# Suppressing recursive events with recursive logging
<a name="cloudtrail-trail-recursive-logging"></a>

## What is recursive logging?
<a name="cloudtrail-recursive-logging-overview"></a>

When CloudTrail delivers log files to a trail's destination, those delivery operations can themselves be logged as events. Destinations include an Amazon S3 bucket or a CloudWatch Logs log group. For example, when CloudTrail delivers a log file to your Amazon S3 bucket, it performs a `PutObject` API call. If your trail is configured to log Amazon S3 data events, this delivery operation is recorded as an event, which is then delivered to your bucket, generating another event, and so on. These are called *recursive events*.

You can use the `RecursiveLogging` setting to suppress these events.

## How recursive logging suppression works
<a name="cloudtrail-recursive-logging-how-it-works"></a>

When you set `RecursiveLogging` to `false` on a trail, CloudTrail suppresses recursive delivery events. CloudTrail filters out events where `userIdentity.invokedBy` is `cloudtrail.amazonaws.com` and the `eventSource` and `eventName` match one of the following:
+ `eventSource` is `s3.amazonaws.com` and `eventName` is `PutObject`
+ `eventSource` is `logs.amazonaws.com` and `eventName` is `PutLogEvents`

This setting only suppresses events where CloudTrail is the invoking service. All other events are delivered as expected.

## Configuring recursive logging
<a name="cloudtrail-recursive-logging-configure"></a>

You can configure the `RecursiveLogging` setting when you create or update a trail.

### Disabling recursive logging (suppressing recursive events)
<a name="cloudtrail-recursive-logging-disable"></a>

To suppress recursive events when creating a trail, use the `--no-recursive-logging` option:

```
aws cloudtrail create-trail \
    --name {{my-trail}} \
    --s3-bucket-name {{my-bucket}} \
    --no-recursive-logging
```

To suppress recursive events on an existing trail:

```
aws cloudtrail update-trail \
    --name {{my-trail}} \
    --no-recursive-logging
```

### Re-enabling recursive logging
<a name="cloudtrail-recursive-logging-enable"></a>

To re-enable recursive logging (deliver recursive events):

```
aws cloudtrail update-trail \
    --name {{my-trail}} \
    --recursive-logging
```

## Default behavior
<a name="cloudtrail-recursive-logging-defaults"></a>

By default, `RecursiveLogging` is set to `true` on all trails. This means recursive delivery events are logged. If you do not explicitly set `RecursiveLogging` to `false`, your trail continues to receive all events, including those generated by CloudTrail delivery operations.