[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-19。"],[[["\u003cp\u003eCompute Engine activity logs are deprecated, and users should transition to audit logs, which provide the same information and more.\u003c/p\u003e\n"],["\u003cp\u003eMigrating to audit logs involves adjusting queries by replacing activity log fields with the appropriate audit log fields, as detailed in the provided field mapping tables.\u003c/p\u003e\n"],["\u003cp\u003eAudit logs differ from activity logs in field names, field values, log names (containing \u003ccode\u003ecloudaudit.googleapis.com\u003c/code\u003e), payloads (\u003ccode\u003eprotoPayload\u003c/code\u003e instead of \u003ccode\u003ejsonPayload\u003c/code\u003e), resource names (fully qualified), and method names (versioned).\u003c/p\u003e\n"],["\u003cp\u003eTo query specific resources or methods in audit logs, users may need to use the "has" operator (\u003ccode\u003e:\u003c/code\u003e) instead of the "equals" operator (\u003ccode\u003e=\u003c/code\u003e) when employing partial or unversioned names.\u003c/p\u003e\n"],["\u003cp\u003eVarious query examples are available to demonstrate how to transition from activity log queries to audit log queries, covering areas such as resource-specific activity, recent admin activity, instance creation log entries, operation starts, and operation completion.\u003c/p\u003e\n"]]],[],null,["# Migrating from activity logs to audit logs\n\n*** ** * ** ***\n\nIf you use [activity logs](/compute/docs/activity-logs) to view Compute Engine\nadmin activity and system events, read this guide to understand how to find\nsimilar log entries using [audit logs](/compute/docs/audit-logging) instead.\n\nCompute Engine activity logs are deprecated. You can identify activity\nlog entries based on their log name: \n\n```\nlogName: \"projects/PROJECT_ID/logs/compute.googleapis.com%2Factivity_log\"\n```\n\nCompute Engine audit logs contain the same information that is available\nthrough activity logs, and more. But audit logs present the information\n[differently](#differences_between_activity_logs_and_audit_logs) compared to\nactivity logs. So you'll need to adjust your queries.\n\nHow to migrate from activity logs to audit logs\n-----------------------------------------------\n\nTo use audit logs instead of activity logs, adjust your\n[queries](/logging/docs/view/logs-explorer-interface). Use the following\nsteps.\n\n1. Find your old queries. For example, you might have saved them in a\n saved search in the [Logs Explorer](https://console.cloud.google.com/logs/query) or created\n a script using the API or SDK. For more information about how you can\n monitor your resources, see the [Logging](/logging/docs)\n documentation.\n\n2. Replace the activity log fields with appropriate audit log fields. Refer to\n the [table](#log_entry_field_mappings) to see how the fields map to each\n other.\n\n For example, if your legacy activity log query looked for a field named\n `jsonPayload.resource.name`, your new audit log query should look for\n `protoPayload.resourceName` instead.\n3. Save and use your new audit log query. For example,\n [create a saved search](/logging/docs/view/building-queries#saved-queries) in\n Cloud Logging or update your scripts.\n\n### Examples\n\nHere are some examples of converted queries:\n\n**Querying for activity related to a specific resource**\n\n**Querying for recent admin activity log entries**\n\n**Querying for recent instance creation log entries**\n\n**Querying for the start of all instance creation operations**\n\n**Querying for the completion of any operation**\n\nDifferences between activity logs and audit logs\n------------------------------------------------\n\nRead this section to learn how audit logs are structured differently from\nactivity logs. Keep these differences in mind as you convert legacy activity log\nqueries into audit log queries. For example, in your queries, replace all legacy\nactivity log field names with the corresponding audit log field names.\n\nWhile audit logging and activity logging both return\n[log entry](/logging/docs/reference/v2/rest/v2/LogEntry)\nobjects, they have the following differences:\n\n- Different field names. See the [field name mapping](#log_entry_field_mappings) table for details.\n- Different field values, including:\n - Different [log names](#log_names): Audit logs have log names that contain `cloudaudit.googleapis.com`.\n - Different [payloads](#payloads): Audit logs return a `protoPayload` field instead of a `jsonPayload`.\n - Fully qualified [resource names](#resource_names): Audit logs return resource names that include their path, for example: `projects/my-project/zones/us-east1-b/instances/my-instance-name`.\n - Versioned [method names](#method_names): Audit logs return method names that include their version, for example, `v1`.\n\nHere is an example that shows differences in log names and payloads:\n\nMapping fields from activity logs to audit logs\n-----------------------------------------------\n\nUse the following tables to map activity log fields to corresponding audit log\nfields in your queries.\n\n### Fields\n\nUse the following table to replace legacy activity log fields with audit\nlog fields in your updated queries.\n\nFor example, if your legacy activity log query contained a\n[filter](/logging/docs/view/logs-explorer-interface) based on\n`jsonPayload.resource.type`, your new audit log query should filter on\n`resource.type` instead.\n\n### Field values\n\nUse the following tables to map legacy activity log field values to audit log\nfield values. Compared to activity logs, audit logs have multiple\n[log name](#log_names) values and different [payload](#payloads) values.\nAudit log entries also return fully qualified resource names and versioned\n[method names](#method_names).\n\n#### Log names\n\nTo find an audit log entry, look for a `logName` that includes\n`cloudaudit.googleapis.com`.\n\n#### Payloads\n\nIn each audit log entry, look for a `protoPayload` instead of a `jsonPayload`.\n\nTo learn how these payloads relate to each other, and how to map\nlegacy activity log fields to audit log fields, read\n[log entry field mappings](#log_entry_field_mappings).\n\n#### Resource names\n\nIn audit logs, API resource names (in the `protoPayload.resourceName` field) are\nfully qualified, for example: \n\n```\nresourceName: \"projects/PROJECT_ID/zones/ZONE/instances/VM_NAME\"\n```\n\nYou can still use partial names but you must fix your query to use the \"has\"\noperator (`:`) instead of the \"equals\" operator.\n\nUse one of the following options in your audit log queries to filter on a\nspecific resource:\n\n-\n\n ```\n gcloud logging read protoPayload.resourceName:\"VM_NAME\"\n ```\n-\n\n ```\n gcloud logging read protoPayload.resourceName=\"projects/PROJECT_ID/zones/ZONE/instances/VM_NAME\"\n ```\n\n#### Method names\n\nIn audit logs, API method names (in the `protoPayload.methodName` field) are\nprefixed with their version, like: `v1.compute.instances.delete`.\n\nYou can still use unversioned method names in your audit log queries, but you\nmust fix your query to use the \"has\" operator (`:`) instead of the \"equals\"\noperator (`=`). For example: `protoPayload.methodName:compute.instances.delete`\nreturns all instance delete API calls, regardless of version. For more\ninformation about operators, see\n[comparisions](/logging/docs/view/advanced-queries#comparisons).\n\nWhat's next\n-----------\n\n- Read the [quick start](/logging/docs/write-query-log-entries-gcloud) for using logging tools.\n- Learn more about [viewing log entries](/logging/docs/view/logs-explorer-interface).\n- Learn about viewing logs with [advanced logging filters](/logging/docs/view/advanced-queries).\n- Learn more about Compute Engine [Cloud Audit Logs](/compute/docs/audit-logging)."]]
