Stay organized with collections
Save and categorize content based on your preferences.
This page explains how to enable network policy logging in a Google Distributed Cloud
user cluster and how to export logs. See Using network policy
logging to learn how to configure which events are logged and how logs are formatted.
Overview
Network
polices
are Pod-level firewalls; they specify network traffic that Pods are allowed to
send and receive. Network policy logs record network policy events. You can
log all events or you can configure logging
selectively
based on the following criteria:
Allowed connections.
Denied connections.
Connections allowed by specific policies.
Denied connections to Pods in specific namespaces.
Before you begin
Network policy logging is supported in user clusters that use
Dataplane V2. You can enable
Dataplane V2 when creating a new user cluster by using the
enableDataplaneV2
field in the user cluster configuration file.
Enabling logging
Network policy logging is not enabled by default. For information on enabling
logging and selecting which events to log, see Configuring network policy
logging.
Accessing logs
The network policy logs generated on each cluster node are available locally on
the cluster nodes at
/var/log/network/policy_actiontimestamp.log. A new
timestamped log file is created when the current log file reaches 10 MB. Up to
five previous log files are stored.
Exporting logs
We recommend you use Fluent Bit to export
logs from your cluster nodes. Fluent Bit is an open source log processor
and forwarder that supports exporting to
Cloud Logging and many other data
sinks.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-03-05 UTC."],[[["Network policy logs record events related to network traffic allowed or denied by Pod-level firewalls, also known as network policies."],["Logging can be enabled to capture all network policy events or selectively configured based on allowed connections, denied connections, connections allowed by specific policies, or denied connections to specific namespaces."],["Network policy logging requires user clusters to use Dataplane V2, which can be enabled during cluster creation using the `enableDataplaneV2` field."],["Logs are stored locally on each cluster node, with new timestamped files created when the current file reaches 10 MB, and up to five previous log files are stored."],["Fluent Bit, an open-source log processor and forwarder, is recommended for exporting logs from cluster nodes to destinations like Cloud Logging."]]],[]]
