Stackdriver Logging

Question 1

What is cloud logging

Answer 1

Provides:
Storage for logs
User interface called the Logs Viewer
API to manage logs programmatically

Logging lets you read and write log entries, search and query your logs, export your logs, and create logs-based metrics.

Question 2

Whom are logs created for

Answer 2

Logs are associated primarily with Google Cloud projects, although other resources, such as organizations, folders, and billing accounts, can also have logs

Question 3

Logs Viewer

Answer 3

The Logs Viewer shows only the logs from one project, but using the Logging API, you can read log entries across multiple resources.

Question 4

Log entries

Answer 4

A log entry records status or an event. The entry might be created by Google Cloud services, AWS services, third-party applications, or your own applications.

Question 5

Creation of log entries

Answer 5

Created:
When services that routinely produce log entries are used, like Compute Engine or BigQuery.
When you connect the operations suite to AWS
When you install the Logging agent on your VM instances
When you call the entries.write method in the Logging API.

Question 6

Payload

Answer 6

The “message” the log entry carries is called the “payload”; it can be a simple string or structured data.

Question 7

Logs

Answer 7

A log is a named collection of log entries within a Google Cloud resource. Each log entry includes the name of its log. A log name can be a simple identifier, like syslog, or a structured name including the log’s writer, like compute.googleapis.com/activity. Logs exist only if they have log entries.

Question 8

Retention period for logs

Answer 8

Log entries are held in Cloud Logging for a limited time known as the retention period. After that, the entries are deleted. If you want to keep your log entries longer, export them outside of Cloud Logging.

Question 9

Monitored resources

Answer 9

Each log entry indicates where it came from by including the name of a monitored resource

Question 10

Logging queries

Answer 10

An advanced query is a filter expression in the Logging query language. It is used in the Logs Viewer and the Logging API to select log entries, such as those from a particular VM instance or those arriving in a particular time period with a particular severity level.

Question 11

Logs router

Answer 11

The Logs Router checks each log entry against existing rules to determine which log entries to ingest (store), which log entries to include in exports, and which log entries to discard.

All logs, including audit logs, platform logs, and user logs, are sent to the Cloud Logging API where they pass through the Logs Router.

Question 12

Exporting logs using sinks

Answer 12

Log entries received by Logging can be exported to Cloud Storage buckets, BigQuery datasets, and Pub/Sub topics by configuring log sinks, which then continue to export log entries as they arrive in Logging. A sink includes a destination and a query that selects the log entries to export.

Question 13

Logs-based Metric

Answer 13

A logs-based metric is a metric whose value is the number of log entries that match a query that you specify.

Question 14

Audit logs

Answer 14

Google Cloud services write audit logs to record certain administrative or user actions on Google Cloud resources. Audit logs appear in the Logs Viewer alongside other logs.

Helps answer the questions of “who did what, where, and when?” within your Google Cloud resources.

Requires Cloud IAM role Logging/Logs Viewer or Project/Viewer.

Question 15

Access control for logs

Answer 15

The ability to access Logging logs is controlled by granting Cloud Identity and Access Management permissions to members.

IAM Viewer role - To read all logs
Cloud IAM Owner role - To read data access audit logs or access transparency logs

Question 16

Types of Audit logs

Answer 16

Cloud Audit Logs maintains three audit logs for each Google Cloud project, folder, and organization: Admin Activity, Data Access, and System Event.

Question 17

Admin activity audit logs

Answer 17

Contain log entries for API calls or other administrative actions that modify the configuration or metadata of resources. For example, these logs record when users create VM instances or change Cloud Identity and Access Management permissions.

Question 18

Data Access audit logs

Answer 18

Contain API calls that read the configuration or metadata of resources, as well as user-driven API calls that create, modify, or read user-provided resource data. Data

Data-access operations on publicly shared resources are not recorded.

Question 19

System Event audit logs

Answer 19

Contain log entries for Google Cloud administrative actions that modify the configuration of resources. System Event audit logs are generated by Google systems; they are not driven by direct user action.

Question 20

Uptime Checks

Answer 20

Cloud Monitoring can verify the availability of your service by accessing it from locations around the world. You can use the results from these uptime checks in your alerting policies, or you can directly monitor the results in the Monitoring uptime-check dashboards.