This topic describes all log fields for Object Storage Service (OSS) access logging.

Types of OSS logs

Table 1. Types of OSS logs
Log type Description
Access log This log records all access data of the corresponding buckets. Log Service collects the log data in real time.
Batch deletion log This log records the objects deleted in batch deletion operations. Log Service collects the log data in real time.
Note When you call the DeleteObjects API operation, the access log generates a request record. The information about the files that you requested to delete is stored in the HTTP body of a request. Therefore, a hyphen (-) is used to indicate the corresponding object in the access log. To retrieve a list of the deleted files, check the corresponding batch deletion log. You can set the request_id parameter to associate the batch deletion request with the files that you want to delete.
Hourly metering log This log records specific hourly metering statistics in a specific bucket to support analysis. A delay of several hours exists between log generation and log collection.

OSS built-in logging and OSS access logging

Log Service provides OSS access logging to record, collect, store, and analyze logs of OSS access operations, batch deletion operations, and hourly metering operations. OSS built-in logging is a built-in feature of OSS to record and store logs of access operations, and record information about access to OSS storage.

OSS access logs contain all information about OSS access operations. However, these logs have different log fields from OSS built-in logs. The following table describes the differences of their log fields.
OSS built-in log field Log Service-OSS log field Description
Remote IP client_ip The IP address that you used to make a request. The proxy or your firewall may block this field.
Time time The time when OSS received a request.
Request-URI request-uri The URI that you requested, including the query-string parameter.
HTTP Status http_status The HTTP status code that OSS returned.
SentBytes response_body_length The traffic consumed when you downloaded logs from OSS.
RequestTime (ms) response_time The time consumed to complete a request, in milliseconds.
Referer referer The HTTP referer in a request.
User-Agent User-Agent The user-agent header in an HTTP request.
HostName host The domain name that you requested.
Request ID request_id The unique ID used to identify a request.
LoggingFlag logging_flag Indicates whether the access logging feature has been enabled.
Requester Aliyun ID requester_id Your Alibaba Cloud ID. This field is displayed as a hyphen (-) for anonymous access.
Operation operation The type of a request.
Bucket bucket The name of the bucket that you requested.
Key object The key that you requested.
Note The object field of Log Service is URL encoded.
ObjectSize object_size The size of an object.
Server Cost Time (ms) server_cost_time The time consumed by the OSS instance to process a request, in milliseconds.
Error Code error_code The error code that OSS returned.
Request Length request_length The length of your request, in bytes.
UserID owner_id The ID of a bucket owner.
Delta DataSize delta_data_size The variation of the size of a bucket. This field is displayed as a hyphen (-) if the bucket size does not change.
Sync Request sync_request Indicates whether you made a back-to-origin request from Content Delivery Network (CDN). This field is displayed as a hyphen (-) if this is not a back-to-origin request.

Access log

Table 2. Access log
Field name Description Example
access_id The AccessKey ID of your Alibaba Cloud account. mEEJX**********
__topic__ The name of the topic in a log. This field is displayed as oss_access_log. -
time The time when you accessed OSS. This is also the time when OSS received a request. Use the value of __time__ if a timestamp is required. 27/Feb/2018:13:58:45
owner_id The Alibaba Cloud ID of the bucket owner. 12345678
User-Agent The user-agent header in an HTTP request. curl/7.15.5
logging_flag Indicates whether logging has been enabled to periodically export logs to OSS buckets. true
bucket The name of a bucket. bucket123
content_length_in The value of Content-Length in a request header, in bytes. 12345
content_length_out The value of Content-Length in a response header, in bytes. 12345
object The URL encoded object of your request. You can use select url_decode(object) to decode the object when querying logs. data%2Fcur_file.txt
object_size The size of a request object, in bytes. 1234
operation The type of an access operation. For more information about access types and descriptions, see Access types. GetObject
bucket_location The cluster where a bucket is located. This field is displayed in the format of oss-<region>-id. oss-cn-beijing-f
request_uri The URL encoded URI of a request, including the query-string parameter. You can use select url_decode(request_uri) to decode the URI when querying logs. /1518085703067732%2Fcur_file.txt HTTP/1.1
error_code The error code that OSS returned. For more information about error codes and descriptions, see OSS error response. NoSuchKey
request_length The size of an HTTP request, including the header, in bytes. 376
client_ip The IP address that you used to make a request. 1.2.3.4
response_body_length The size of the body in an HTTP response, excluding the header. 123
http_method The method of an HTTP request. GET
referer The HTTP referer in a request. http://www.abc.com
requester_id Your Alibaba Cloud ID. This field is displayed as a hyphen (-) for anonymous access. 12345678
request_id The request ID that is used in OSS technical support to troubleshoot issues. 5A7C39674857FB9FFFFFF
response_time The response time of a request, in milliseconds. 123
server_cost_time The processing time of an OSS instance, in milliseconds. This is the time consumed by the OSS instance to process a request. 123
http_type The type of an HTTP request. This field is displayed as HTTP or HTTPS. http
sign_type The type of a signature. For more information about signature types and descriptions, see Signature types. NormalSign
http_status The status code of an HTTP connection returned in a request to OSS. 200
sync_request The type of a synchronization request. For more information about synchronization request types and descriptions, see Synchronization request types. cn
bucket_storage_type The type of bucket storage. For more information about bucket storage types and descriptions, see Bucket storage types. standard
host The domain name that you requested. bucket123.oss-cn-beijing.aliyuncs.com
vpc_addr The virtual IP address (VIP) that corresponds to the domain name that you requested. This field is in the integer format, and used in OSS technical support to troubleshoot issues. 1234567890
vpc_id The Virtual Private Cloud (VPC) ID that you used when accessing OSS in a VPC. This field is used in OSS technical support to troubleshoot issues. 1234
delta_data_size The variation of the size of an object. This field is displayed as 0 if the object size does not change. This field is displayed as a hyphen (-) for requests other than uploads. 280

Batch deletion log

When you call the DeleteObjects API operation, the access log generates a request record. The information about the files that you requested to delete is stored in the HTTP body of a request. Therefore, a hyphen (-) is used to indicate the corresponding object in the access log. To retrieve a list of the deleted files, check the corresponding batch deletion log. The fields and descriptions about deleting multiple logs are shown in the following table. You can set the request_id parameter to associate the batch deletion request with the files that you want to delete.

Table 3. Batch deletion log
Field Description Example
__topic__ The name of the topic in a log. This field is displayed as oss_batch_delete_log. -
client_ip The IP address that you used to make a request. 1.2.3.4
user_agent The user-agent header in an HTTP request. curl/7.15.5
bucket The name of a bucket. bucket123
error_code The error code that OSS returned. For more information about error codes and descriptions, see OSS error response. NoSuchKey
request_length The size of an HTTP request, including the header, in bytes. 376
response_body_length The size of the body in an HTTP response, excluding the header. 123
object The URL encoded object of your request. You can use select url_decode(object) to decode the object when querying logs. data%2Fcur_file.txt
object_size The size of a request object, in bytes. 1234
operation The type of an access operation. For more information about access types and descriptions, see Access types. GetObject
bucket_location The cluster where a bucket is located. This field is displayed in the format of oss-<region>-id. oss-cn-beijing-f
http_method The method of an HTTP request. POST
referer The HTTP referer in a request. http://www.abc.com
request_id The request ID that is used in OSS technical support to troubleshoot issues. 5A7C39674857FB9FFFFFF
http_status The status code of an HTTP connection returned in a request to OSS. 200
sync_request The type of a synchronization request. For more information about synchronization request types and descriptions, see Synchronization request types. cdn
request_uri The URL encoded URI of a request, including the query-string parameter. You can use select url_decode(request_uri) to decode the URI when querying logs. /1518085703067732%2Fcur_file.txt HTTP/1.1
host The domain name that you requested. bucket123.oss-cn-beijing.aliyuncs.com
logging_flag Indicates whether logging has been enabled to periodically export logs to OSS buckets. true
server_cost_time The processing time of an OSS instance, in milliseconds. This is the time consumed by the OSS instance to process a request. 123
owner_id The Alibaba Cloud ID of the bucket owner. 12345678
requester_id Your Alibaba Cloud ID. This field is displayed as a hyphen (-) for anonymous access. 12345678
delta_data_size The variation of the size of an object. This field is displayed as 0 if the object size does not change. This field is displayed as a hyphen (-) for requests other than uploads. 280

Hourly metering log

This log records specific hourly metering statistics in a specific bucket to support analysis. A delay of several hours exists between log generation and log collection.

Table 4. Hourly metering log
Field Description Example
__topic__ The name of the topic in a log. This field is displayed as oss_metering_log. -
owner_id The Alibaba Cloud ID of the bucket owner. 12345678
bucket The name of a bucket. bucket123
cdn_in The CDN inbound traffic, in bytes. 123
cdn_out The CDN outbound traffic, in bytes. 123
get_request The number of GET requests. 123
intranet_in The intranet inbound traffic, in bytes. 123
intranet_out The intranet outbound traffic, in bytes. 123
network_in The Internet inbound traffic, in bytes. 123
network_out The Internet outbound traffic, in bytes. 123
put_request The number of PUT requests. 123
storage_type The type of bucket storage. For more information about bucket storage types and descriptions, see Bucket storage types. standard
storage The storage capacity of a bucket, in bytes. 123
metering_datasize The size of metering data in non-standard storage. 123
process_img_size The size of a processed image, in bytes. 123
process_img The name of a processed image. 123
sync_in The synchronous inbound traffic, in bytes. 123
sync_out The synchronous outbound traffic, in bytes. 123
start_time The timestamp when a metering operation started. 1518084000
end_time The timestamp when a metering operation ended. The metering data was hourly collected. 1518087600
region The region where a bucket is located. cn-beijing
bucket_location The cluster where a bucket is located. This field is displayed in the format of oss-<region>-id. oss-cn-beijing-f

Operation types

Table 5. Operation types
Operation name Description
AbortMultiPartUpload Stops a multipart upload.
AppendObject Appends an object.
CommitTransition CommitTransition.
CompleteUploadPart Completes a multipart upload.
CopyObject Copies an object.
DeleteBucket Deletes a bucket.
DeleteLiveChannel Deletes a LiveChannel.
DeleteObject Deletes an object.
DeleteObjects Deletes multiple objects.
ExpireObject Makes an object expire.
GetBucket Queries objects.
GetBucketAcl Obtains permissions of a bucket.
GetBucketCors Queries the cross-origin resource sharing (CORS) rules of a bucket.
GetBucketEventNotification Queries the notification configurations of a bucket.
GetBucketInfo Queries the information about a bucket.
GetBucketLifecycle Queries the lifecycle configurations of a bucket.
GetBucketLocation Queries the region where a bucket is located.
GetBucketLog Queries the access log configurations of a bucket.
GetBucketReferer Queries the hotlink protection configurations of a bucket.
GetBucketReplication Queries the cross-region replication configurations.
GetBucketReplicationProgress Queries the progress of a cross-region replication.
GetBucketStat Queries the information about a bucket.
GetBucketWebSite Queries the static website hosting status of a bucket.
GetLiveChannelStat Queries the status of a LiveChannel.
GetObject Reads an object.
GetObjectAcl Obtains the Access Control List (ACL) of an object.
GetObjectInfo Queries the information about an object.
GetObjectMeta Queries meta data of an object.
GetObjectSymlink Queries the details of the symlink file.
GetPartData Queries the data in all parts of an object.
GetPartInfo Queries the information about all parts of an object.
GetProcessConfiguration Queries the image processing configurations of a bucket.
GetService Queries buckets.
HeadBucket Queries the information about a bucket.
HeadObject Queries the information about an object.
InitiateMultipartUpload Initializes the file for multipart upload.
ListMultiPartUploads Queries multipart upload events.
ListParts Queries statuses of all parts of an object.
Options Options.
PostObject Uploads an object by using a form.
PostProcessTask Commits data processing operations, such as taking snapshots.
PostVodPlaylist Creates a video-on-demand (VOD) playlist of a LiveChannel.
ProcessImage Processes an image.
PutBucket Creates a bucket.
PutBucketCors Specifies the CORS rule for a bucket.
PutBucketLifecycle Specifies the lifecycle configuration of a bucket.
PutBucketLog Specifies the access log for a bucket.
PutBucketWebSite Specifies static website hosting mode for a bucket.
PutLiveChannel Creates a LiveChannel.
PutLiveChannelStatus Specifies the status of a LiveChannel.
PutObject Uploads an object.
PutObjectAcl Modifies the ACL of an object.
PutObjectSymlink Creates a symlink file.
RedirectBucket Redirects the request to a bucket endpoint.
RestoreObject Restores an object.
UploadPart Resumes uploading a file from a checkpoint.
UploadPartCopy Copies a part.
get_image_exif Queries the exchangeable image file format (Exif) data of an image.
get_image_info Queries the length and width of an image.
get_image_infoexif Queries the length, width, and Exif data of an image.
get_style Queries the style of a bucket.
list_style Queries all styles of a bucket.
put_style Creates a style of a bucket.

For more information about each operation, see API overview.

Synchronization request types

Table 6. Synchronization request types
Synchronization request type Description
- Indicates a common request.
cdn Indicates a back-to-origin request from CDN.

Signature types

Table 7. Signature types
Signature type Description
NotSign Indicates that a request was not signed.
NormalSign Indicates that a request was signed with a normal signature.
UriSign Indicates that a request was signed with a URL signature.
AdminSign Indicates that a request was signed by an administrator.

For more information about signatures, see User signature authentication.

Bucket storage types

Table 8. Bucket storage types
Storage type Description
standard Standard storage
archive Archive storage
infrequent_access Infrequent access storage

For more information about each storage type, see Overview.