[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-19。"],[[["\u003cp\u003eVerbose logging in Google Cloud Armor provides detailed information about triggered security policy rules, aiding in troubleshooting, validation, and tuning.\u003c/p\u003e\n"],["\u003cp\u003eVerbose logging is configured via the \u003ccode\u003e--log-level\u003c/code\u003e flag in the \u003ccode\u003egcloud compute security-policies update\u003c/code\u003e command, with options for \u003ccode\u003eNORMAL\u003c/code\u003e or \u003ccode\u003eVERBOSE\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003eWhen verbose logging is enabled, logs include additional fields like \u003ccode\u003ematchedFieldType\u003c/code\u003e, \u003ccode\u003ematchedFieldName\u003c/code\u003e, and \u003ccode\u003ematchedFieldValue\u003c/code\u003e to pinpoint the exact parts of the request that triggered a rule.\u003c/p\u003e\n"],["\u003cp\u003eVerbose logging should only be enabled temporarily during policy creation, modification, or troubleshooting due to the risk of logging potentially sensitive data from incoming requests.\u003c/p\u003e\n"],["\u003cp\u003eBy default verbose logging is disabled, and normal logs only show the rule and subsignature that were triggered, while verbose logging provides the details of the incoming request that triggered the rule.\u003c/p\u003e\n"]]],[],null,["# Verbose logging\n\nThis page contains information about configuring verbose logging, an optional\nfeature that you can use with your Cloud Armor security policies.\n\nYou can adjust the level of detail recorded in your logs. We recommend that you\nenable verbose logging only when you first create a policy, make\nchanges to a policy, or troubleshoot a policy. If you enable verbose\nlogging, it is in effect for rules in preview mode as well as active\n(non-previewed) rules during standard operations.\n\nConsider an example in which you can't tell why a preconfigured WAF\nrule is triggered by a particular request. Cloud Armor's default event\nlogs contain the rule that was triggered, as well as the subsignature. However,\nyou might need to identify the details from the incoming request that triggered\nthe rule for troubleshooting, rule validation, or rule tuning purposes. For this\nexample, we recommend that you enable verbose logging.\n\nYou can configure the Cloud Armor logging level to enable more detailed\nlogging for each security policy by using the `--log-level` flag in the\nGoogle Cloud CLI.\n\nBy default, this option is disabled. The syntax for the flag is as follows:\n\n`--log-level=[NORMAL | VERBOSE]`\n\nThe flag is available only by using the `gcloud compute security-policies update`\ncommand. You can't create a new security policy with this option unless you\ncreate a security policy in a file and then import that file. For more\ninformation, see\n[Import security policies](/armor/docs/configure-security-policies#importing-policies).\n\nFor example: \n\n```\n gcloud compute security-policies update ca-policy-1 \\\n --log-level=VERBOSE\n \n```\n\nWe recommend that you enable verbose logging when you first create a\npolicy, make changes to a policy, or troubleshoot a policy.\n\n### Values logged when verbose logging is enabled\n\nWhen verbose logging is enabled, additional information is logged to the\nload balancing request log that is sent to Cloud Logging. The\nfollowing additional fields appear in the request log when verbose logging is\nenabled:\n\n- `matchedFieldType` (string): this is the type of field causing the match.\n\n - `ARG_NAMES`\n - `ARG_VALUES`\n - `BODY`\n\n - When the `BODY` field is in the log, it means that the entire request body matches a rule.\n - `COOKIE_VALUES`\n\n - `COOKIE_NAMES`\n\n - `FILENAME`\n\n - `HEADER_VALUES`\n\n - `RAW_URI`\n\n - `REFERER`\n\n - `REQUEST_LINE`\n\n - `URI`\n\n - `USER_AGENT`\n\n - `HEADER_NAMES`\n\n - `ARGS_GET`\n\n - `X_FILENAME`\n\n - `ARG_NAME_COUNT`\n\n - `TRANSFER_ENCODING`\n\n - `REQUEST_METHOD`\n\n- `matchedFieldName` (string): if this matches the value part of a key-value pair,\n the key value is stored in this field. Otherwise, it is empty.\n\n- `matchedFieldValue` (string): a prefix of up to 16 bytes for the part of the field\n that causes the match.\n\n- `matchedFieldLength` (integer): the total length of the field.\n\n- `matchedOffset` (integer): the start offset inside the field that causes the match.\n\n- `matchedLength` (integer): the length of the match.\n\n- `inspectedBodySize` (integer): the configured inspection limit (number of\n bytes) for a request body that you set by using the\n `--request-body-inspection-size` flag. For more information about this\n limit, see [POST and PATCH body inspection limitation](/armor/docs/security-policy-overview#post-body).\n\nFor example, you might send the following request to a project where SQL injection WAF\nrules are enabled: \n\n```\ncurl http://IP_ADDR/?sql_table=abc%20pg_catalog%20xyz\n```\n\nThe entry in the **Logs Explorer** is similar to the following: \n\n```\nenforcedSecurityPolicy: {\n name: \"user-staging-sec-policy\"\n priority: 100\n configuredAction: \"DENY\"\n outcome: \"DENY\n inspectedBodySize: 65536\n preconfiguredExprIds: [\n 0: \"owasp-crs-v030001-id942140-sqli\"\n ]\nmatchedFieldType: \"ARG_VALUES\"\nmatchedFieldName: \"sql_table\"\nmatchedFieldValue: \"pg_catalog\"\nmatchedFieldLength: 18\nmatchedOffset: 4\nmatchedLength: 10\n}\n```\n\n### Maintaining privacy when verbose logging is turned on\n\nWhen you use verbose logging, Cloud Armor logs snippets of the elements\nfrom the incoming requests that triggered a particular preconfigured WAF rule.\nThese snippets might contain pieces of request headers, request parameters, or\nelements of the request body. A snippet can contain sensitive data\nsuch as an IP address or other sensitive data from the incoming request,\ndepending on what is in the request headers or body and what triggers the WAF\nrule.\n\nWhen you enable verbose logging, there is a risk of accumulating\npotentially sensitive data in your logs in Logging. We recommend\nthat you enable verbose logging only during rule creation and validation or for\ntroubleshooting. During normal operations, we recommend that you leave verbose\nlogging disabled.\n\nWhat's next\n-----------\n\n- [Configure Cloud Armor security policies](/armor/docs/configure-security-policies)\n- [Use request logging](/armor/docs/request-logging)"]]
