--- title: "S3 Bucket Logging" slug: "s3-bucket-logging" tags: ["5.5"] updated: 2026-10-27T23:00:54Z published: 2026-10-27T23:00:54Z canonical: "docs.vastdata.com/s3-bucket-logging" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.vastdata.com/llms.txt > Use this file to discover all available pages before exploring further. # S3 Bucket Logging - [Overview](/docs-5-5/docs/s3-bucket-logging#overview) - [Destination Bucket Requirements](/docs-5-5/docs/s3-bucket-logging#destination-bucket-requirements) - [Configuring S3 Bucket Logging in VAST Web UI](/docs-5-5/docs/s3-bucket-logging#configuring-s3-bucket-logging-in-vast-web-ui) - [Configuring S3 Bucket Logging in VAST CLI](/docs-5-5/docs/s3-bucket-logging#configuring-s3-bucket-logging-in-vast-cli) - [Configuring S3 Bucket Logging via VAST S3 API](/docs-5-5/docs/s3-bucket-logging#configuring-s3-bucket-logging-via-vast-s3-api) - [Setting Permissions for Log Objects in the Destination Bucket](/docs-5-5/docs/s3-bucket-logging#setting-permissions-for-log-objects-in-the-destination-bucket) - [Bucket Log Format](/docs-5-5/docs/s3-bucket-logging#bucket-log-format) ## Overview S3 bucket logging, or S3 server access logging, is a [native S3 feature](https://docs.aws.amazon.com/AmazonS3/latest/userguide/ServerLogs.html) that VAST Cluster supports on S3-enabled views. With S3 bucket logging, you can set up detailed recording of S3 operations on your bucket or bucket objects, with the logs written to another bucket. > [!NOTE] > Note > > Operations performed through other access protocols are not subject to S3 bucket logging. When the *source bucket* has S3 bucket logging enabled, VAST Cluster creates a log entry in AWS [log format](/docs-5-5/docs/s3-bucket-logging#bucket-log-format) for each S3 request made to the source bucket, and periodically uploads the log objects to a *destination bucket*. The format of log object keys can be configured to allow for date-based partitioning of log objects. You can set up S3 bucket logging in the VAST Web UI, VAST CLI or via VAST Cluster S3 API. Permissions for accessing the log objects in the destination bucket can be managed via a bucket policy, an identity policy, or when [sending a PutBucketLogging request](/docs-5-5/docs/s3-bucket-logging#configuring-s3-bucket-logging-via-vast-s3-api) to the VAST Cluster S3 server. To manage retention of log objects, configure VAST Web UI [lifecycle rules](/docs-5-5/docs/overview-of-lifecycle-rules) on the destination bucket. ## Destination Bucket Requirements The destination bucket must meet the following requirements: - The destination bucket is on the same tenant as the source bucket. - The destination bucket is on a view that has S3 protocol enabled. - The view policy of the destination bucket view is set to *S3 Native* security flavor. - The destination bucket has the same bucket owner as the source bucket. - The destination bucket is not the same as the source bucket. - The destination bucket does not have [S3 object locking](/docs-5-5/docs/s3-object-locking#s3-object-locking-overview) enabled. ## Configuring S3 Bucket Logging in VAST Web UI You configure S3 bucket logging for a bucket when [creating](/docs-5-5/docs/managing-views#creating-views) or [editing](/docs-5-5/docs/managing-views#modifying-views) a view that exposes the bucket to be logged (the source bucket). In the Bucket Logging tab of the Create View or Update View dialog, make the following settings: - Enable bucket logging Toggle on or off to enable or disable S3 bucket logging for the bucket. By default, bucket logging is disabled. - Destination bucket Select the bucket to store the logs. - Prefix Optionally, specify a prefix that will be prepended to each key of a log object uploaded to the destination bucket. This prefix can be used to categorize log objects; for example, if you use the same destination bucket for multiple source buckets. The prefix can be up to 128 characters and must follow [S3 object naming rules](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-keys.html). - Key format Select the format for the log object keys: - Non-date-based partitioning This is the default format: ```plaintext [DestinationPrefix][YYYY]-[MM]-[DD]-[hh]-[mm]-[ss]-[UniqueString] ``` - Date-based partitioning This format enables timestamp-based partitioning of log objects: ```plaintext [DestinationPrefix][SourceUsername]/[SourceBucket]/    [YYYY]/[MM]/[DD]/[YYYY]-[MM]-[DD]-[hh]-[mm]-[ss]-[UniqueString] ``` If you choose this format, you can use the Timestamp field to determine which time to use for the log object key: the time when the log object has been delivered to the destination bucket, or the time when the logged events occurred. - In the formats: - `[DestinationPrefix]` is the optional prefix that prepends keys of log objects uploaded to the destination bucket. You define this prefix in the Prefix field. - `[SourceUsername]` is the username for the owner of the bucket being logged. - `[SourceBucket]` is the bucket being logged. - UTC time is used in timestamps. - `[UniqueString]` is a unique string added to prevent overwriting of objects. - Timestamp If you specified the Key format that enables date-based partitioning of log objects, select the type of timestamp to be used when generating log object keys: - S3 event time. The timestamp shows the time when the logged events occurred. - Log object delivery time. The timestamp shows the time when the log object has been delivered to the destination bucket. - ## Configuring S3 Bucket Logging in VAST CLI By default, S3 bucket logging is disabled. To enable and configure S3 bucket logging using VAST CLI, run the `view create` or `view modify` command with the `--bucket-logging-destination-id` and, optionally, `--bucket-logging-prefix` and `--bucket-logging-key-format` options specified. To disable S3 bucket logging, run the `view create` or `view modify` command with the `--disable-bucket-logging` option specified. ## Configuring S3 Bucket Logging via VAST S3 API VAST Cluster supports the following S3 requests that are specific to S3 bucket logging: - `PutBucketLogging` is used to configure S3 bucket logging for a bucket and set permissions for accessing the log objects in the destination bucket (see [here](/docs-5-5/docs/boto3-client#configure-bucket-logging) for an example).Configure Bucket Logging - `GetBucketLogging` returns the S3 bucket logging configuration for the bucket (see [here](/docs-5-5/docs/boto3-client#return-bucket-logging) for an example).Return Bucket Logging The following users are able to configure S3 bucket logging and return logging configuration via VAST S3 API: - The bucket owner - Users allowed to do so by applicable identity or bucket policy ## Setting Permissions for Log Objects in the Destination Bucket Permissions for accessing the log objects in the destination bucket can be managed via a bucket policy, an identity policy, through a PutBucketLogging request, or based on the destination bucket ACL. To set permissions through a PutBucketLogging request (see [here](/docs-5-5/docs/boto3-client#configure-bucket-logging) for an example):Configure Bucket Logging - Ensure that the destination bucket has [ACLs enabled](/docs-5-5/docs/s3-object-ownership). If ACLs are disabled for the destination bucket, a PutBucketLogging request that sets grantees for this bucket would fail. - In the `Grantee` element of the request, specify grantees by `EmailAddress`. - In the `Permission` element of the request, specify the permissions provided to the grantee. These permissions are mapped to bucket ACL entries as follows: | Permission in PutBucketLogging Request | Permission in Bucket ACL | | --- | --- | | FULL_CONTROL | FULL_CONTROL | | READ | READ | | WRITE | WRITE | | | READ_ACP | | | WRITE_ACP | > [!NOTE] > Note > > Permissions specified in the PutBucketLogging request override permissions in the existing bucket ACL. ## Bucket Log Format The S3 bucket log is created in [AWS log format](https://docs.aws.amazon.com/AmazonS3/latest/userguide/LogFormat.html). Each entry in the log includes the following fields: | Field | Description | | --- | --- | | Bucket owner | The owner of the bucket being logged, in the format `username@domain` or just `username` if domain information is not available. | | Bucket | The name of the bucket being logged. | | Time | The UTC timestamp of when the request was received, in `[%d/%b/%Y:%H:%M:%S %z]` format. | | Remote IP | The IP address from which the request was received. | | Requester | The user which sent the request, in the format `username@domain` or just `username` if domain information is not available. | | Request ID | The ID set by the server for this request. | | Operation | The requested operation in the `REST.<HTTP method>.<resource type>` format; for example, `REST.GET.TAGGING`. | | Key | The name of the object specified in the request. | | Request URI | The `Request-URI` part of the HTTP message. | | HTTP status | The HTTP status code of the response. | | Error code | `-` if no S3 error occurred; otherwise, the S3 error code. | | Bytes sent | Response bytes sent, excluding HTTP protocol overhead. `-` means zero bytes. | | Object size | The size (in bytes) of the object specified in the request | | Total time | The time (in milliseconds) elapsed from when the server received the request to when it sent the last byte of the response. | | Turn-around time | The time (in milliseconds) elapsed from when the server received the last byte of the request to when it sent the first byte of the response. | | Referer | The value of the `Referer` header in the HTTP message. | | User agent | The value of the `User-Agent` header in the HTTP message. | | Version ID | The ID of the object version, if applicable. | | Host ID | This field is set to be the same as the *Request ID*. | | Signature version | The version of the signature used to authenticate the request (`SigV2` or `SigV4`). | | Cipher suite | If HTTPS was used, this field specifies the negotiated SSL cipher. For HTTP, it is set to `-`. | | Authentication type | Whether the request was authenticated using the HTTP `AuthHeader` header, or by means of `QueryString`. | | Host header | The value of the `Host` header in the HTTP message. | | TLS version | The TLS version used, for example, `TLSv1.2`. | | Access point ARN | This field is set to `-`. | | aclRequired | Whether ACLs were used to authorize access: `Yes` if ACLs were used, or `-` if ACLs were not used. | For example: ```plaintext [myuser c-2024-09-12-111045-288000 [12/Sep/2024:11:18:21 +0000] 198.51.100.2 myuser 88033944677064 REST.PUT.TAGGING elbencho-198.51.100.4-S65536-10485760/dir0/dir1/r0/d1/r0-f2 "PUT /c-2024-09-12-111045-288000/elbencho-198.51.100.4-S65536-10485760/dir0/dir1/r0/d1/r0-f2?tagging HTTP/1.1" 200 0 - 1589570 10933984 10880249 "-" "aws-sdk-cpp/1.11.335 ua/2.0 md/aws-crt#0.26.8 os/Linux/3.10.0-957.27.2.el7.x86_64 md/arch#x86_64 lang/c++#C++17 md/GCC#13.2.1 cfg/retry-mode#standard api/S3ocore/1.34.61esource" 0 88033944677064 SigV4 - AuthHeader 198.51.100.3:9090090 - - Yes] ```