---
title: "Enable Access Logging for a Bucket"
slug: "enable-access-logging-for-a-bucket"
updated: 2025-04-12T06:06:49Z
published: 2025-04-12T06:06:49Z
canonical: "kb.expedient.com/enable-access-logging-for-a-bucket"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://kb.expedient.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Enable Access Logging for a Bucket

### Introduction

When server access logging is enabled for a bucket, the system will write a timestamped access log file to a bucket specified in the configuration every 10 minutes. See [Amazon Documentation](https://docs.aws.amazon.com/AmazonS3/latest/userguide/LogFormat.html) for details about the log content.

### Limitations

- Log files are only created if the bucket has been accessed within the past 10 minutes.
- The logging destination bucket must be in the same S3 region and must have the same owner as the source bucket.
- S3 Object lock cannot be enabled on the log destination bucket.
- [Bucket Naming Rules](https://kb.expedient.com/docs/create-a-bucket-on-cloud-object-storage#bucket-naming-rules) apply to the log destination bucket

### Configure the logging destination bucket

<editor360-custom-block data-preprocessing="true" data-sanitizationtags="strong"><ol><li><a href="https://kb.expedient.com/docs/login-to-cloud-object-storage" rel="nofollow noopener noreferrer" target="_blank" translate="no">Log into Cloud Object Storage</a></li><li>Navigate to the <strong>Buckets &amp; Objects </strong>tab, then click <strong>+ Add New Bucket</strong></li><li>Give the new bucket an appropriate <strong>Bucket </strong><strong>N</strong><strong>ame</strong>, select the same <strong>R</strong><strong>egion </strong>that hosts the bucket you wish to enable logging on, and leave the <strong>Storage Policy</strong> as the default<img src="https://cdn.document360.io/69e9f9c7-5da8-45e7-a671-4b8287f36122/Images/Documentation/image-1678113028757.png" class="fr-fic fr-fil fr-dib"></li><li>With the bucket created, access the <strong>Properties</strong> of the newly created bucket and navigate to the <strong>Bucket Canned ACL </strong>tab</li><li>In the <strong>Set Canned ACL </strong>drop-down, select <strong>Log Delivery Write </strong>and <strong>Save </strong>the configuration<strong><img src="https://cdn.document360.io/69e9f9c7-5da8-45e7-a671-4b8287f36122/Images/Documentation/image-1678113161294.png" class="fr-fic fr-fil fr-dib"></strong></li><li>Review the <strong>Bucket Permissions </strong>tab. Ensure that the <strong>Log Delivery</strong> grantee has both <strong>Writable </strong>and <strong>ACP Readable </strong>permissions<img src="https://cdn.document360.io/69e9f9c7-5da8-45e7-a671-4b8287f36122/Images/Documentation/image-1678113500161.png" class="fr-fic fr-fil fr-dib"></li></ol></editor360-custom-block>

### Configure the source bucket

1. Return to **Buckets & Objects** and access the **Properties** of the bucket on which you wish to enable
2. Navigate to the **Logging** tab and toggle **Enable Logging**
3. Enter the name of the **Destination Bucket** that was created earlier.

![](https://cdn.document360.io/69e9f9c7-5da8-45e7-a671-4b8287f36122/Images/Documentation/image-1678113584735.png)
  1. Optionally, enter a **Target Prefix.** This is a text string that will be added to the beginning of the log filename. If multiple buckets are enabled for logging, we recommend setting a target prefix as the source bucket name
4. **Save** the configuration