You can identify object delete transactions in the audit log by locating API-specific (S3 and Swift) audit messages.
Not all audit messages generated during a delete transaction are listed in the following tables. Only messages required to trace the delete transaction are included.
S3 delete audit messages
Code |
Name |
Description |
Trace |
See |
SDEL |
S3 Delete |
Request made to delete the object from a bucket. |
CBID, S3KY |
SDEL: S3 DELETE |
Swift delete audit messages
Code |
Name |
Description |
Trace |
See |
WDEL |
Swift Delete |
Request made to delete the object from a container, or the container. |
CBID, WOBJ |
WDEL: Swift DELETE |
CDMI delete audit messages