Understand OSS Log Fields for Access, Deletion & Metering - Simple Log Service

This topic describes the log fields for Object Storage Service (OSS) logs collected by Simple Log Service. OSS produces three types of logs: access logs, batch deletion logs, and hourly metering logs. Each log type uses a different topic value and captures a distinct set of fields.

Access logs

Access logs record all incoming requests to each OSS bucket. These logs are collected in real time.

The __topic__ value for access logs is oss_access_log.

Field	Description
`__topic__`	Log topic. Fixed value: `oss_access_log`.
`owner_id`	ID of the Alibaba Cloud account that owns the bucket.
`region`	Region where the bucket resides.
`access_id`	AccessKey ID of the requester.
`time`	Time at which OSS receives the request. To record timestamps, use the `__time__` field instead.
`User-Agent`	User-Agent field in the request header.
`logging_flag`	Whether logging is enabled to export logs to a bucket at regular intervals.
`bucket`	Name of the bucket.
`content_length_in`	Content-Length value in the request header. Unit: bytes.
`content_length_out`	Content-Length value in the response header. Unit: bytes.
`object`	URL-encoded requested object. To decode the object name, include `select url_decode(object)` in your query statement.
`object_size`	Size of the requested object. Unit: bytes.
`operation`	API operation. For more information, see Operation types.
`request_uri`	URL-encoded URI of the request, including the query string. To decode the URI, include `select url_decode(request_uri)` in your query statement.
`error_code`	Error code returned by OSS. For more information, see Overview.
`request_length`	Size of the request, including the header. Unit: bytes.
`client_ip`	IP address from which the request is sent. This address can be the IP address of a client, firewall, or proxy.
`response_body_length`	Size of the response body, excluding the header.
`http_method`	HTTP method used to send the request.
`referer`	Referer field in the request header.
`requester_id`	ID of the Alibaba Cloud account that sends the request. A hyphen (`-`) indicates an anonymous request.
`request_id`	ID of the request.
`response_time`	Time taken by OSS to respond to the request. Unit: milliseconds.
`server_cost_time`	Time taken by OSS to process the request. Unit: milliseconds.
`http_type`	Protocol used for the request. Valid values: `HTTP` and `HTTPS`.
`sign_type`	Signature type in the request. For more information, see Signature types.
`http_status`	HTTP status code in the response.
`sync_request`	Synchronous communication type for the request. For more information, see Synchronous request types.
`bucket_storage_type`	Storage class of the requested object. For more information, see Storage classes.
`host`	Endpoint of the bucket.
`vpc_addr`	Virtual IP address (VIP) of the server that hosts the bucket in a Virtual Private Cloud (VPC). Data type: integer. Example: `343819108`. To convert this value to an IP address, use the `int_to_ip(cast(vpc_addr as bigint))` function.
`vpc_id`	VPC ID.
`delta_data_size`	Change in the size of the requested object. A value of `0` means the object size did not change. A hyphen (`-`) means the request is not an upload request.
`acc_access_region`	Region of the OSS endpoint specified in the request when transfer acceleration is enabled. A hyphen (`-`) means transfer acceleration is disabled.
`restore_priority`	Priority of the log in the event of data restoration.
`extend_information`	Extended fields. Default value: hyphen (`-`). If the request is initiated by using a RAM role, this field records the RAM role information in the format `requesterParentId,roleName,roleSessionName,roleOwnerId`. Fields are separated by commas (`,`). New fields can be added to this format.

Batch deletion logs

Batch deletion logs record operations that delete multiple objects at a time from each bucket. These logs are collected in real time.

The __topic__ value for batch deletion logs is oss_batch_delete_log.

Note

When you call the DeleteObjects operation, an access log is generated for the operation. Because the information about the deleted objects is in the request body, the object field in the access log is set to a hyphen (-). To view the deleted objects, query the batch deletion logs where the request_id value matches the request ID.

Field	Description
`__topic__`	Log topic. Fixed value: `oss_batch_delete_log`.
`owner_id`	ID of the Alibaba Cloud account that owns the bucket.
`region`	Region where the bucket resides.
`client_ip`	IP address from which the request is sent. This address can be the IP address of a client, firewall, or proxy.
`user_agent`	User-Agent field in the request header.
`bucket`	Name of the bucket.
`error_code`	Error code returned by OSS. For more information, see Overview.
`request_length`	Size of the request body, including the header. Unit: bytes.
`response_body_length`	Size of the response body, excluding the header.
`object`	URL-encoded requested object. To decode the object name, include `select url_decode(object)` in your query statement.
`object_size`	Size of the requested object. Unit: bytes.
`operation`	API operation. For more information, see Operation types.
`bucket_location`	Cluster to which the bucket belongs.
`http_method`	HTTP method used to send the request.
`referer`	Referer field in the request header.
`request_id`	ID of the request.
`http_status`	HTTP status code in the response.
`sync_request`	Synchronous communication type for the request. For more information, see Synchronous request types.
`request_uri`	URL-encoded URI of the request, including the query string. To decode the URI, include `select url_decode(request_uri)` in your query statement.
`host`	Endpoint of the bucket.
`logging_flag`	Whether logging is enabled to export logs to a bucket at regular intervals.
`server_cost_time`	Time taken by OSS to process the request. Unit: milliseconds.
`requester_id`	ID of the Alibaba Cloud account that sends the request. A hyphen (`-`) indicates an anonymous request.
`delta_data_size`	Change in the size of the requested object. A value of `0` means the object size did not change. A hyphen (`-`) means the request is not an upload request.

Hourly metering logs

Hourly metering logs record storage and traffic metrics for each bucket on an hourly basis. These logs are collected several hours after they are generated.

The __topic__ value for hourly metering logs is oss_metering_log.

Field	Description
`__topic__`	Log topic. Fixed value: `oss_metering_log`.
`owner_id`	ID of the Alibaba Cloud account that owns the bucket.
`bucket`	Name of the bucket.
`cdn_in`	Inbound traffic from CDN to the bucket. Unit: bytes.
`cdn_out`	Outbound traffic from the bucket to CDN. Unit: bytes.
`get_request`	Number of GET requests sent to the bucket.
`intranet_in`	Inbound traffic to the bucket over internal networks. Unit: bytes.
`intranet_out`	Outbound traffic from the bucket over internal networks. Unit: bytes.
`network_in`	Inbound traffic to the bucket over the Internet. Unit: bytes.
`network_out`	Outbound traffic from the bucket over the Internet. Unit: bytes.
`put_request`	Number of PUT requests sent to the bucket.
`storage_type`	Storage class of the bucket. For more information, see Storage classes.
`storage`	Amount of data in the bucket. Unit: bytes.
`metering_datasize`	Amount of data whose storage class is not Standard in the bucket.
`process_img_size`	Size of the processed image. Unit: bytes.
`process_img`	The processed image.
`sync_in`	Inbound traffic to the bucket over synchronous requests. Unit: bytes.
`sync_out`	Outbound traffic from the bucket over synchronous requests. Unit: bytes.
`start_time`	Time at which the metering period starts. Unit: seconds.
`end_time`	Time at which the metering period ends. Unit: seconds.
`region`	Region where the bucket resides.

Reference tables

Storage classes

The following table lists the storage class values that appear in OSS log fields.

Storage class	Description
`standard`	Standard storage class.
`archive`	Archive storage class.
`infrequent_access`	Infrequent Access (IA) storage class.

Operation types

The following table lists the operation values that appear in OSS log fields.

Operation	Description
`AbortMultiPartUpload`	Cancels a multipart upload task.
`AppendObject`	Appends an object.
`CompleteUploadPart`	Completes a multipart upload task.
`CopyObject`	Copies an object.
`DeleteBucket`	Deletes a bucket.
`DeleteLiveChannel`	Deletes a LiveChannel.
`DeleteObject`	Deletes an object.
`DeleteObjects`	Deletes multiple objects.
`GetBucket`	Queries all objects in a bucket.
`GetBucketAcl`	Queries the access control list (ACL) of a bucket.
`GetBucketCors`	Queries the cross-origin resource sharing (CORS) rules of a bucket.
`GetBucketEventNotification`	Queries the notification configurations of a bucket.
`GetBucketInfo`	Queries the information about a bucket.
`GetBucketLifecycle`	Queries the lifecycle rules of a bucket.
`GetBucketLocation`	Queries the region where a bucket resides.
`GetBucketLog`	Queries the access log configurations of a bucket.
`GetBucketReferer`	Queries the hotlink protection configurations of a bucket.
`GetBucketReplication`	Queries the cross-region replication (CRR) rules of a bucket.
`GetBucketReplicationProgress`	Queries the progress of a CRR task on a bucket.
`GetBucketStat`	Queries the status of a bucket.
`GetBucketWebSite`	Queries the static website hosting status of a bucket.
`GetLiveChannelStat`	Queries the status of a LiveChannel.
`GetObject`	Reads an object.
`GetObjectAcl`	Queries the ACL of an object.
`GetObjectInfo`	Queries the information about an object.
`GetObjectMeta`	Queries the metadata of an object.
`GetObjectSymlink`	Queries the symbolic link of an object.
`GetPartData`	Queries the data in all parts of an object.
`GetPartInfo`	Queries the information about all parts of an object.
`GetProcessConfiguration`	Queries the image processing configurations of a bucket.
`GetService`	Queries all buckets created within your Alibaba Cloud account.
`HeadBucket`	Queries the information about a bucket.
`HeadObject`	Queries the metadata of an object.
`InitiateMultipartUpload`	Initializes a multipart upload task.
`ListMultiPartUploads`	Queries all multipart upload tasks in progress.
`ListParts`	Queries the status of all parts of an object.
`PostObject`	Uploads an object by using a form.
`PostProcessTask`	Commits a data processing task, such as screenshots.
`PostVodPlaylist`	Creates a playlist for a LiveChannel.
`ProcessImage`	Processes an image.
`PutBucket`	Creates a bucket.
`PutBucketCors`	Configures CORS rules for a bucket.
`PutBucketLifecycle`	Configures lifecycle rules for a bucket.
`PutBucketLog`	Enables logging for a bucket.
`PutBucketWebSite`	Enables static website hosting for a bucket.
`PutLiveChannel`	Creates a LiveChannel.
`PutLiveChannelStatus`	Changes the state of a LiveChannel.
`PutObject`	Uploads an object.
`PutObjectAcl`	Modifies the ACL of an object.
`PutObjectSymlink`	Creates a symbolic link for an object.
`RedirectBucket`	Redirects a request to the endpoint of a different bucket.
`RestoreObject`	Restores an object.
`UploadPart`	Uploads an object by part.
`UploadPartCopy`	Copies a part of an object.
`get_image_exif`	Queries the exchangeable image file format (EXIF) data of an image.
`get_image_info`	Queries the length and width of an image.
`get_image_infoexif`	Queries the length, width, and EXIF data of an image.
`get_style`	Queries a style of a bucket.
`list_style`	Queries all styles of a bucket.
`put_style`	Creates a style for a bucket.

For more information about API operations, see List of operations by function.

Synchronous request types

The following table lists the synchronous request type values that appear in OSS log fields.

Synchronous request type	Description
Hyphen (`-`)	General request.
`cdn`	CDN back-to-origin request.
`sync-public`	Cross-region replication (CRR) request.
`lifecycle`	Lifecycle rules configuration request.

Signature types

The following table lists the signature type values that appear in OSS log fields.

Signature type	Description
Hyphen (`-`)	General request.
`NotSign`	Unsigned request.
`NormalSign`	Request signed with a regular signature.
`UriSign`	Request signed with a URL signature.
`AdminSign`	Request signed with an administrator account.
`NORMAL_SIGN4`	Request signed with an Authorization header that includes a V4 signature. For more information, see (Recommended) Include a V4 signature in the Authorization header.
`URI_SIGN4`	Request signed with a URL that includes a V4 signature. For more information, see Signature version 4 (recommended).

For more information about signatures, see Verify user signatures.