When you access OSS, a large number of access logs are generated. Real-time log query combines OSS with Log Service. This feature allows you to query and collect statistics for OSS access logs and audit access to OSS by using the OSS console, track exceptions, and troubleshoot problems. Real-time log query enables you to be more efficient and make better decisions.

Comparison between real-time log query and access logging

  • Real-time log query:
    • Pushes logs to Log Service within 3 minutes and allows you to view real-time logs in the OSS console.
    • Provides the log analysis service and typical analysis reports so that you can easily query data.
    • Allows you to query and analyze raw logs in real time and filter logs by bucket, object name, API operation, and time.
  • Access logging:
    • Allows you to enable access logging for a bucket, after which OSS generates log objects in accordance with a predefined naming convention. This way, hourly access logs are written to the specified bucket as objects.
    • Allows you to use Alibaba Cloud Data Lake Analytics or build a Spark cluster to analyze access logs.
    • Allows you to configure lifecycle rules for the specified bucket to convert the storage class of log objects to Archive or Cold Archive for long-term archiving.

Configuration method

Console: Configure real-time log query

Query methods

The real-time log query feature provides the following query methods:
  • Query raw logs
    You can specify the time range and query statement to query logs in real time and perform the following operations:
    • Analyze the distribution of a specified field such as an API operation within a specified time range.
    • Filter by field to view required access records. For example, filter the object deletion operations for the last day by bucket, object name, or API operation name, and query the deletion time and access IP address.
    • Collect statistics on OSS access records such as the page view (PV), unique visitor (UV), or maximum latency of a bucket within a specified time range.
  • Use Dashboard
    Dashboard allows you to view four immediately available reports.
    • Access Center: displays the overall operating status including the PV, UV, traffic, and distribution of access over the Internet.
    • Audit Center: displays statistics on object operations including read, write, and delete operations on objects.
    • Operation Center: displays statistics on access logs including the number of requests and distribution of failed operations.
    • Performance: displays statistics on performance including the performance of downloads and uploads over the Internet, the performance of transmission over different networks or with different object sizes, and the list of differences between stored and downloaded objects.
  • Use the Log Service console

    You can view OSS access logs in the Log Service console. For more information, see OSS access logs.

Billing methods

  • Real-time log query allows you to query logs from the past seven days free of charge. If the log storage time that you set is longer than seven days, Log Service will charge the excess days separately. Extra fees are charged when you read data from or write data to Log Service over the Internet.
  • Log Service allows you to store 900 GB of logs (equivalent to 900 million 1-KB log entries) per day free of charge, and charges additional fees for excessive logs. You can use the real-time log query feature to query the stored logs.

For more information about the billing standards, see Log Service billing methods.