Logs explorer

Logsk8s_nodeNode pool logsk8s_containerWorkload container logsWhen GKE on AWS writes your cluster's logs, each log entry includesthe resource type. Understanding where logs appear makes it easier to find logswhen you need them.Control Plane logsControl plane logs use the k8s_control_plane_component resource type. Theseinclude logs from system components running on the control plane replicas, suchaskube-apiserver.Node logsNode logs fall under the k8s_node resource type. These include logs fromcritical system component running on the worker nodes, such askubeletand containerd.System apps logsSystem apps logs fall under the k8s_container resource type. These includelogs from pods installed on the worker nodes by GKE on AWS.Specifically, containers running in the following namespaces are included:kube-systemgke-connectgke-systemgmp-systemasm-user-authcnrm-systemconfig-management-systemgatekeeper-systemgmp-publicistio-systemknative-servingFind your logs in the Cloud Logging user interfaceYou can view your logs using theLogs Explorer in theCloud Logging user interface.Logs ExplorerUsing the Query Builder, you can build a query by adding query parametersmanually. For example, if you want to explore logs for system workloads, you canstart with selecting or searching for the k8s_container resource type, andthen select the location and cluster name. You can then refine your search byfiltering the container or Pod names.The Logs Explorer offers an additional way to build your search queriesusing the Logs field explorer. It shows the count of log entries, sorted bydecreasing count, for the given log field. Using the Logs field explorer isparticularly useful for GKE on AWS logs because it provides an easyway to select the Kubernetes values for your resources. For example, you canselect logs for a specific cluster, Namespace, Pod name, and container name.For more information, seeUsing the Logs Explorer.Sample queriesThis section includes sample queries that you can make on Logs Explorer.Example 1: Get the logs of kube-apiserver on control plane nodes for anAWS cluster CLUSTER_NAME:resource.type="k8s_control_plane_component"resource.labels.cluster_name="awsClusters/CLUSTER_NAME"resource.labels.component_name="apiserver"Example 2: Get the logs of kubelet on worker nodes for an AWScluster CLUSTER_NAME:resource.type="k8s_node"resource.labels.cluster_name="awsClusters/CLUSTER_NAME"log_name="projects/PROJECT_ID/logs/kubelet"Example 3: Get the logs of the

Stay organized with collections Save and categorize content based on your preferences. Cloud Scheduler publishes logs at the start of each execution and at the endof each execution. You can retrieve, view, and analyze the logs for a specificjob.To view logs, follow these steps:In the Google Cloud console, go to the Cloud Scheduler page.Go to Cloud SchedulerIn the row of the job that you want to view the logs for,click Actions >View logs.The Logs Explorer page opens and lets you display log entries,parse and analyze them, and specify query parameters.To learn more about viewing logs in Cloud Logging, seeView logs by using the Logs Explorer. Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates. Last updated 2025-03-05 UTC.

Logs you want to see.In Log name, select the audit log type that you want to see:For Admin Activity audit logs, select activity.For Data Access audit logs, select data_access.For System Event audit logs, select system_event.For Policy Denied audit logs, select policy.Click Run query.If you don't see these options, then there aren't any audit logs ofthat type available in the Google Cloud project, folder, ororganization.If you're experiencing issues when trying to view logs in theLogs Explorer, see thetroubleshootinginformation.For more information about querying by using the Logs Explorer, seeBuild queries in the Logs Explorer. gcloud The Google Cloud CLI provides a command-line interface to theLogging API. Supply a valid resource identifier in each of the lognames. For example, if your query includes a PROJECT_ID, then theproject identifier you supply must refer to the currently selectedGoogle Cloud project.To read your Google Cloud project-level audit log entries, runthe following command:gcloud logging read "logName : projects/PROJECT_ID/logs/cloudaudit.googleapis.com" \ --project=PROJECT_IDTo read your folder-level audit log entries, run the following command:gcloud logging read "logName : folders/FOLDER_ID/logs/cloudaudit.googleapis.com" \ --folder=FOLDER_IDTo read your organization-level audit log entries, run the followingcommand:gcloud logging read "logName : organizations/ORGANIZATION_ID/logs/cloudaudit.googleapis.com" \ --organization=ORGANIZATION_IDTo read your Cloud Billing account-level audit log entries, run the following command:gcloud logging read "logName : billingAccounts/BILLING_ACCOUNT_ID/logs/cloudaudit.googleapis.com" \ --billing-account=BILLING_ACCOUNT_IDAdd the --freshness flagto your command to read logs that are more than 1 day old.For more information about using the gcloud CLI, seegcloud logging read. REST When building your queries, supply a valid resource identifier in each ofthe log names. For example, if your query includes a PROJECT_ID,then the project identifier you supply must refer to the currently selectedGoogle Cloud project.For example, to use the Logging API to view your project-levelaudit log entries, do the following:Go to the Try this API section in the documentation for theentries.list method.Put the following into the Request body part