This page provides supplemental information for using Cloud Audit Logs with AI Platform. Use Cloud Audit Logs to generate logs for API operations performed in AI Platform.
Audit logs are not the same as job logs. Job logs provide debugging information for training and prediction jobs. Audit logs help you determine who did what, where, and when. Specifically, audit logs track how your AI Platform resources are modified and accessed within your Google Cloud Platform projects for auditing purposes. For more information about Cloud Audit Logs general concepts and how-to guides, see Cloud Audit Logs.
Cloud Audit Logs includes the following types of logs:
Admin Activity logs: Contains log entries for operations that modify the configuration or metadata of a AI Platform resource. Admin Activity logs include any API call that creates, deletes, updates or modifies a resource using a custom verb.
Data Access logs: Contains log entries for operations that perform read-only operations that do not modify any data, such as get and list. Unlike audit logs for other services, AI Platform only has
ADMIN_READData Access logs and does not generally offer
DATA_WRITElogs. This is because
DATA_WRITElogs are only used for services that store and manage user data such as Cloud Storage, Cloud Spanner, and Cloud SQL, which does not apply to AI Platform.
The following table summarizes which AI Platform operations fall into each log type:
|Log entry type||Sub-type||Operations|
AI Platform logs use an
object and follows the same format as other Cloud Audit Logs logs. Logs contain
information such as:
- The user who made the request, including the email address of that user.
- The resource name on which the request was made.
- The outcome of the request.
Admin Activity logs are recorded by default. These logs do not count towards your log ingestion quota.
Data Access logs are not recorded by default. These logs count towards your log ingestion quota. To learn how to enable logs for data access-type operations, see Configuring Data Access Logs.
The following users can view Admin Activity logs:
- Project owners, editors, and viewers.
- Users with the Logs Viewer IAM role.
- Users with the
The following users can view Data Access logs:
- Project owners.
- Users with the Private Logs Viewer IAM role.
- Users with the
For instructions on granting access, see Adding IAM members to a project.
The Logs Viewer basic viewing interface allows you to select and retrieve audit logs for specific projects. You can also use the Logs Viewer advanced filter interface to specify the resource type and log name. For more information, see Retrieving audit logs.
Exporting your logs
You can export copies of some or all of your logs to other applications, other repositories, or third parties. To export your logs, see Exporting logs.
- Read up on Stackdriver Logging.