Cloud Object Storage (COS) access logs record information about users' access to COS resources, including object upload (PUT), object deletion (DELETE), and object getting (GET). By analyzing access logs, you can perform audit backtracking, such as deleting resource records and collecting statistics on popular resources. This document introduces how to analyze COS access logs.
Prerequisite
COS logs have been collected to Cloud Log Service (CLS). For more information, please see Importing COS Data.
If you have not enabled the feature, you can use the Demo log topic provided for free by CLS to experience it. For detailed steps, see Use Demo Log to Quickly Experience CLS.
Introduction to Access Logs
No.
Field
Description
Example
1
eventVersion
Log version
1.0
2
bucketName
Bucket name
examplebucket-1250000000
3
qcsRegion
Request region
ap-beijing
4
eventTime
Event time (request end time, which is a timestamp in UTC+0 time zone)
According to the time column chart, 14 logs are recorded on the last day. For the drill-down analysis of the 14 log records, click the quick analysis bar on the left to view the resHttpCode information.
According to the quick analysis, there are 6 request log records whose resHttpCode is not 200: resHttpCode is 403 for 5 log records and 204 for 1 log record. Click to search for these logs quickly.
According to the logs, the 5 log records whose error code is Access Denied are object access failure logs. According to the logs whose resHttpCode is 204, object access failed because user 1000****** performed object deletion at around 20:16 on August 24 in the COS console.
