> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nebius.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Logs in Object Storage

Object Storage keeps logs of actions that are performed to buckets and objects. You can view and analyze these logs as events in the [Audit Logs](/audit-logs) service.

There are two types of logs in Object Storage:

* *Control plane logs* describe actions on buckets, such as creating and deleting buckets, or getting and updating buckets' settings. Control plane logs are always available for all buckets.
* *Data plane logs* describe actions on objects, such as uploading, downloading and deleting objects. By default, Object Storage does not keep data plane logs for your buckets. For each individual bucket, you can enable partial or full data plane logging. This can help you identify object usage patterns to optimize storage costs, improve performance of critical parts of your applications and comply with regulations, such as the [Health Insurance Portability and Accountability Act](https://www.hhs.gov/hipaa/index.html) (HIPAA).

  <Note>
    Data plane logs are in [preview](/overview/services#preview). Before enabling them for your buckets, [contact support](https://console.nebius.com/support/create-ticket).
  </Note>

  Audit Logs has a [throughput quota for data plane logs](/audit-logs/resources/quotas-limits). Logs beyond that quota are not recorded. You can [monitor data plane events](/audit-logs/resources/quotas-limits#monitoring-data-plane-events) to avoid exceeding the quota.

## Configuring data plane logs

To configure data plane logs for a bucket, you need the `admin` [role](/iam/authorization/roles) for the bucket, its parent project or tenant.

<Tabs>
  <Tab title="Web console">
    You can configure data plane logs when [creating a bucket](https://console.nebius.com/storage/create) or on the **Settings** page of an existing bucket:

    1. Turn the **Data plane Audit Logs** setting on or off.
    2. If the setting is on, choose whether to log all actions or only actions that change objects. See the [list of logged data plane actions](#logged-data-plane-actions).
  </Tab>

  <Tab title="Nebius AI Cloud CLI">
    To configure data plane logs when [creating](./buckets/manage#how-to-create-buckets) (`nebius storage bucket create`) or [modifying buckets](./buckets/manage#how-to-modify-buckets) (`nebius storage bucket update`), add the `--object-audit-logging` parameter to the command:

    * `--object-audit-logging all`: All data plane actions are logged.
    * `--object-audit-logging mutate_only`: Only data plane actions that change objects are logged.
    * `--object-audit-logging none` (default): Data plane actions are not logged.

    See the [list of logged data plane actions](#logged-data-plane-actions).

    For example, to enable full data plane logging in an existing bucket, run the following command:

    ```bash theme={null}
    nebius storage bucket update \
      --id <bucket_ID> \
      --object-audit-logging all
    ```
  </Tab>

  <Tab title="Terraform">
    To configure data plane logs when [creating](./buckets/manage#how-to-create-buckets) or [modifying buckets](./buckets/manage#how-to-modify-buckets), add the `object_audit_logging` parameter to the `nebius_storage_v1_bucket` resource:

    * `object_audit_logging = "all"`: All data plane actions are logged.
    * `object_audit_logging = "mutate_only"`: Only data plane actions that change objects are logged.
    * `object_audit_logging = "none"` (default): Data plane actions are not logged.

    See the [list of logged data plane actions](#logged-data-plane-actions).

    For example, to enable full data plane logging in a bucket, use the following configuration:

    ```hcl theme={null}
    resource "nebius_storage_v1_bucket" "my_bucket" {
      name                 = "<bucket_name>"
      parent_id            = "<project_ID>"
      object_audit_logging = "all"
    }
    ```

    For more information about the `nebius_storage_v1_bucket` resource, see the [Terraform provider documentation](/terraform-provider/reference/resources/storage_v1_bucket).
  </Tab>
</Tabs>

Changes to existing buckets may take some time to apply. For example, if you enable data plane logs in an existing bucket, there may be a delay before logging begins.

### Logged data plane actions

Depending on whether you enabled all data plane logs (`all`) or only logs for actions that change objects (`mutate_only`), Object Storage logs actions that are performed by using the following [S3 API methods](https://docs.aws.amazon.com/AmazonS3/latest/API/API_Operations_Amazon_Simple_Storage_Service.html):

| Method                    | `all` | `mutate_only` |
| ------------------------- | ----- | ------------- |
| `PutObject`               | ✓     | ✓             |
| `CopyObject`              | ✓     | ✓             |
| `CreateMultipartUpload`   | ✓     | ✓             |
| `UploadPart`              | ✓     | ✓             |
| `UploadPartCopy`          | ✓     | ✓             |
| `AbortMultipartUpload`    | ✓     | ✓             |
| `CompleteMultipartUpload` | ✓     | ✓             |
| `DeleteObject`            | ✓     | ✓             |
| `DeleteObjects`           | ✓     | ✓             |
| `DeleteObjectVersion`     | ✓     | ✓             |
| `GetObject`               | ✓     | —             |
| `HeadObject`              | ✓     | —             |
| `ListParts`               | ✓     | —             |
| `ListObjectVersions`      | ✓     | —             |
| `ListObjects`             | ✓     | —             |
| `ListMultipartUploads`    | ✓     | —             |

Actions that do not create, read, update or delete objects themselves, such as `GetObjectAcl` or `PutObjectTagging`, are not logged, even if Object Storage supports them. Requests that result in HTTP client errors `400 Bad Request` and `429 Too Many Requests` are also not logged.

## Viewing control plane and data plane logs

You can view control plane logs, and data plane logs from buckets that have them enabled, in Audit Logs:

<Tabs>
  <Tab title="Web console">
    1. In the sidebar, go to <Icon icon="https://mintcdn.com/nebius-ai-cloud/1Ha0sWR6e1mnIaHS/_assets/sidebar/audit-logs.svg?fit=max&auto=format&n=1Ha0sWR6e1mnIaHS&q=85&s=9cb45ab2aee1262c0b066fdb6816f93d" width="16" height="16" data-path="_assets/sidebar/audit-logs.svg" /> **Audit Logs**.
    2. Select **Control plane** or **Data plane**.
    3. Filter events by the `STORAGE` service. If this filter is not displayed, click **Filters** and then select **Service**.
  </Tab>

  <Tab title="Nebius AI Cloud CLI">
    Run [nebius audit v2 audit-event list](/cli/reference/audit/v2/audit-event/list) with the service filter: `--filter "service.name='STORAGE'"`. To get control plane logs, add `--event-type control_plane`:

    ```bash theme={null}
    nebius audit v2 audit-event list \
      --parent-id <tenant_ID> \
      --start <time_in_ISO_8601> \
      --end <time_in_ISO_8601> \
      --filter "service.name='STORAGE'" \
      --event-type control_plane
    ```

    To get data plane logs, replace `--event-type control_plane` with `--event-type data_plane`:

    ```bash theme={null}
    nebius audit v2 audit-event list \
      --parent-id <tenant_ID> \
      --start <time_in_ISO_8601> \
      --end <time_in_ISO_8601> \
      --filter "service.name='STORAGE'" \
      --event-type data_plane
    ```
  </Tab>
</Tabs>

For more details, see [Viewing events in Audit Logs](/audit-logs/events/view).

Parameters of an action, such as the bucket name and the object key, are returned in the `.request.parameters` field of the Audit Logs event. For example:

```json theme={null}
{
  "request": {
    "parameters": {
      "bucket_name": "bucket-test",
      "object_key": "data/config.yaml",
      "version": "0[isNull=true,isLatest=false]"
    }
  }
}
```

For more details, see [Structure and fields of events in Audit Logs](/audit-logs/events/reference).