) rules of a bucket.
GetBucketEventNotification Queries the notification configurations of a bucket.
GetBucketInfo Queries the information about a bucket.
GetBucketLifecycle Queries the lifecycle configurations of a bucket.
GetBucketLocation Queries the region where a bucket is located.
GetBucketLog Queries the access log configurations of a bucket.
GetBucketReferer Queries the hotlink protection configurations of a bucket.
GetBucketReplication Queries the cross-region replication configurations.
GetBucketReplicationProgress Queries the progress of a cross-region replication.
GetBucketStat Queries the information about a bucket.
GetBucketWebSite Queries the static website hosting status of a bucket.
GetLiveChannelStat Queries the status of a LiveChannel.
GetObject Reads an object.
GetObjectAcl Obtains the access control list (ACL) of an object.
GetObjectInfo Queries the information about an object.
GetObjectMeta Queries the metadata of an object.
GetObjectSymlink Queries the details of the object that a symbolic link refers to.
GetPartData Queries the data in all parts of an object.
GetPartInfo Queries the information about all parts of an object.
GetProcessConfiguration Queries the image processing configurations of a bucket.
GetService Queries buckets.
HeadBucket Queries the information about a bucket.
HeadObject Queries the information about an object.
InitiateMultipartUpload Initializes the object for multipart upload.
ListMultiPartUploads Queries multipart upload events.
ListParts Queries status of all parts of an object.
Options Queries the options.
PostObject Uploads an object by using a form.
PostProcessTask Commits data processing operations, such as taking snapshots.
PostVodPlaylist Creates a video-on-demand (VOD) playlist of a LiveChannel.
ProcessImage Processes an image.
PutBucket Creates a bucket.
PutBucketCors Specifies the CORS rule for a bucket.
PutBucketLifecycle Specifies the lifecycle configurations of a bucket.
PutBucketLog Specifies the access log for a bucket.
PutBucketWebSite Specifies the static website hosting mode for a bucket.
PutLiveChannel Creates a LiveChannel.
PutLiveChannelStatus Specifies the status of a LiveChannel.
PutObject Upload an object.
PutObjectAcl Modifies the ACL of an object.
PutObjectSymlink Creates the object by using the symbolic link.
RedirectBucket Redirects the request to a bucket endpoint.
RestoreObject Restores an object.
UploadPart Resumes uploading an object from a checkpoint.
UploadPartCopy Copies a part.
get_image_exif Queries the exchangeable image file format (Exif) data of an image.
get_image_info Queries the length and width of an image.
get_image_infoexif Queries the length, width, and Exif data of an image.
get_style Queries the picture processing rule of a bucket.
list_style Queries all picture processing rules of a bucket.
put_style Creates a picture processing rule for a bucket.

For more information about each operation, see API overview.

Synchronization request types

Table 6. Synchronization request type
Synchronization request type Description
- Indicates a common request.
cdn Indicates a back-to-origin request from CDN.

Signature types

Table 7. Signature type
Signature type Description
NotSign Indicates that a request was not signed.
NormalSign Indicates that a request was signed with a normal signature.
UriSign Indicates that a request was signed with a URL signature.
AdminSign Indicates that a request was signed by an administrator.

For more information about signatures, see User signature authentication.

Bucket storage classes

Table 8. Bucket storage classes
Storage class Description
standard The default storage class for frequently accessed objects.
archive The storage class for archiving objects.
infrequent_access The storage class for infrequently accessed objects.

For more information about each storage class, see Introduction to storage classes.