Problem
A Google Compute Engine VM instance has been deleted but logs can still be seen up to 24 hours after deletion.
Environment
- Google Compute Engine
- Google Cloud Logging
Solution
This is an intended behavior. See Cause below.
Cause
It is possible that the internal clock of the machine has been changed thus producing logs with some drift.
In the definition of receiveTimestamp in our LogEntry documentation it indicates the following:
Incoming log entries must have timestamps that don't exceed the logs retention period in the past, and that don't exceed 24 hours in the future. Log entries outside those time boundaries aren't ingested by Logging.
Tweaking the VM's clock forward would cause the receiveTimestamp to appear to be smaller than timestamp as it is received by Cloud Logging but the log entry will not be shown until the real world clock ticks to that time.