Bucket Access Logs

Backblaze Bucket Access Logs contain detailed records about requests made on a bucket. Information such as the time and date of requests, request types, and specified resources can be included in these access logs. Bucket Access Logs are intended to help facilitate general data security and compliance requirements, as well as troubleshooting and monitoring.

Enable Bucket Access Logs

Backblaze does not collect bucket access logs by default. To start collecting data on a bucket, you will need to enable access logging at the bucket level on the desired source bucket (the bucket for which you would like to monitor activity) and select a destination bucket to which Backblaze will deliver the logs.

You can use the Backblaze web console or S3-Compatible API to enable access logging on a bucket.

Backblaze Web Console

1. In the Backblaze web console, in the left navigation menu under B2 Cloud Storage, click Buckets and locate the bucket for which you would like to enable Bucket Access Logs.
2. Click the Access Logs link to open the Bucket Access Logs configuration panel. 
3. In the Access Logs panel, toggle Access Logging to Enabled. 
4. Next, configure a Log File Destination bucket. This destination bucket will be the storage location for the source bucket’s access logs. Select the destination bucket from the dropdown menu. There is also an option to add a prefix to store the Bucket Access Logs in a specific folder in the destination bucket.
   The following are requirements for assigning a destination bucket to receive Bucket Access Logs:
   
   

   • Destination bucket must be a B2 Cloud Storage bucket.
   • Destination bucket and source bucket must be in the same account.
   • Destination bucket cannot have Object Lock enabled.
5. (OptionaI) It is possible to select between two different log object key formats and date sources, depending on your needs. For more information on log object key formats, see below. 
6. When you are finished with the configuration, click Update Bucket.

S3-Compatible API

Two S3-Compatible API operations are available for configuring and retrieving information on Bucket Access Logs:

• S3 Put Bucket Logging — enables and configures Bucket Access Logs for a source bucket. 
• S3 Get Bucket Logging —  returns the logging status of a source bucket.

Disable Bucket Access Logs

You can use the Backblaze web console or S3-Compatible API to disable access logging on a bucket.

Backblaze Web Console

1. In the Backblaze web console, in the left navigation menu under B2 Cloud Storage, click Buckets and locate the bucket for which you would like to enable Bucket Access Logs.
2. Click the Access Logs link to open the Bucket Access Logs configuration panel. 
3. In the Access Logs panel, toggle Access Logging to Disabled. 
4. Finally, click Update Bucket to save the changes.

S3-Compatible API

To disable logging, call the S3 Put Bucket Logging operation and use an empty BucketLoggingStatus in the request. For more information, please refer to the API documentation.

Log Format

Backblaze Bucket Access Logs consist of space-delimited fields, with each log record representing one request.

Example Bucket Access Log: 

5390fcd32749 test-bucket
[17/Apr/2025:22:47:56 +0000] 127.0.0.0 identity:applicationKey:1005390fcd337490000000086
ccad706cf1cb02c6 REST.S3_GET_OBJECT test.html
"GET /test.html?versionId=4_z85b369305f6c6d1393470419_f4178bc399f591e62_d20250113_m202432_c100_v0009990_t0001_u01736799872973
HTTP/1.1" 200 - - 71 43 43 "-"
"PostmanRuntime/7.43.3" - - SigV4 TLS_AES_256_GCM_SHA384 AuthHeader s3.us-east-005.backblazeb2.com TLSv1.3 - -

Log Record Fields

Backblaze Bucket Access Logs follow the AWS Bucket Access Log format, with the exception of the Access Point ARN and aclRequired fields. These two fields have empty default values because Amazon Resource Names (ARN) and access control lists (ACL) are not supported.

This table describes the log record fields:

Identity Field Types

In addition to detailed records about requests made on a bucket, Bucket Access Logs also include identity fields that indicate the entity responsible for the action. For example, identity fields can provide information about the specific account that triggered a replication request or which internal Backblaze service is responsible for an action.

Every identity string in a log has the identity: prefix to denote that they are values outside of the context of the log line from which they came.  Please see the table below for a complete list of identity fields.

The following table describes the identity field types that may appear in your Bucket Access Logs:

Log Object Key Format

In order to support AWS S3-compatibility, Bucket Access Logs follow the AWS S3 naming pattern for object log names. 

Example Log File Name: 

prefix/0883dc05e9a6/us-west-100/example-log-name/2025/03/27/2025-03-27-15-12-52-[UniqueString]

Bucket Access Logs can have two different log object key formats: 

• Non-date-based partitioning – This is the default log object key format:
  [DestinationPrefix][YYYY]-[MM]-[DD]-[hh]-[mm]-[ss]-[UniqueString]
• Date-based partitioning – If you choose date-based partitioning, you can choose the event time or delivery time for the log file as the date source used in the log format. This format makes it easier to query the logs:[DestinationPrefix]/[SourceAccountId]/[SourceRegion]/[SourceBucket]/[YYYY]/[MM]/[DD]/[YYYY]-[MM]-[DD]-[hh]-[mm]-[ss]-[UniqueString]

Log Delivery

Bucket Access Logs will be delivered to your destination bucket on a best-effort basis. This means that, for most logs, you can expect delivery within a few hours of the log being first recorded. Please note that the time between a particular request on a bucket and when that request is recorded in the logs and delivered is not guaranteed. Additionally, logs may occasionally be incomplete and/or contain duplicate data. For this reason, we advise that Bucket Access Logs not be regarded as a complete accounting of all requests but instead, be used to indicate the nature of traffic to your bucket.