Monitor resources using Cloud Monitoring

Console

To view the metrics for a monitored resource by using the Metrics Explorer, do the following:

1. In the Google Cloud console, go to the leaderboard Metrics explorer page:

   Go to Metrics explorer

   If you use the search bar to find this page, then select the result whose subheading is Monitoring.

2. In the Metric element, expand the Select a metric menu, enter Certificate Authority in the filter bar, and then use the submenus to select a specific resource type and metric:
   1. In the Active resources menu, select Certificate Authority.
   2. To select a metric, use the Active metric categories and Active metrics menus. For a list of metrics, see privateca metrics.
   3. Click Apply.

3. To remove time series from the display, use the Filter element.

4. To combine time series, use the menus on the Aggregation element. For example, to display the CPU utilization for your VMs, based on their zone, set the first menu to Mean and the second menu to zone.

   All time series are displayed when the first menu of the Aggregation element is set to Unaggregated. The default settings for the Aggregation element are determined by the metric type you selected.

5. For quota and other metrics that report one sample per day, do the following:
   1. In the Display pane, set the Widget type to Stacked bar chart.
   2. Set the time period to at least one week.

Console

1. Go to the CA Service Overview page in the Google Cloud console.

   Certificate Authority Service

2. On the top right of the Overview page, click the + 5 Recommended Alerts.

3. Enable or disable each alert, reading its description.

   • Some alerts support custom thresholds. For example, you can specify when you want to be alerted for an expiring CA certificate, or the error rate for a high rate of certificate creation failures.
   • All alerts support notification channels.

4. Click Submit once you have enabled all selected alerts.

Console

You can create alerting policies to monitor the values of metrics and to notify you when those metrics violate a condition.

1. In the Google Cloud console, go to the notifications Alerting page:

   Go to Alerting

   If you use the search bar to find this page, then select the result whose subheading is Monitoring.

2. If you haven't created your notification channels and if you want to be notified, then click Edit Notification Channels and add your notification channels. Return to the Alerting page after you add your channels.
3. From the Alerting page, select Create policy.
4. To select the metric, expand the Select a metric menu and then do the following:
   1. To limit the menu to relevant entries, enter Certificate Authority into the filter bar. If there are no results after you filter the menu, then disable the Show only active resources & metrics toggle.
   2. For the Resource type, select Certificate Authority.
   3. For the Metric category, select Ca.
   4. For the Metric, select a metric from the list of privateca metrics.
   5. Select Apply.
5. Click Next.
6. The settings in the Configure alert trigger page determine when the alert is triggered. Select a condition type and, if necessary, specify a threshold. For more information, see Create metric-threshold alerting policies.
7. Click Next.
8. Optional: To add notifications to your alerting policy, click Notification channels. In the dialog, select one or more notification channels from the menu, and then click OK.
9. Optional: Update the Incident autoclose duration. This field determines when Monitoring closes incidents in the absence of metric data.
10. Optional: Click Documentation, and then add any information that you want included in a notification message.
11. Click Alert name and enter a name for the alerting policy.
12. Click Create Policy.

Console

You can create alerting policies to monitor the values of metrics and to notify you when those metrics violate a condition.

1. In the Google Cloud console, go to the notifications Alerting page:

   Go to Alerting

   If you use the search bar to find this page, then select the result whose subheading is Monitoring.

2. If you haven't created your notification channels and if you want to be notified, then click Edit Notification Channels and add your notification channels. Return to the Alerting page after you add your channels.
3. From the Alerting page, select Create policy.
4. To select the metric, expand the Select a metric menu and then do the following:
   1. To limit the menu to relevant entries, enter Certificate Authority into the filter bar. If there are no results after you filter the menu, then disable the Show only active resources & metrics toggle.
   2. For the Resource type, select Certificate Authority.
   3. For the Metric category, select Ca.
   4. For the Metric, select ca/cert_expiration.
   5. Select Apply.
5. Click Next.
6. The settings in the Configure alert trigger page determine when the alert is triggered. Complete this page with the settings in the following table.
   

   Configure alert trigger page Field	Value
   Condition type	Threshold
   Alert trigger	Any time series violates
   Threshold position	Below threshold
   Threshold value	2592000000 ms
   Advanced Options: Retest window	No retest

7. Click Next.
8. Optional: To add notifications to your alerting policy, click Notification channels. In the dialog, select one or more notification channels from the menu, and then click OK.
9. Optional: Update the Incident autoclose duration. This field determines when Monitoring closes incidents in the absence of metric data.
10. Optional: Click Documentation, and then add any information that you want included in a notification message.
11. Click Alert name and enter a name for the alerting policy.
12. Click Create Policy.

gcloud

Paste the following policy into a file named ca-expiration-policy.yaml:

combiner: OR
conditions:
- conditionThreshold:
    aggregations:
    - alignmentPeriod: 60s
      perSeriesAligner: ALIGN_MEAN
    comparison: COMPARISON_LT
    duration: 0s
    filter: metric.type="privateca.googleapis.com/ca/cert_expiration" resource.type="privateca.googleapis.com/CertificateAuthority"
    thresholdValue: 2592000.0
    trigger:
      count: 1
  displayName: CA certificate expiration
displayName: CA expiring in 30 days
enabled: true

Create the alert policy with the following command:

gcloud alpha monitoring policies create --policy-from-file ca-expiration-policy.yaml

After creating the alert policy, follow Managing notification channels to create or update existing notification channels, if required. To add a notification channel to an existing alert policy, follow Updating notification channels in a policy.

gcloud

Paste the following policy into a file named cert-create-failure.yaml:

displayName: High rate of certificate creation failures
enabled: true
combiner: OR
conditions:
- conditionThreshold:
    filter: metric.type="privateca.googleapis.com/ca/cert/create_failure_count" resource.type="privateca.googleapis.com/CertificateAuthority"
    aggregations:
    - alignmentPeriod: 300s
      crossSeriesReducer: REDUCE_SUM
      groupByFields:
      - resource.label.resource_container
      - resource.label.location
      - resource.label.certificate_authority_id
      perSeriesAligner: ALIGN_DELTA
    denominatorFilter: metric.type="privateca.googleapis.com/ca/cert/create_request_count"
      resource.type="privateca.googleapis.com/CertificateAuthority"
    denominatorAggregations:
    - alignmentPeriod: 300s
      perSeriesAligner: ALIGN_DELTA
    comparison: COMPARISON_GT
    duration: 0s
    thresholdValue: 0.2
    trigger:
      count: 1
  displayName: 'Ratio: Certificate creation CA policy error count / Total certificate creation request count'

Create the alert policy with the following command:

gcloud alpha monitoring policies create --policy-from-file cert-create-failure.yaml

After creating the alert policy, follow Managing notification channels to create or update existing notification channels, if required. To add a notification channel to an existing alert policy, follow Updating notification channels in a policy.