인증서 관리자는 Cloud Logging을 사용하여 로그를 캡처하고 저장합니다. 인증서 관리자 로깅은 항상 사용 설정되어 있으며, 인증서 만료와 관련된 최소한의 정보만 캡처합니다. 인증서 관리자 모니터링 리소스 유형은 certificatemanager.googleapis.com/Project입니다.
Cloud Logging을 사용하여 인증서 관리자 로그를 캡처하고 검색할 수도 있습니다. 이 로깅 메커니즘을 구성하는 방법은 Cloud Logging 클라이언트 라이브러리 문서를 참조하세요.
로그 알림 구성
Certificate Manager가 Cloud Logging에 쓰는 이벤트(예: 인증서 만료)에 대한 알림을 구성할 수 있습니다. 자세한 내용은 로그 기반 알림 구성을 참고하세요.
예를 들어 만료된 인증서에 대한 알림을 구성하려면 다음을 알림 쿼리로 사용합니다.
logName = "projects/PROJECT_ID/logs/certificatemanager.googleapis.com%2Fcertificates_expiry" AND jsonPayload.state = "EXPIRED"
만료일이 가까운 인증서에 대한 알림을 구성하려면 다음을 알림 쿼리로 사용하세요.
logName = "projects/PROJECT_ID/logs/certificatemanager.googleapis.com%2Fcertificates_expiry" AND jsonPayload.state = "CLOSE_TO_EXPIRY"
PROJECT_ID를 대상 Google Cloud 프로젝트의 ID로 바꿉니다.
Google 관리형 인증서의 경우 인증서 수명 및 갱신 프로세스에 따라 만료일로부터 5~10일 전에 CLOSE_TO_EXPIRY 로그가 매일 생성됩니다. 자체 관리형 인증서의 경우에도 만료일 10일 전부터 매일 CLOSE_TO_EXPIRY 로그가 생성됩니다.
측정항목
이 섹션에는 인증서 관리자에서 지원하는 측정항목이 나와 있습니다.
인증서 관리자 측정항목을 보려면 Google Cloud 콘솔에서 측정항목 탐색기를 사용합니다.
표준 측정항목
인증서 관리자는 다음과 같은 표준 Cloud Monitoring API 측정항목을 작성합니다.
측정항목
설명
serviceruntime.googleapis.com/api/request_count
종류: Delta
유형: INT64
단위: 1
완료된 요청의 누적 수입니다. 다음 라벨이 적용됩니다.
protocol은 요청의 프로토콜을 나타냅니다(예: http 또는 grpc).
response_code는 HTTP/gRPC 요청의 HTTP(또는 gRPC 상응) 응답 코드입니다.
코드 목록을 참고하세요.
response_code_class `200` 또는 `400`과 같은 응답 코드의 클래스(또는 gRPC 상응)입니다.
grpc_status_code는 gRPC 응답 코드 또는 이에 상응하는 HTTP 코드입니다.
코드 목록을 참고하세요.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2024-12-21(UTC)"],[[["\u003cp\u003eCertificate Manager utilizes Cloud Logging to record operational data, primarily focusing on certificate expiration, which is always enabled, capturing minimal information.\u003c/p\u003e\n"],["\u003cp\u003eYou can access and review Certificate Manager logs through the Logs Explorer in the Google Cloud console and filter logs based on specific events, such as certificate expiration or close to expiration.\u003c/p\u003e\n"],["\u003cp\u003eAlerts for certificate events, including expiration or approaching expiration, can be configured in Cloud Logging by specifying query conditions using the log name and certificate state within a specific project.\u003c/p\u003e\n"],["\u003cp\u003eCertificate Manager provides standard Cloud Monitoring API metrics, such as request counts, latencies, and sizes, along with custom metrics like the number of certificates and map entries provisioned in a project.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003eCLOSE_TO_EXPIRY\u003c/code\u003e log event is generated daily for both Google-managed and self-managed certificates starting 5-10 days and 10 days before expiration respectively, allowing for proactive management.\u003c/p\u003e\n"]]],[],null,["# Logs and metrics\n\nThis page explains how Certificate Manager logs various types of\ninformation about its operation and how to view that information.\n\nLogs\n----\n\nTo view Certificate Manager logs, use the\n[Logs Explorer](https://console.cloud.google.com/logs) in the Google Cloud console.\n\nCertificate Manager provides Google Cloud logs described in\n[Google Cloud logs](/logging/docs/api/platform-logs#certificate_manager).\n\nCertificate Manager uses Cloud Logging to capture and\nstore logs. Certificate Manager logging is always enabled and\nonly captures a minimal amount of information specifically related to\ncertificate expiration. The Certificate Manager monitored resource type\nis `certificatemanager.googleapis.com/Project`.\n\nYou can also capture and retrieve Certificate Manager logs using\nCloud Logging. See the documentation for\n[Cloud Logging client libraries](/logging/docs/reference/libraries)\nfor information on how to configure this logging mechanism.\n\n### Configure log alerts\n\nYou can configure alerts for events that Certificate Manager writes to\nCloud Logging, such as certificate expiration. For instructions, see\n[Configure log-based alerts](/logging/docs/alerting/log-based-alerts).\n\nFor example, to configure an alert for certificates that have expired, use the following as the alert query: \n\n```\nlogName = \"projects/PROJECT_ID/logs/certificatemanager.googleapis.com%2Fcertificates_expiry\" AND jsonPayload.state = \"EXPIRED\"\n```\n\nIf you want to configure an alert for certificates that are close to expiration, use the following as the alert query: \n\n```\nlogName = \"projects/PROJECT_ID/logs/certificatemanager.googleapis.com%2Fcertificates_expiry\" AND jsonPayload.state = \"CLOSE_TO_EXPIRY\"\n```\n\nReplace \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e with the ID of the target Google Cloud project.\n\nFor Google-managed certificates `CLOSE_TO_EXPIRY` logs are generated daily, starting 5-10 days before\nexpiration, depending on the certificate's lifetime and renewal process. For self-managed\ncertificates too, `CLOSE_TO_EXPIRY` logs are generated daily, starting 10 days before expiration.\n\nMetrics\n-------\n\nThis section lists the metrics supported by Certificate Manager.\nTo view Certificate Manager metrics, use the\n[Metrics Explorer](https://console.cloud.google.com/monitoring/metrics-explorer) in the\nGoogle Cloud console.\n\n### Standard metrics\n\nCertificate Manager writes the following standard\nCloud Monitoring API metrics:\n\n### Custom metrics\n\nAdditionally, Certificate Manager writes the following custom\nmetrics using the Cloud Monitoring API:\n\nWhat's next\n-----------\n\n- [Deploy a Google-managed certificate with DNS authorization (tutorial)](/certificate-manager/docs/deploy-google-managed-dns-auth)\n- [Deploy a Google-managed certificate with load balancer authorization (tutorial)](/certificate-manager/docs/deploy-google-managed-lb-auth)\n- [Deploy a Google-managed certificate with CA Service (tutorial)](/certificate-manager/docs/deploy-google-managed-cas)\n- [Deploy a self-managed certificate (tutorial)](/certificate-manager/docs/deploy-self-managed)\n- [Migrate a certificate to Certificate Manager](/certificate-manager/docs/migrate)\n- [Manage certificates](/certificate-manager/docs/certificates)\n- [Manage certificate maps](/certificate-manager/docs/maps)\n- [Manage certificate map entries](/certificate-manager/docs/map-entries)\n- [Manage DNS authorizations](/certificate-manager/docs/dns-authorizations)"]]
