Aerospike Database logs

When you need to troubleshoot unexpected behavior, diagnose performance issues, or debug errors in your Aerospike Cloud cluster, inspect the per-node server logs. Aerospike Cloud stores logs from each cluster node in an Amazon S3 bucket. Grant access to your AWS IAM roles or account through the Cloud API, then read the logs with standard AWS tooling.

Configure log access

Grant your AWS IAM roles access to the S3 bucket containing your cluster logs.

Grant log access to your AWS account or IAM roles using the Aerospike Cloud API.

Caution
When updating the authorizedRoles array, the entire list is replaced. Include all roles that should have access in each update. Setting "authorizedRoles": [] removes access for all roles.

To grant access during database creation:

Include the logging block in your create cluster API request.

To grant access to an entire AWS account, use the root user ARN.
```
{
  "logging": {
    "authorizedRoles": [
      "arn:aws:iam::012345678901:root"
    ]
  }
}
```
To grant access to specific roles, use the role ARNs.
```
{
  "logging": {
    "authorizedRoles": [
      "arn:aws:iam::012345678901:role/ASLogReader",
      "arn:aws:iam::012345678901:role/DeveloperRole"
    ]
  }
}
```
To grant access for an existing database:

Use the update cluster API endpoint to modify the logging configuration:
```
{
  "logging": {
    "authorizedRoles": [
      "arn:aws:iam::012345678901:role/ASLogReader",
      "arn:aws:iam::012345678901:role/DeveloperRole"
    ]
  }
}
```
Retrieve the S3 bucket ARN from the cluster details.

You can retrieve the S3 bucket ARN using the get cluster API endpoint. The response includes a logging object with the logBucket field:
```
{
  "logging": {
    "logBucket": "arn:aws:s3::db-logs-bucket",
    "authorizedRoles": [ "arn:aws:iam::012345678901:root" ]
  }
}
```
Access the S3 bucket containing your database logs.

Use your authorized AWS account or assume the authorized IAM role. Access the logs with standard AWS tools:
Terminal window
```
# Using AWS CLI to list logs (extract bucket name from ARN)
aws s3 ls s3://db-logs-bucket
```