Back History
Self-Managed Mode

<h1>Self-Managed Mode</h1>
<div style="float:right;width:250px;border:solid 1px #ccc;background-color:#f0f0f0;padding:10px;margin-left:20px;">
	<h2>Need help setting this up?</h2>
	<img src="/images/cloudberry/cloudberry_explorer.png" style="float:left;margin-right:10px;" />
	Our friends at 
	<a href="http://cloudberrylab.com/">Cloudberry Lab</a>
	have integrated S3<small>STAT</small> Self-Managed logging into 
	<a href="http://cloudberrylab.com/?id=7">Cloudberry Explorer</a>.  
<p/>
	It's a great tool for managing your S3 and Cloudfront distributions, 
	and now it will help you set up your buckets to play nice with S3<small>STAT</small>!
</div>


It is possible to set up your own S3 Buckets in such a way that we can process them for you without needing your AWS credentials.  It's a lot of effort, and not for the feint of heart, but it's certainly doable.

In a nutshell, you'll need to set up Server Access Logging manually, with a Logging Instruction that will send logfiles to a location in your bucket that matches our way of doing things, along with a Grant to give us READ permission for the generated files.  You'll also need to give us FULL_CONTROL over the bucket in question.

Simple eh?  Not really.  Here are some more detailed instructions for how to pull this off.


	<br style="clear:both;" />

<div style="border:solid 1px #ccc;background-color:#f0f0f0;padding:10px;margin-left:20px;">
<h2>Note:</h2>
At the moment, there in <b>no way to configure Cloudfront</b> distributions in self-managed mode.
<p/>
Cloudfront doesn't yet allow you to change the ACL for delivered logfiles, which means we can't read them unless we have your AWS credentials.
<p/>
Never fear, though.  We're working with the Cloudfront team to make this possible.
</div>

<h2>Permissions</h2>
You'll need to modify the ACL for the bucket in question to include the grants that Amazon will need to deliver logfiles to the bucket, as well as a grant that allows us to read and write the files we'll need to generate your reports.

If you're editing the XML for the ACL directly, here is what those Grants will look like (Grants needed for log delivery are in <span style="color:blue">blue</span>, while the Grant needed for S3<small>STAT</small> is in <span style="color:green">green</span>:

<pre><code class="xml">&lt;?xml version="1.0" encoding="UTF-8"?>
&lt;AccessControlPolicy xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
    &lt;AccessControlList><span style="color:blue">
        &lt;Grant>
            &lt;Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="Group">
                &lt;URI>http://acs.amazonaws.com/groups/s3/LogDelivery&lt;/URI>
            &lt;/Grantee>
            &lt;Permission>READ_ACP&lt;/Permission>
        &lt;/Grant>
        &lt;Grant>
            &lt;Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="Group">
                &lt;URI>http://acs.amazonaws.com/groups/s3/LogDelivery&lt;/URI>
            &lt;/Grantee>
            &lt;Permission>WRITE&lt;/Permission>
        &lt;/Grant></span><span style="color:green">
        &lt;Grant>
            &lt;Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="AmazonCustomerByEmail">
                &lt;EmailAddress>s3stat@s3stat.com&lt;/EmailAddress>
            &lt;/Grantee>
            &lt;Permission>FULL_CONTROL&lt;/Permission>
        &lt;/Grant></span>
    &lt;/AccessControlList>
&lt;/AccessControlPolicy>
</code></pre>

You can learn more about this piece by reading the section of Amazon's <a href="http://docs.amazonwebservices.com/AmazonS3/2006-03-01/LoggingHowTo.html"> 
Server Access Logging Setup Tutorial</a> titled "Preparing the Target Bucket".  Keep in mind, though, that you'll also need to add that grant for s3stat@s3stat.com.

<b>NOTE:</b> Do not attempt to make any ACL changes with <b>S3fox</b>.  It has a <b>bug</b> that mis-writes ACL changes in a way that effectively disables Server Access Logging.  Read <a href="http://developer.amazonwebservices.com/connect/thread.jspa?messageID=125957">more about this bug here</a>.

<h2>Logging Setup</h2>
Next, you'll need to set up Server Access Logging on the bucket to be logged.  S3<small>STAT</small> requires that logs be delivered back to the bucket being logged, and prefixed with the string "log/access_log-".

If you simply copy & paste the logging XML below, substituting your own <span style="color:blue">bucketname</span> in the right place, you should be fine:

<pre><code>&lt;?xml version="1.0" encoding="UTF-8"?>
&lt;BucketLoggingStatus xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
    &lt;LoggingEnabled>
        &lt;TargetBucket><span style="color:blue">bucketname</span>&lt;/TargetBucket>
        &lt;TargetPrefix>log/access_log-&lt;/TargetPrefix>
        &lt;TargetGrants>
            &lt;Grant>
                &lt;Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="AmazonCustomerByEmail">
                    &lt;EmailAddress>s3stat@s3stat.com&lt;/EmailAddress>
                &lt;/Grantee>
                &lt;Permission>FULL_CONTROL&lt;/Permission>
            &lt;/Grant>
        &lt;/TargetGrants>
    &lt;/LoggingEnabled>
&lt;/BucketLoggingStatus>
</code></pre>

You can learn more about this step by reading the section of Amazon's <a href="http://docs.amazonwebservices.com/AmazonS3/2006-03-01/LoggingHowTo.html"> 
Server Access Logging Setup Tutorial</a> titled "Enabling Server Access Logging on the Source Bucket".  

<h2>S3<small>STAT</small> Setup</h2>
If you followed the steps above, then you should be good to go.  Logs will start arriving in your bucket, and we will be able to read them.

At this point, you'll want to go ahead and <a href="/Setup/Register.aspx">sign up for S3stat</a> if you haven't done so already.  Once your account is up and running, you can go ahead and <a href="/Setup/SelfManagedSetup.aspx">set up a self-managed bucket</a>.

With luck, it should be self-explanatory from there!

	<a href="/Setup/SelfManagedSetup.aspx" class="giantlink" style="> 
		<img src="/images/orange_go.png" border="0" width="48" height="48" style="margin-bottom:-15px;" alt="Set up a Self-Managed Bucket" /> 
		Set up a Self-Managed Bucket
	</a> 
	<br /> 
	<br /> 

<h2>Disclaimer</h2>
I want to warn you one last time, in case you didn't notice it above: <b>THIS IS HARD</b>.  It requires considerable effort, skill, and a bit of luck on your part to pull it off.  There is every possibility that it simply won't work.

But here's the thing.  The reason we can offer this service so cheaply is that our customers are generally pretty bright and don't need a lot of hand holding.  For that reason, <b>we cannot offer any help or support with self-managed accounts</b>.

Chances are, nothing will go wrong, but if it does, you'll either need to figure it out on your own or fall back on our simple, painless, full-service way of doing things.

Thanks for your understanding, and Good luck!
Web log analysis and statistics for Amazon S3

Self-Managed Mode

About S3STAT

Getting Started

Getting Support

Bonus Stuff
