Server Access Log Format

Amazon Simple Storage Service: 2006-03-01

previous page next page

Server Access Log Format

[Important]Important

This section describes Beta functionality that is subject to change in future releases. Please provide feedback on this functionality in the

Amazon S3 Developer Forum.

The log files consist of a sequence of new-line delimited log records. Log records appear in no particular order. Each log record represents one request and consists of space delimited fields described in the following table.

Field Name Example Entry Notes
Bucket Owner 
314159b66967d86f031c7249d1d9a8024

                9109428335cd0ef1cdc487b4566cb1b
 The canonical user id of the owner of the source bucket.
Bucket 
mybucket
 The name of the bucket that the request was processed against. If the system receives a malformed request and cannot determine the bucket, the request will not appear in any server access log.
Time 
[04/Aug/2006:22:34:02 +0000]
 The time at which the request was received. The format, using strftime() terminology, is [%d/%B/%Y:%H:%M:%S %z]
Remote IP 
72.21.206.5
 The apparent Internet address of the requester. Intermediate proxies and firewalls might obscure the actual address of the machine making the request.
Requester 
314159b66967d86f031c7249d1d9a80

                249109428335cd0ef1cdc487b4566cb1b
 The canonical user id of the requester, or the string "Anonymous" for unauthenticated requests. This identifier is the same one used for access control purposes.
Request ID 
3E57427F33A59F07
 The request ID is a string generated by Amazon S3 to uniquely identify each request.
Operation 
SOAP.CreateBucket
or 
REST.PUT.OBJECT
 Either SOAP.operation or REST.HTTP_method.resource_type
Key 
/photos/2006/08/puppy.jpg
 The "key" part of the request, URL encoded, or "-" if the operation does not take a key parameter.
Request-URI 
"GET /mybucket/photos/2006/08/

                puppy.jpg?x-foo=bar"
 The Request-URI part of the HTTP request message.
HTTP status 
200
 The numeric HTTP status code of the response.
Error Code 
NoSuchBucket
 The Amazon S3 Error Code, or "-" if no error occurred.
Bytes Sent 
2662992
 The number of response bytes sent, excluding HTTP protocol overhead, or "-" if zero.
Object Size 
3462992
 The total size of the object in question.
Total Time 
70
 The number of milliseconds the request was in flight from the server's perspective. This value is measured from the time your request is received to the time that the last byte of the response is sent. Measurements made from the client's perspective might be longer due to network latency.
Turn-Around Time 
10
 The number of milliseconds that Amazon S3 spent processing your request. This value is measured from the time the last byte of your request was received until the time the first byte of the response was sent.
Referrer 
"http://www.amazon.com/webservices"
 The value of the HTTP Referrer header, if present. HTTP user-agents (e.g. browsers) typically set this header to the URL of the linking or embedding page when making a request.
User-Agent 
"curl/7.15.1"
 The value of the HTTP User-Agent header.

Any field can be set to "-" to indicate that the data was unknown or unavailable, or that the field was not applicable to this request.

Custom Access Log Information

You can include custom information to be stored in the access log record for a request by adding a custom query-string parameter to the URL for the request. Amazon S3 will ignore query-string parameters that begin with "x-", but will include those parameters in the access log record for the request, as part of the Request-URI field of the log record. For example, a GET request for "s3.amazonaws.com/mybucket/photos/2006/08/puppy.jpg?x-user=johndoe" will work the same as the same request for "s3.amazonaws.com/mybucket/photos/2006/08/puppy.jpg", except that the "x-user=johndoe" string will be included in the Request-URI field for the associated log record. This functionality is available in the REST interface only.

Extensible Server Access Log Format

From time to time, we might extend the access log record format by adding new fields to the end of each line. Code that parses server access logs must be written to handle trailing fields that it does not understand.

previous page start next page