OSS log types and fields - Simple Log Service - Alibaba Cloud Documentation Center

This topic describes the types of Object Storage Service (OSS) logs and the fields for each log type.

OSS log types

Log type	Description
Access log	You must manually enable this feature. For more information, see Enable log collection. Collects all access logs and deletion information from batch deletion logs for the specified OSS bucket in real time. Note When you call the DeleteObjects operation, a request record is generated in the access log. `oss-log-store` may contain both Detailed Access Logs and Hourly Metering Logs (This is different from the metering logs described below). `_topic_:oss_access_log` represents Detailed Access Logs, and `_topic_:oss_metering_log` represents Hourly Metering Logs.
Metering log	Enabled by default for free. Records the hourly accumulated metering data for a specific OSS bucket. The log collection time is several hours later than the actual generation time. These logs are used for auxiliary analysis.
Monitoring metrics	Enabled by default for free. Records metrics such as requests, latency, and traffic at a 10-second granularity, and metrics such as requests and traffic at a 5-minute granularity.

OSS built-in logging and OSS access logging

Simple Log Service (SLS) provides a real-time query and analysis feature for OSS access logs. This service records, collects, stores, and analyzes data for OSS access, batch deletions, and hourly metering. OSS built-in logging is an OSS feature that records and stores access logs for OSS buckets.

The logs provided by SLS contain all the information from OSS access logs, but the log fields differ from those of the OSS built-in logs, as shown in the following table. For more information, see Access logs.

OSS built-in log field	SLS-OSS log field
Remote IP	client_ip
Time	time
Request-URI	request-uri
HTTP Status	http_status
SentBytes	response_body_length
RequestTime (ms)	response_time
Referer	referer
User-Agent	user-agent
HostName	host
Request ID	request_id
LoggingFlag	logging_flag
Requester Aliyun ID	requester_id
Operation	operation
Bucket	bucket
Key	object
ObjectSize	object_size
Server Cost Time (ms)	server_cost_time
Error Code	error_code
Request Length	request_length
UserID	owner_id
Delta DataSize	delta_data_size
Sync Request	sync_request

Access logs

Field	Description
__topic__	The log topic. The value is fixed to oss_access_log.
time	The time when the OSS request ended, for example, 27/Feb/2018:13:58:45. If you need a timestamp, use the __time__ field.
access_id	The AccessKey ID of the requester.
owner_id	The Alibaba Cloud account ID of the OSS bucket owner.
user_agent	The User-Agent header of the HTTP request, for example, curl/7.15.5.
logging_flag	Indicates whether the feature that periodically exports logs to an OSS bucket is enabled. A value of true indicates that the feature is enabled.
bucket	The name of the OSS bucket.
content_length_in	The value of Content-Length in the request header. Unit: bytes.
content_length_out	The value of Content-Length in the response header. Unit: bytes.
object	The requested OSS object. The object is URL encoded. When you query the object, run `select url_decode(object)` to decode it.
object_size	The size of the OSS object. Unit: bytes.
operation	The API operation. For more information, see Appendix: API operations.
bucket_location	The data center where the OSS bucket is located. The format is usually `oss-<region ID>`.
request_uri	The URI of the HTTP request, including the query string. The URI is URL encoded. When you query the URI, run `select url_decode(request_uri)` to decode it.
error_code	The error code returned by OSS. For more information, see Error codes.
request_length	The size of the HTTP request, including the header. Unit: bytes.
client_ip	The IP address from which the request is initiated. This can be the IP address of the client, its network firewall, or a proxy.
response_body_length	The size of the body in the HTTP response, excluding the header.
http_method	The HTTP request method.
referer	The HTTP Referer of the request.
requester_id	The ID of the requester. If the access is anonymous, a hyphen (-) is displayed.
request_id	The request ID.
response_time	The HTTP response time. Unit: milliseconds.
server_cost_time	The time that the OSS server takes to process the request. Unit: milliseconds.
http_type	The HTTP request type. Valid values: HTTP and HTTPS.
sign_type	The signature type. NotSign: The request is not signed. NormalSign: The request is signed in a common way. UriSign: The request is signed using a URL. AdminSign: Specifies the administrator account. NORMAL_SIGN4: V4 signature. URI_SIGN4: V4 signature included in a URL.
http_status	The status returned for the HTTP request.
sync_request	The synchronization request type. Hyphen (-): a common request. cdn: a back-to-origin request from CDN. lifecycle: a request to set a lifecycle rule.
bucket_storage_type	The storage class of the OSS object. standard: Standard archive: Archive Storage IA: Infrequent Access
host	The endpoint used for the request, for example, bucket123.oss-cn-beijing.aliyuncs.com.
vpc_addr	The Havip address of the VPC where OSS is located. This address is an integer, for example, 343819108. Run `int_to_ip(cast(vpc_addr as bigint))` to convert it to an IP address.
vpc_id	The ID of the VPC where OSS is located.
delta_data_size	The change in the size of the OSS object. If the size does not change, the value is 0. If the request is not an upload request, a hyphen (-) is returned.
ec	The detailed error code. For more information about how to troubleshoot issues based on ECs, see Troubleshoot issues based on ECs.
acc_access_region	If the request is a transfer acceleration request, this field indicates the region of the access point. Otherwise, a hyphen (-) is returned.
restore_priority	The restoration priority.
extend_information	An extended field. The default value is a hyphen (-). If a request is initiated using a RAM role, the log records the information about the RAM role. The information is concatenated in the `requesterParentId,roleName,roleSessionName,roleOwnerId` format. The fields are separated by commas (,). New fields may be added.
user_defined_log_fields	An extended field. The default value is a hyphen (-). If you configure custom headers and parameters for the bucket, the log records the information about the matching headers and parameters. The value is the Base64 encoding of a JSON field.
archive_direct_read_size	The billed size for real-time access of Archive objects generated by the request. If real-time access of Archive objects is not used, a hyphen (-) is returned. Unit: bytes.

Batch delete log

When you call the DeleteObjects operation, a request record is generated in the access log. However, because the information about the deleted files is stored in the HTTP request body, the value of the object field in the access log is a hyphen (-). To view the list of deleted files, you must check the batch delete log. The following table describes the fields of a batch delete log. You can associate the batch delete log with the access log using the request_id field.

Field name	Description
__topic__	The log topic. The value is fixed to oss_batch_delete_log.
bucket	The name of the OSS bucket.
bucket_location	The data center where the OSS bucket is located. The format is oss-<region ID>.
client_ip	The IP address from which the request is initiated. This can be the IP address of the client, its network firewall, or a proxy.
delta_data_size	The change in the size of the OSS object. If the size does not change, the value is 0. If the request is not an upload request, a hyphen (-) is returned.
error_code	The error code returned by OSS. For more information, see Error codes.
host	The endpoint used for the request, for example, bucket123.oss-cn-beijing.aliyuncs.com.
http_method	The HTTP request method, for example, POST.
http_status	The status returned for the HTTP request.
logging_flag	Indicates whether the feature that periodically exports logs to an OSS bucket is enabled. A value of true indicates that the feature is enabled.
object	The requested OSS object. The object is URL encoded. When you query the object, run `select url_decode(object)` to decode it.
object_size	The size of the OSS object. This corresponds to the size of the requested object. Unit: bytes.
operation	The API operation. For more information, see Appendix: API operations.
owner_id	The Alibaba Cloud account ID of the OSS bucket owner.
response_body_length	The size of the HTTP response body, excluding the header.
request_length	The size of the HTTP request, including the header. Unit: bytes.
referer	The HTTP Referer of the request.
request_id	The request ID.
requester_id	The ID of the requester. If the access is anonymous, a hyphen (-) is returned.
request_uri	The URI of the request, including the query string. The URI is URL encoded. When you query the URI, run `select url_decode(request_uri)` to decode it.
sync_request	The synchronization request type. Hyphen (-): a common request. cdn: a back-to-origin request from CDN. lifecycle: a request to set a lifecycle rule.
server_cost_time	The time that the OSS server takes to process the request. Unit: milliseconds.
user_agent	The User-Agent header of the HTTP request, for example, curl/7.15.5.

Hourly metering logs

Hourly metering logs record hourly statistics for a specific OSS bucket. You can use these logs for analysis.

Field	Description
__topic__	The log topic. The value is fixed to oss_metering_log.
owner_id	The Alibaba Cloud account ID of the OSS bucket owner.
bucket	The name of the OSS bucket.
cdn_in	The inbound traffic from CDN. Unit: bytes.
cdn_out	The outbound traffic to CDN. Unit: bytes.
metering_datasize	The size of the metered data for non-Standard storage classes.
get_request	The number of GET requests.
intranet_in	The inbound traffic over the internal network. Unit: bytes.
intranet_out	The outbound traffic over the internal network. Unit: bytes.
network_in	The inbound traffic over the Internet. Unit: bytes.
network_out	The outbound traffic over the Internet. Unit: bytes.
put_request	The number of PUT requests.
storage	The storage usage of the OSS bucket. Unit: bytes.
storage_type	The storage class of the OSS bucket. standard: Standard archive: Archive Storage IA: Infrequent Access
process_img_size	The size of the processed image. Unit: bytes.
sync_in	The inbound traffic for synchronization. Unit: bytes.
sync_out	The outbound traffic for synchronization. Unit: bytes.
start_time	The start timestamp of the metering. Unit: seconds.
end_time	The end timestamp of the metering. Unit: seconds.
region	The region where the OSS bucket is located.
process_img	The processed image.
bucket_location	The data center where the OSS bucket is located. The format is usually oss-<region ID>.
standard_total	Standard - Total physical capacity. Unit: bytes.
standard_lrs	Standard - Locally redundant storage - Physical capacity. Unit: bytes.
standard_zrs	Standard - Zone-redundant storage - Physical capacity. Unit: bytes.
ia_total	IA - Total physical capacity. Unit: bytes.
ia_lrs	IA - Locally redundant storage - Physical capacity. Unit: bytes.
ia_zrs	IA - Zone-redundant storage - Physical capacity. Unit: bytes.
ia_total_charged_datasize	IA - Total billable storage usage. Unit: bytes.
ia_lrs_charged_datasize	IA - Locally redundant storage - Billable storage usage. Unit: bytes.
ia_zrs_charged_datasize	IA - Zone-redundant storage - Billable storage usage. Unit: bytes.
archive_total	Archive - Total physical capacity. Unit: bytes.
archive_lrs	Archive - Locally redundant storage - Physical capacity. Unit: bytes.
archive_zrs	Archive - Zone-redundant storage - Physical capacity. Unit: bytes.
archive_total_charged_datasize	Archive - Total billable storage usage. Unit: bytes.
archive_lrs_charged_datasize	Archive - Locally redundant storage - Billable storage usage. Unit: bytes.
archive_zrs_charged_datasize	Archive - Zone-redundant storage - Billable storage usage. Unit: bytes.
coldarchive_total	Cold Archive - Total physical capacity. Unit: bytes.
coldarchive_lrs	Cold Archive - Locally redundant storage - Physical capacity. Unit: bytes.
coldarchive_total_charged_datasize	Cold Archive - Total billable storage usage. Unit: bytes.
coldarchive_lrs_charged_datasize	Cold Archive - Locally redundant storage - Billable storage usage. Unit: bytes.
deepcoldarchive_total	Deep Cold Archive - Total physical capacity. Unit: bytes.
deepcoldarchive_lrs	Deep Cold Archive - Locally redundant storage - Physical capacity. Unit: bytes.
deepcoldarchive_total_charged_datasize	Deep Cold Archive - Total billable storage usage. Unit: bytes.
deepcoldarchive_lrs_charged_datasize	Deep Cold Archive - Locally redundant storage - Billable storage usage. Unit: bytes.
reserved_capacity	Reserved capacity - Total used capacity. Unit: bytes.
reserved_capacity_lrs	Reserved capacity - Locally redundant storage - Used capacity. Unit: bytes.
reserved_capacity_zrs	Reserved capacity - Zone-redundant storage - Used capacity. Unit: bytes.
total_storage	Total physical capacity. Unit: bytes.
total_storage_charged_datasize	Total billable storage usage (excluding Standard storage). Unit: bytes.

Appendix: API operations

The following table lists the API operations. For more information, see API overview.

Operation	Description
AbortMultiPartUpload	Aborts a multipart upload.
AppendObject	Appends data by uploading a file.
CompleteUploadPart	Completes the breakpoint upload.
CopyObject	Copies the file.
DeleteBucket	Deletes a bucket.
DeleteLiveChannel	Deletes a LiveChannel.
DeleteObject	Deletes an object.
DeleteObjects	Deletes multiple objects.
ExpireObject	Deletes an expired object.
GetBucket	Lists objects.
GetBucketAcl	Gets the access control list (ACL) of a bucket.
GetBucketCors	Qets the cross-origin resource sharing (CORS) rules of a bucket.
GetBucketEventNotification	Gets the notification configurations of a bucket.
GetBucketInfo	Qets the information about a bucket.
GetBucketLifecycle	Qets the lifecycle configuration of a bucket.
GetBucketLocation	Qets the region of a bucket.
GetBucketLog	Qets the access log configuration of a bucket.
GetBucketReferer	Qets the hotlink protection settings of a bucket.
GetBucketReplication	Qets the cross-region replication (CRR) configuration.
GetBucketReplicationProgress	Qets the CRR progress.
GetBucketStat	Qets the information about a bucket.
GetBucketWebSite	Qets the static website hosting status of a bucket.
get_image_exif	Qets the EXIF information of an image.
get_image_info	Qets the information about an image, such as its height and width.
get_image_infoexif	Qets the height, width, and EXIF information of an image.
GetLiveChannelStat	Qets the status information of a LiveChannel.
GetObject	Reads the object.
GetObjectAcl	Obtains object access permissions.
GetObjectInfo	Gets the information about an object.
GetObjectMeta	Qets the object meta information.
GetObjectSymlink	Gets the details of a symbolic link file.
GetPartData	Gets the data of a part in a multipart upload.
GetPartInfo	Gets the information about a part in a multipart upload.
GetProcessConfiguration	Gets the image processing configuration of a bucket.
GetService	Lists buckets.
get_style	Gets a bucket style.
HeadBucket	Queies the information about a bucket.
HeadObject	Views file information.
InitiateMultipartUpload	Initiates a multipart upload.
ListMultiPartUploads	Lists multipart upload tasks in progress.
ListParts	Lists the status of parts in a multipart upload.
list_style	Lists the styles of a bucket.
PostObject	Uploads an object using a form.
PostProcessTask	Submits a data processing task, such as taking a screenshot.
PostVodPlaylist	Creates a video-on-demand (VOD) playlist for a LiveChannel.
ProcessImage	Processes an image.
PutBucket	Creates a bucket.
PutBucketCors	Configures the CORS rules for a bucket.
PutBucketLifecycle	Configures the lifecycle rules for a bucket.
PutBucketLog	Configures access logs for a bucket.
PutBucketWebSite	Configures the static website hosting mode for a bucket.
PutLiveChannel	Creates a LiveChannel.
PutLiveChannelStatus	Sets the status of a LiveChannel.
PutObject	Uploads files.
PutObjectAcl	Modifies file access permissions.
PutObjectSymlink	Creates a symbolic link file.
put_style	Creates a bucket style.
RedirectBucket	Redirects a bucket endpoint.
RestoreObject	Restores the file.
UploadPart	Uploads data by part.
UploadPartCopy	Copies a part.