Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Dokumen ini menjelaskan cara menggunakan Cloud Audit Logs untuk Google Distributed Cloud (khusus software) di bare metal. Google Distributed Cloud menggunakan Kubernetes Audit Logging, yang menyimpan catatan kronologis panggilan yang dilakukan ke server Kubernetes API cluster. Log audit berguna untuk menyelidiki permintaan API yang mencurigakan dan untuk mengumpulkan statistik. Untuk mengetahui informasi tentang logging audit untuk
GKE On-Prem API, lihat Logging audit Cloud API.
Tentang Cloud Audit Logs
Log audit ditulis ke Cloud Audit Logs di project
Google Cloud Anda. Menulis ke Cloud Audit Logs memiliki beberapa manfaat dibandingkan menulis ke
disk atau merekam log dalam sistem logging lokal:
Log audit untuk semua cluster GKE dapat dipusatkan.
Entri log yang ditulis ke Cloud Audit Logs tidak dapat diubah.
Entri Cloud Audit Logs dipertahankan selama 400 hari.
Fitur Cloud Audit Logs disertakan dalam harga Google Distributed Cloud khusus software.
Anda dapat mengonfigurasi Google Distributed Cloud untuk menulis log ke disk atau ke
Cloud Audit Logs.
Logging audit berbasis disk
Jika Cloud Audit Logs dinonaktifkan secara eksplisit, log audit akan ditulis ke disk persisten sehingga memulai ulang dan mengupgrade cluster tidak akan menyebabkan log hilang.
Google Distributed Cloud hanya menyimpan hingga 1 GiB entri log audit.
Akses log audit berbasis disk dengan login ke Node bidang kontrol. Log berada di direktori /var/log/apiserver/.
Cloud Audit Logs
Entri log audit Aktivitas Admin dari semua server Kubernetes API dikirim ke
Google Cloud, menggunakan project dan lokasi yang Anda tentukan saat Anda
membuat cluster pengguna. Untuk melakukan buffering dan menulis entri log ke Cloud Audit Logs, Google Distributed Cloud men-deploy set daemon audit-proxy yang berjalan di node bidang kontrol.
Batasan
Di bare metal, Cloud Audit Logs memiliki batasan berikut:
Logging akses data tidak didukung.
Memodifikasi kebijakan audit Kubernetes tidak didukung.
Cloud Audit Logs tidak tahan terhadap pemadaman jaringan yang berkepanjangan. Jika entri log tidak dapat diekspor ke Google Cloud, entri tersebut akan di-cache dalam buffer disk 10 GiB. Jika buffer tersebut penuh, entri terlama akan
dihapus.
Satu project dapat mendukung hingga sekitar 1.000 akun layanan untuk digunakan dengan
Cloud Audit Logs. Beberapa cluster dapat menggunakan akun layanan yang sama.
Membuat akun layanan untuk Cloud Audit Logs
Sebelum dapat menggunakan Cloud Logging dan Cloud Monitoring dengan
Google Distributed Cloud software-only, Anda harus mengonfigurasi hal berikut terlebih dahulu:
Buat Ruang Kerja Cloud Monitoring dalam Google Cloud project, jika Anda
belum memilikinya.
Di konsol Google Cloud , klik tombol berikut dan ikuti alur kerja.
Klik Run query untuk menampilkan semua log audit dari cluster yang dikonfigurasi untuk login ke project ini.
gcloud
Mencantumkan dua entri log pertama di log Aktivitas Admin project Anda yang berlaku untuk jenis resource k8s_cluster:
gcloudloggingread\'logName="projects/PROJECT_ID/logs/externalaudit.googleapis.com%2Factivity" \ AND resource.type="k8s_cluster" \ AND protoPayload.serviceName="anthosgke.googleapis.com" '\--limit2\--freshness300d
Ganti PROJECT_ID dengan project ID Anda.
Output menampilkan dua entri log. Perhatikan bahwa untuk setiap entri log, kolom
logName memiliki nilai
projects/PROJECT_ID/logs/externalaudit.googleapis.com%2Factivity
dan protoPayload.serviceName sama dengan anthosgke.googleapis.com.
Kebijakan audit
Kebijakan audit Kubernetes menentukan aturan untuk peristiwa mana yang dicatat sebagai entri log dan menentukan data apa yang harus disertakan dalam entri log. Mengubah kebijakan ini untuk mengubah perilaku Cloud Audit Logs tidak didukung.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-14 UTC."],[],[],null,["This document describes how to use Cloud Audit Logs for Google Distributed Cloud\n(software only) on bare metal. Google Distributed Cloud uses [Kubernetes Audit\nLogging](https://kubernetes.io/docs/tasks/debug-application-cluster/audit/),\nwhich keeps a chronological record of calls made to a cluster Kubernetes API\nserver. Audit logs are useful for investigating suspicious API requests and for\ncollecting statistics. For information about audit logging for the\nGKE On-Prem API, see [Cloud API audit\nlogging](/kubernetes-engine/distributed-cloud/bare-metal/docs/how-to/audit-logging-api).\n| **Note:** Starting with Google Distributed Cloud release 1.9.0, Cloud Audit Logs is enabled by default. Cloud Audit Logs is automatically enabled for 1.8.x clusters that are upgraded to 1.32.400-gke.68 unless it was explicitly disabled for the 1.8.x cluster by setting `disableCloudAuditLogging` to `true`.\n\nAbout Cloud Audit Logs\n\nAudit logs are written to [Cloud Audit Logs](/logging/docs/audit) in your\nGoogle Cloud project. Writing to Cloud Audit Logs has several benefits over writing to\ndisk or capturing logs in an on-premises logging system:\n\n- Audit logs for all GKE clusters can be centralized.\n- Log entries written to Cloud Audit Logs are immutable.\n- Cloud Audit Logs entries are retained for 400 days.\n- Cloud Audit Logs feature is included in the price of Google Distributed Cloud software-only.\n- You can configure Google Distributed Cloud to write logs to disk or to Cloud Audit Logs.\n\nDisk-based audit logging\n\nIf Cloud Audit Logs is disabled explicitly, audit logs are written to a persistent\ndisk so that cluster restarts and upgrades don't cause the logs to disappear.\nGoogle Distributed Cloud software-only retains up to 1 GiB of audit log\nentries.\n\nAccess the disk-based audit logs by logging into control plane Nodes. The logs\nare located in the `/var/log/apiserver/` directory.\n\nCloud Audit Logs\n\nAdmin Activity audit log entries from all Kubernetes API servers are sent to\nGoogle Cloud, using the project and location that you specify when you\ncreate a user cluster. To buffer and write log entries to Cloud Audit Logs,\nGoogle Distributed Cloud deploys an `audit-proxy` daemon set that runs on the control\nplane nodes.\n\nLimitations\n\nOn bare metal, Cloud Audit Logs has the following limitations:\n\n- Data access logging isn't supported.\n- Modifying the Kubernetes audit policy is not supported.\n- Cloud Audit Logs isn't resilient to extended network outages. If the log entries can't be exported to Google Cloud, they are cached in a 10 GiB disk buffer. If that buffer fills, then the oldest entries are dropped.\n - One project can support up to approximately 1000 service accounts for use with Cloud Audit Logs. Multiple clusters can use the same service account.\n\nCreating a service account for Cloud Audit Logs\n\nBefore you can use Cloud Logging and Cloud Monitoring with\nGoogle Distributed Cloud software-only, you must first configure the following:\n\n1. Create a Cloud Monitoring Workspace within the Google Cloud project, if you\n don't have one already.\n\n In the Google Cloud console, click the following button and follow the\n workflow.\n\n [Go to Monitoring](https://console.cloud.google.com/monitoring)\n2. Click the following buttons to enable the required APIs:\n\n [Enable the Anthos Audit API](https://console.cloud.google.com/apis/library/anthosaudit.googleapis.com)\n\n [Enable the Stackdriver API](https://console.cloud.google.com/apis/library/stackdriver.googleapis.com)\n\n [Enable the Monitoring API](https://console.cloud.google.com/apis/library/monitoring.googleapis.com)\n\n [Enable the Logging API](https://console.cloud.google.com/apis/library/logging.googleapis.com)\n3. Assign the following IAM roles to the service account used by\n the Stackdriver agents:\n\n - `logging.logWriter`\n - `monitoring.metricWriter`\n - `stackdriver.resourceMetadata.writer`\n - `monitoring.dashboardEditor`\n\n| **Warning:** before deleting this service account, be sure to replace it with the new service account in the cluster configuration first! See [Rotate service\n| account keys](/kubernetes-engine/distributed-cloud/bare-metal/docs/how-to/update-secrets). If you forget to do this, follow [the guide to clean\n| up](/kubernetes-engine/distributed-cloud/bare-metal/docs/troubleshooting/observability#sa-leakage).\n\nAccessing Cloud Audit Logs \n\nConsole\n\n1. In the Google Cloud console, go to the **Logs Explorer** page in the\n **Logging** menu.\n\n [Go to the Logs Explorer](https://console.cloud.google.com/logs/query)\n\n If the **Legacy Logs Viewer** page opens, choose **Upgrade to the new\n Logs Explorer** from the **Upgrade** drop-down menu.\n2. Click **Query** to access the field for submitting queries.\n\n3. Fill the field with the following query:\n\n resource.type=\"k8s_cluster\"\n logName=\"projects/\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e/logs/externalaudit.googleapis.com%2Factivity\"\n protoPayload.serviceName=\"anthosgke.googleapis.com\"\n\n Replace \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e with your project ID.\n4. Click **Run query** to display all audit logs from clusters that were\n configured to sign in to this project.\n\ngcloud\n\nList the first two log entries in your project's Admin Activity log that\napply to the `k8s_cluster` resource type: \n\n gcloud logging read \\\n 'logName=\"projects/\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e/logs/externalaudit.googleapis.com%2Factivity\" \\\n AND resource.type=\"k8s_cluster\" \\\n AND protoPayload.serviceName=\"anthosgke.googleapis.com\" ' \\\n --limit 2 \\\n --freshness 300d\n\nReplace \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e with your project ID.\n\nThe output shows two log entries. Notice that for each log entry, the\n`logName` field has the value\n`projects/`\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e`/logs/externalaudit.googleapis.com%2Factivity`\nand `protoPayload.serviceName` is equal to `anthosgke.googleapis.com`.\n\nAudit policy\n\nThe Kubernetes audit policy defines rules for which events are recorded as log\nentries and specifies what data the log entries should include. Changing this\npolicy to modify Cloud Audit Logs behavior isn't supported."]]
