Container-Optimized OS 包含一个 Logging 代理，用于将某些系统和容器日志导出到 Cloud Logging。在 Container-Optimized OS 101 之前，基于 x86 的 Container-Optimized OS 映像使用基于 fluentd 的容器化日志记录代理。Container-Optimized OS 105 开始提供备选日志记录代理实现 fluent-bit。从 Container-Optimized OS 109 开始，fluent-bit 日志记录代理是默认的。旧版日志记录代理 fluentd 将在 Container-Optimized OS 113 中移除。
所有版本的基于 Arm 的 Container-Optimized OS 映像都附带 fluent-bit 日志记录代理。
启用日志记录代理
Logging 代理默认处于停用状态。您可以在创建新实例或更新现有实例时启用此功能。
访问权限要求
Cloud Logging 提供了可用于授予适当访问权限的 IAM 角色。如需在项目中查看日志，您必须拥有 roles/logging.viewer 角色，并且应用必须有权写入日志。您可以通过将 IAM 角色 roles/logging.logWriter 分配给应用的服务账号来授予此权限。
基于 x86 的 Container-Optimized OS 105 和 109 映像提供两个日志记录代理实现：fluentd（旧版）和 fluent-bit。Container-Optimized OS 105 默认使用 fluentd，Container-Optimized OS 109 默认使用 fluent-bit。您可以使用 google-logging-use-fluentbit 元数据条目更改默认行为。
如需在 Container-Optimized OS 105 上使用 fluent-bit 日志记录代理，请将 google-logging-use-fluentbit 值设置为 true。
如需在 Container-Optimized OS 109 上使用 fluentd 日志记录代理，请将 google-logging-use-fluentbit 值设置为 false。
解决方法是不使用 gcplogs 作为 Docker 日志记录驱动程序，而是使用 Container-Optimized OS 配置的默认驱动程序。请注意，Container-Optimized OS 附带的 Logging 代理会将容器日志导出到 Cloud Logging，因此不需要同时使用这两种解决方案。
Logging 代理配置兼容性
日志记录代理是基于 x86 的 Container-Optimized OS 映像上的基于 fluentd 的容器，是基于 Arm 的 Container-Optimized OS 映像上的 fluent-bit 二进制文件。这两个代理的配置不兼容。如果您仅依赖于操作系统映像中内置的默认日志记录配置，则这不是一个问题。不过，如果您使用自定义日志记录配置，则在将工作负载迁移到基于其他架构的映像或较新版本的 Container-Optimized OS 时，可能会遇到问题。
参考
Google Cloud Observability 的旧版 Logging 代理文档。Container-Optimized OS 附带的容器化日志记录代理是旧版 Logging 代理的一部分，因此本文档可能会在 Container-Optimized OS 的范围之外更广泛地提供有关该代理的背景信息。
Google Cloud Observability 文档。Google Cloud Observability 文档首页；可能对了解背景信息有用。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-04。"],[[["\u003cp\u003eContainer-Optimized OS uses a logging agent to export system and container logs to Cloud Logging, with fluent-bit being the default agent as of version 109.\u003c/p\u003e\n"],["\u003cp\u003eThe logging agent is disabled by default, but can be enabled during instance creation or by updating an existing instance, using the \u003ccode\u003egoogle-logging-enabled\u003c/code\u003e metadata key.\u003c/p\u003e\n"],["\u003cp\u003eTo use the logging agent outside of Google Kubernetes Engine, you must have the \u003ccode\u003eroles/logging.viewer\u003c/code\u003e role to view logs and grant applications the \u003ccode\u003eroles/logging.logWriter\u003c/code\u003e role to write logs.\u003c/p\u003e\n"],["\u003cp\u003ex86-based Container-Optimized OS versions 105 and 109 offer a choice between the fluentd and fluent-bit logging agents, controllable via the \u003ccode\u003egoogle-logging-use-fluentbit\u003c/code\u003e metadata entry.\u003c/p\u003e\n"],["\u003cp\u003eStarting with milestone 89, avoid using the Docker \u003ccode\u003egcplogs\u003c/code\u003e logging driver with the included logging agent to prevent excessive warning logs and increased Cloud Logging charges, as the built-in agent already handles container log exporting.\u003c/p\u003e\n"]]],[],null,["# Using Cloud Logging with Container-Optimized OS\n\nContainer-Optimized OS includes a logging agent which exports some\nsystem and container logs to Cloud Logging. Up until\nContainer-Optimized OS 101, x86-based Container-Optimized OS images used\na containerized logging agent based on fluentd. Container-Optimized OS 105\nstarted shipping an alternative logging agent implementation, fluent-bit.\nAs of Container-Optimized OS 109, the fluent-bit logging agent is the default.\nThe legacy logging agent, fluentd, will be removed in\nContainer-Optimized OS 113.\n\nAll versions of Arm-based Container-Optimized OS images ship the fluent-bit\nlogging agent.\n| **Note:** Logging is automatically available when you choose Container-Optimized OS as the node image for running your Google Kubernetes Engine clusters. These instructions are for when you are using Container-Optimized OS outside of GKE, such as in Compute Engine.\n\nEnable the logging agent\n------------------------\n\nThe logging agent is disabled by default. You can enable this feature when\ncreating a new instance or by updating an existing instance.\n\n### Access Requirements\n\nCloud Logging provides IAM\n[roles](/logging/docs/access-control#permissions_and_roles)\nthat you can use to grant appropriate access. In order to view your logs in a project,\nyou must have the `roles/logging.viewer` role and applications must have permission\nto write logs. You can grant this permission by assigning the\nIAM role `roles/logging.logWriter` to the service account for an\napplication.\n\nFor more information about permissions and roles, see\n[Predefined roles](/logging/docs/access-control#permissions_and_roles).\n\n### Create an instance with a logging agent enabled\n\n### Console\n\nTo run a Compute Engine instance on Container-Optimized OS with the fluent-bit logging\nagent enabled, perform the following:\n\n1. Open the Compute Engine instance creation page on Google Cloud console.\n\n [Create a new Compute Engine instance](https://console.cloud.google.com/compute/instancesAdd)\n2. Specify a **Name** for your instance.\n\n3. In the **Boot disk** section, select a Container-Optimized OS image.\n\n4. Click on **Management, security, disks, networking, sole tenancy** to\n expand additional options.\n\n5. Under the **Management** tab, scroll to the **Metadata** section. Add a\n new metadata entry, with **Key** as `google-logging-enabled` and **Value**\n as `true`.\n\n6. Optionally, specify any other options for your use case. See\n [Creating and configuring instances](/container-optimized-os/docs/how-to/create-configure-instance)\n for more details.\n\n7. Click **Create** to create and boot the instance.\n\n### gcloud\n\nTo run a Compute Engine instance on Container-Optimized OS with the logging\nagent enabled, use the `gcloud compute instances create` command, and include\n`google-logging-enabled=true` in the metadata. For example: \n\n```\ngcloud compute instances create instance-name \\\n --image image-name \\\n --image-project cos-cloud \\\n --zone compute-zone \\\n --metadata google-logging-enabled=true\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003einstance-name\u003c/var\u003e: the name of your VM instance.\n- \u003cvar translate=\"no\"\u003eimage-name\u003c/var\u003e: the name of the Container-Optimized OS image for the instance. For example, `--image=cos-113-18244-85-29`.\n- \u003cvar translate=\"no\"\u003ecompute-zone\u003c/var\u003e: the [compute zone](/compute/docs/regions-zones#available) for your instance.\n\nFor more information on the `gcloud` command, see the\n[gcloud compute instances create](/sdk/gcloud/reference/compute/instances/create)\nreference documentation.\nFor more details on creating Container-Optimized OS instances, see\n[Creating and configuring instances](/container-optimized-os/docs/how-to/create-configure-instance).\n\n### Selecting the logging agent\n\nx86-based Container-Optimized OS 105 and 109 images ship two implementations\nof the logging agent: fluentd (legacy) and fluent-bit.\nContainer-Optimized OS 105 uses fluentd by default and\nContainer-Optimized OS 109 uses fluent-bit by default. You can use the `google-logging-use-fluentbit`\nmetadata entry to change the default behavior.\n\nTo use fluent-bit logging agent on Container-Optimized OS 105 set\n`google-logging-use-fluentbit` value to `true`.\n\nTo use fluentd logging agent on Container-Optimized OS 109 set\n`google-logging-use-fluentbit` value to `false`.\n\n### Enable the logging agent in project metadata\n\nStarting in [milestone 97](/container-optimized-os/docs/release-notes/m97),\nlogging can be enabled in project metadata: \n\n gcloud compute project-info add-metadata \\\n --metadata google-logging-enabled=true\n\n| **Note:** Metadata flags defined at instance level takes precedence over metadata flags defined at project level.\n\nAccess logs\n-----------\n\n### Console\n\n1. Go to the VM instances page.\n\n [Go to the VM instances page](https://console.cloud.google.com/compute/instances)\n2. Click on the name of the Container-Optimized OS instance you want to access\n logs from.\n\n3. Under the **Logs** section, click Cloud Logging.\n\n4. This opens the Logs Explorer for the given instance. For more information,\n see [Using the Logs Explorer](/logging/docs/view/logs-explorer-interface).\n\n| **Note:** In the query builder, you can filter by log name. Click on **Log name** , and select the given log name. For example, **cos_audit** for Audit logs or **cos_containers** for docker container logs.\n\n### gcloud\n\nTo access logs, use the `gcloud logging read` command. For example: \n\n```\ngcloud logging read \\\n\"resource.type=gce_instance AND resource.labels.instance_id=instance-id\" \\\n --limit 10 \\\n --format json \\\n --freshness 30d\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003einstance-id\u003c/var\u003e: the id of your VM instance.\n\nThis command attempts to read logs from the VM instance with\n\u003cvar translate=\"no\"\u003einstance-id\u003c/var\u003e, limiting to 10 logs, in JSON format, from the last 30\ndays.\n\nFor more information on the `gcloud` command, see the\n[gcloud logging read](/sdk/gcloud/reference/logging/read) reference\ndocumentation.\n\nHow does it work?\n-----------------\n\nThe logging agent is configured by default to send logs from certain system\ncritical services and user application containers to the Cloud Logging\nbackend. For example, logs from docker containers, selected systemd services,\naudit logs, journal log errors, etc. See Container-Optimized OS specific\nconfiguration source ([x86 images](https://cos.googlesource.com/cos/overlays/board-overlays/+/refs/heads/main-R105/project-lakitu/app-admin/stackdriver/files/logging_configs/fluentd-lakitu.conf) and [Arm images](https://cos.googlesource.com/cos/overlays/board-overlays/+/refs/heads/main-R105/project-lakitu/app-admin/fluent-bit/files/fluent-bit.conf))\nfor complete default logging configuration.\n\nFor x86 images of Container-Optimized OS 105 and older, the logging agent is\nGoogle Cloud Observability's containerized legacy Logging agent. The docker command that\nstarts the logging agent is defined in the Container-Optimized OS\n[source for stackdriver-logging systemd service](https://cos.googlesource.com/cos/overlays/board-overlays/+/refs/heads/main-R105/project-lakitu/app-admin/stackdriver/files/stackdriver-logging.service).\nThe version of the containerized agent being run is defined in the Container-Optimized OS\n[source app-admin/stackdriver directory](https://cos.googlesource.com/cos/overlays/board-overlays/+/refs/heads/main-R105/project-lakitu/app-admin/stackdriver/files/env_vars).\n\nFor Arm images of all versions and x86 images for Container-Optimized OS 109 and\nlater, the logging agent is a built-in OS package called\n[fluent-bit](https://cos.googlesource.com/cos/overlays/board-overlays/+/refs/heads/master/project-lakitu/app-admin/fluent-bit).\nThe agent is built into the OS and updated along with the OS images.\n\nKnown Limitations\n-----------------\n\n### Compatibility with `gcplogs` driver\n\nStarting with\n[milestone 89](/container-optimized-os/docs/release-notes#release_schedule),\nif the logging agent included with Container-Optimized OS is enabled and Docker\n`gcplogs` logging driver is enabled for one or more containers, excessive\nwarning logs may be output by the included logging agent. This may create log\nnoise and/or increase Cloud Logging related charges.\n\nA workaround is to not use `gcplogs` as a Docker logging driver, and to\ninstead use the default driver as configured by Container-Optimized OS. Note\nthat the logging agent included with Container-Optimized OS will export\ncontainer logs to Cloud Logging, so using both solutions simultaneously is\nnot necessary.\n\n### Logging agent configuration compatibility\n\nThe logging agent is a fluentd-based container on x86-based\nContainer-Optimized OS images and a fluent-bit binary on Arm-based\nContainer-Optimized OS images. The configurations of the two agents are not\ncompatible. This is not a problem if you only rely on the default logging\nconfiguration built into the OS images. However, if you have a\ncustom logging configuration, you might experience breakage when migrating\nworkloads to images that are based on a different architecture or to a\nnewer version of Container-Optimized OS.\n\nReferences\n----------\n\n- Google Cloud Observability's legacy Logging agent [documentation](/logging/docs/agent/logging). The containerized logging agent included with Container-Optimized OS is a subset of the legacy Logging agent, so this documentation may provide context on the agent more generally, outside of the scope of Container-Optimized OS.\n- Google Cloud Observability [documentation](/products/operations). Homepage for Google Cloud Observability documentation; may be useful for context."]]
