A large number of logs are generated when Object Storage Service (OSS) resources are accessed. OSS uses Simple Log Service to help you query and collect statistics for OSS access logs and audit access to OSS in the OSS console, track exception events, and troubleshoot problems. This helps you improve work efficiency and make informed decisions.
Prerequisites
Simple Log Service is authorized to access OSS.
If you have not authorized Simple Log Service to access OSS, follow the instructions on the Cloud Resource Access Authorization page to complete the authorization.
Benefits
Pushes logs to Simple Log Service within 3 minutes and allows you to view real-time logs in the OSS console.
Provides log analysis and common analysis reports for easy data queries.
Allows you to query and analyze raw logs in real time and filter logs by bucket, object name, API operation, or time.
Billing rules
If the dedicated Logstore uses the pay-by-feature billing mode, you are not charged log storage or index traffic fees if the size of OSS access logs that are written per day is no more than 900 GB and the logs are stored for no more than seven days. If the size of an OSS access log is 1 KB, 900 GB is equivalent to 900 million logs. If the limits are exceeded, you are charged log storage and index traffic fees for the excess logs. The fees are included in your Simple Log Service bills. For more information, see Billable items of pay-by-feature.
You are charged when you read data from a dedicated Logstore over the Internet. You are also charged when you transform and ship data.
If the dedicated Logstore uses the pay-by-feature mode, the real-time log query feature provides a free quota for shards per month. The free quota is calculated by using the following formula: 16 × 31. The unit of the free quota is shard day. After the free quota is exhausted, you are charged fees, and the fees are included in your Simple Log Service bills. For more information, see Billable items of pay-by-feature.
For more information, see Billable items of pay-by-feature.
Enable real-time log query
You can enable real-time log query when you create a bucket or for an existing bucket.
Enable the real-time log query feature when you create a bucket
Log on to the OSS console.
In the left-side navigation pane, click Buckets. On the Buckets page, click Create Bucket.
In the Create Bucket panel, turn on Real-time Log Query. For more information about other parameters, see Create buckets.
Click OK.
Enable the real-time log query feature for an existing bucket
Log on to the OSS console.
In the left-side navigation pane, click Buckets. On the Buckets page, find and click the desired bucket.
In the left-side navigation tree, choose .
Click Activate Now.
Real-time log query allows you to query logs within the previous seven days free of charge. You can click Set Log Retention Period in the upper-right corner to modify the retention period of logs.
Query real-time logs
You can use one of the following methods to query real-time logs:
Query real-time logs on the Raw Logs tab
Log on to the OSS console.
In the left-side navigation pane, click Buckets. On the Buckets page, find and click the desired bucket.
In the left-side navigation tree, choose .
You can specify the time range and query statement in real-time log queries. For example, you can analyze the distribution of a specified field, such as an API operation within a specified time range. You can also filter the query results by condition to view the required access records.
Query real-time logs on the LogReduce tab
Log on to the OSS console.
In the left-side navigation pane, click Buckets. On the Buckets page, find and click the desired bucket.
In the left-side navigation tree, choose .
Click the LogReduce tab. If you have not enabled LogReduce, click Enable LogReduce.
In the message that appears, click OK.
For more information about LogReduce, see LogReduce.
When you query real-time logs, fields may change. For example, a field is added or a field is changed to an index. However, the configuration on the real-time log query page is not automatically synchronized. You need to manually refresh the configuration on the real-time log query page by using one of the following methods:
The following two methods restore the index to the latest version of the built-in index. However, the custom indexes are lost. Check whether the loss of custom indexes affects your business scenarios. If the loss does not affect your business scenarios, perform the following procedure. If the loss affects your business scenarios, manually add the missing indexes. For more information, see Create indexes.
Method 1: Use the OSS console
Disable real-time log query, and then enable it.
Method 2: Use the Simple Log Service console
- Log on to the Log Service console.
In the Log Application section, click the Cloud Service Lens tab. Then, click CloudLens for OSS.
On the Destination Logstore tab of the Data Import Management page, find the Logstore that you want to manage and click Reset in the Index Reset column.
In the message that appears, click OK.
NoteThe change takes effect in 1 minute.
Disable real-time log query
If you no longer need to retain log data, perform the following steps to disable real-time log query:
Log on to the OSS console.
In the left-side navigation pane, click Buckets. On the Buckets page, find and click the desired bucket.
In the left-side navigation tree, choose .
Click Disable Real-time Log Query in the upper-right corner.
ImportantWhen you enable real-time log query, Simple Log Service projects are automatically created. However, the projects are not automatically deleted when you disable real-time log query. Therefore, after real-time log query is disabled, you must log on to the Simple Log Service console to delete the projects that are automatically created to avoid unexpected charges. For more information, see Manage a project.