Server Access Log Format

Amazon Simple Storage Service: 2006-03-01

Server Access Log Format

	Important
	This section describes Beta functionality that is subject to change in future releases. Please provide feedback on this functionality in the

Amazon S3 Developer Forum.

The log files consist of a sequence of new-line delimited log records. Log records appear in no particular order. Each log record represents one request and consists of space delimited fields described in the following table.

Field Name	Example Entry	Notes
Bucket Owner	314159b66967d86f031c7249d1d9a8024 9109428335cd0ef1cdc487b4566cb1b	The canonical user id of the owner of the source bucket.
Bucket	mybucket	The name of the bucket that the request was processed against. If the system receives a malformed request and cannot determine the bucket, the request will not appear in any server access log.
Time	[04/Aug/2006:22:34:02 +0000]	The time at which the request was received. The format, using `strftime()` terminology, is `[%d/%B/%Y:%H:%M:%S %z]`
Remote IP	72.21.206.5	The apparent Internet address of the requester. Intermediate proxies and firewalls might obscure the actual address of the machine making the request.
Requester	314159b66967d86f031c7249d1d9a80 249109428335cd0ef1cdc487b4566cb1b	The canonical user id of the requester, or the string "Anonymous" for unauthenticated requests. This identifier is the same one used for access control purposes.
Request ID	3E57427F33A59F07	The request ID is a string generated by Amazon S3 to uniquely identify each request.
Operation	SOAP.CreateBucket or REST.PUT.OBJECT	Either `SOAP.``operation` or `REST.``HTTP_method`.`resource_type`
Key	/photos/2006/08/puppy.jpg	The "key" part of the request, URL encoded, or "-" if the operation does not take a key parameter.
Request-URI	"GET /mybucket/photos/2006/08/ puppy.jpg?x-foo=bar"	The Request-URI part of the HTTP request message.
HTTP status	200	The numeric HTTP status code of the response.
Error Code	NoSuchBucket	The Amazon S3 Error Code, or "-" if no error occurred.
Bytes Sent	2662992	The number of response bytes sent, excluding HTTP protocol overhead, or "-" if zero.
Object Size	3462992	The total size of the object in question.
Total Time	70	The number of milliseconds the request was in flight from the server's perspective. This value is measured from the time your request is received to the time that the last byte of the response is sent. Measurements made from the client's perspective might be longer due to network latency.
Turn-Around Time	10	The number of milliseconds that Amazon S3 spent processing your request. This value is measured from the time the last byte of your request was received until the time the first byte of the response was sent.
Referrer	"http://www.amazon.com/webservices"	The value of the HTTP Referrer header, if present. HTTP user-agents (e.g. browsers) typically set this header to the URL of the linking or embedding page when making a request.
User-Agent	"curl/7.15.1"	The value of the HTTP User-Agent header.

Any field can be set to "-" to indicate that the data was unknown or unavailable, or that the field was not applicable to this request.

Custom Access Log Information

You can include custom information to be stored in the access log record for a request by adding a custom query-string parameter to the URL for the request. Amazon S3 will ignore query-string parameters that begin with "x-", but will include those parameters in the access log record for the request, as part of the Request-URI field of the log record. For example, a GET request for "s3.amazonaws.com/mybucket/photos/2006/08/puppy.jpg?x-user=johndoe" will work the same as the same request for "s3.amazonaws.com/mybucket/photos/2006/08/puppy.jpg", except that the "x-user=johndoe" string will be included in the Request-URI field for the associated log record. This functionality is available in the REST interface only.

Extensible Server Access Log Format

From time to time, we might extend the access log record format by adding new fields to the end of each line. Code that parses server access logs must be written to handle trailing fields that it does not understand.

previous page start next page