[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-05 (世界標準時間)。"],[],[],null,["# Using Cloud Monitoring with Cloud KMS\n\n[Cloud Monitoring](/monitoring) can be used to monitor operations performed on\nresources in Cloud Key Management Service.\n\nThis topic provides:\n\n- an example for monitoring when a key version is scheduled for destruction\n- information about monitoring other Cloud KMS resources and operations\n\nBefore you begin\n----------------\n\nIf you haven't already done so,\nset up a Google Cloud project that has the Cloud Key Management Service API enabled.\nThese steps are documented in the [Cloud KMS Quickstart](/kms/docs/create-encryption-keys#before-you-begin).\n\nCreate a counter metric\n-----------------------\n\nUse the [`gcloud logging metrics create`](/sdk/gcloud/reference/logging/metrics/create) command to create a counter metric\nthat will monitor any occurrence of the scheduled destruction of a key version. \n\n```\ngcloud logging metrics create key_version_destruction \\\n --description \"Key version scheduled for destruction\" \\\n --log-filter \"resource.type=cloudkms_cryptokeyversion \\\n AND protoPayload.methodName=DestroyCryptoKeyVersion\"\n```\n\nYou can list your counter metrics using the [`gcloud logging metrics list`](/monitoring/alerts)\ncommand: \n\n```\ngcloud logging metrics list\n```\n\nFor more information about creating a counter metric, including via the\nGoogle Cloud console and the Monitoring API, see\n[Creating a counter metric](/logging/docs/logs-based-metrics/counter-metrics#creating_a_counter_metric).\n\nCreate an alerting policy\n-------------------------\n\nYou can create alerting policies to monitor the values of metrics and to notify you when\nthose metrics violate a condition.\n\n1. In the Google Cloud console, go to the\n *notifications* **Alerting** page:\n\n [Go to **Alerting**](https://console.cloud.google.com/monitoring/alerting)\n\n \u003cbr /\u003e\n\n If you use the search bar to find this page, then select the result whose subheading is\n **Monitoring**.\n2. If you haven't created your notification channels and if you want to be notified, then click **Edit Notification Channels** and add your notification channels. Return to the **Alerting** page after you add your channels.\n3. From the **Alerting** page, select **Create policy**.\n4. To select the metric, expand the **Select a metric** menu and then do the following:\n 1. To limit the menu to relevant entries, enter `key_version` into the filter bar. If there are no results after you filter the menu, then disable the **Show only active resources \\& metrics** toggle.\n 2. For the **Resource type** , select **Global**.\n 3. For the **Metric category** , select **Logs-Based Metric**.\n 4. For the **Metric** , select **logging/user/key_version_destruction**.\n 5. Select **Apply**.\n5. Click **Next**.\n6. The settings in the **Configure alert trigger** page determine when the alert is triggered. Complete this page with the settings in the following table. \n\n7. Click **Next**.\n8. Optional: To add notifications to your alerting policy, click **Notification channels** . In the dialog, select one or more notification channels from the menu, and then click **OK**.\n9. Optional: Update the **Incident autoclose duration**. This field determines when Monitoring closes incidents in the absence of metric data.\n10. Optional: Click **Documentation**, and then add any information that you want included in a notification message.\n11. Click **Alert name** and enter a name for the alerting policy.\n12. Click **Create Policy**.\n\nFor more information, see [Alerting overview](/monitoring/alerts).\n\nTo test your new notification, [schedule a key version for destruction](/kms/docs/destroy-restore#schedule_a_key_version_for_destruction_destroy_a_key_version) and\nthen check your email to see if the notification was sent.\n\nThis alert will be triggered each time a key version has been scheduled for\ndestruction. Note that the alert will get automatically resolved (even though\nthe key version remains scheduled for destruction), so there will be two email\nnotifications, one for the scheduled destruction, and one for the alert being\nresolved.\n\nFor more information about alert policies, see [Introduction to alerting](/monitoring/alerts). To\nlearn how to turn on, turn off, edit, copy, or delete an alert policy, see\n[Managing policies](/monitoring/alerts/using-alerting-ui#managing_policies).\n\nFor information about different types of notifications, see\n[Notification options](/monitoring/support/notification-options).\n| **Note:** If you only wanted to test a notification for scheduling destruction of a key version, but you do not want it actually destroyed, [restore the key\n| version](/kms/docs/destroy-restore#restore_a_key_version) that you scheduled for destruction.\n\nMonitoring administrative activities vs. data access\n----------------------------------------------------\n\nThe scheduled destruction of a key version is an *administrator activity* .\nAdministrator activities are logged automatically. If you want to create an\nalert for *data access* of a Cloud KMS resource, e.g. monitoring\nwhen a key is used for encryption, you need to [enable Data Access logs](/kms/docs/logging#enabling_data_access_logs) and\nthen create an alert policy as described in this topic.\n\nFor more information about logging of Cloud KMS administrative\nactivities and data access, see [Using Cloud Audit Logs with\nCloud KMS](/kms/docs/logging).\n\nRate quota metrics\n------------------\n\nCloud KMS supports the following rate quota metrics:\n\n- `cloudkms.googleapis.com/crypto_requests`\n- `cloudkms.googleapis.com/external_kms_requests`\n- `cloudkms.googleapis.com/hsm_asymmetric_requests`\n- `cloudkms.googleapis.com/hsm_symmetric_requests`\n- `cloudkms.googleapis.com/read_requests`\n- `cloudkms.googleapis.com/write_requests`\n\nFor information about monitoring these quotas using Cloud Monitoring, see\n[Set up quota alerts and monitoring](/docs/quotas/set-up-quota-alerts).\n\nWhat's next\n-----------\n\n- [Monitor your external key manager usage](/kms/docs/monitor-ekm-usage)."]]
