Saat membangun, menguji, dan menjalankan beban kerja, sebaiknya pantau progresnya untuk men-debug masalah. Alat berikut tersedia untuk digunakan dalam memantau dan men-debug:
Image Confidential Space untuk proses debug: Image Confidential Space untuk proses debug
membuat Confidential VM yang menjalankan workload tetap beroperasi setelah workload
selesai, dan menjalankan server SSH. Hal ini memungkinkan Anda login ke VM dari jarak jauh untuk mendiagnosis masalah. Sebaiknya gunakan image debug hingga Anda yakin bahwa kode Anda berfungsi sebagaimana mestinya. Saat tiba waktunya untuk mulai mengerjakan
data produksi sensitif, beralihlah ke image Confidential Space
produksi.
Shell interaktif: Setelah menggunakan SSH untuk terhubung ke workload Confidential VM, Anda dapat menggunakan perintah
sudo ctr task exec -t --exec-id shell tee-container bash untuk masuk ke shell interaktif di dalam container guna mendiagnosis masalah workload.
Logging
Seperti program command line lainnya, beban kerja STDOUT dan STDERR dapat ditampilkan di konsol. Log ini juga dapat dialihkan ke Cloud Logging oleh operator workload yang menetapkan kunci metadata tee-container-log-redirect ke true atau cloud_logging di VM Confidential Space, dan memastikan bahwa akun layanan yang menjalankan workload memiliki peran logging.logWriter.
Untuk mengurangi profil risiko Anda, catat jumlah informasi minimum, dan jangan mencatat informasi sensitif.
Melihat log Confidential Space
Jika akun layanan yang terpasang ke VM Confidential Space Anda telah diberi peran logging.logWriter dan Anda telah mengalihkan log ke Cloud Logging, Anda dapat memecahkan masalah error dengan melihat log VM:
Buka Logging di project operator workload di konsolGoogle Cloud .
Di samping tab Kueri, klik rentang waktu untuk menetapkan periode pencatatan log yang ingin Anda lihat.
Filter log berdasarkan kolom log berikut jika tersedia:
Jenis resource: Instance VM
ID Instance: ID instance Confidential VM
Nama log: confidential-space-launcher
Baca pesan kegagalan untuk mengetahui masalahnya. Resource mungkin belum disiapkan dengan benar, kondisi atribut di penyedia WIP kolaborator data Anda mungkin tidak cocok dengan klaim yang dibuat oleh beban kerja Confidential Space, atau beban kerja itu sendiri mungkin mengalami error.
Kode status
Kode yang ditampilkan ditampilkan di konsol saat menjalankan
peluncur
dan beban kerja, dan dapat dialihkan ke Cloud Logging.
Kode yang ditampilkan dijelaskan dalam tabel berikut:
Kode
Definisi
Perilaku penghentian VM
0
Beban kerja berhasil diselesaikan saat menggunakan image produksi.
VM berhenti setelah
beban kerja selesai.
1
Beban kerja atau peluncur menampilkan
error saat menggunakan image
produksi.
VM berhenti setelah menampilkan error.
3
Peluncur telah dimulai ulang setelah terjadi kegagalan karena tee-restart-policy.
VM akan dimulai ulang.
4
Workload atau peluncur telah selesai berjalan saat menggunakan image debug, dan VM kini dalam kondisi tidak ada aktivitas.
VM tidak berhenti setelah
workload selesai atau menampilkan
error. Hal ini dilakukan agar Anda dapat
men-debug beban kerja melalui SSH.
Jika workload gagal, operator workload hanya menerima pesan
workload finished with a non-zero return code, tanpa konteks lebih lanjut. Untuk gambar produksi, peluncur dapat disetel untuk memulai ulang saat terjadi kegagalan dengan
tee-restart-policy=OnFailure.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-18 UTC."],[[["\u003cp\u003eCloud Logging can be used to troubleshoot Confidential Space workloads by redirecting \u003ccode\u003eSTDOUT\u003c/code\u003e and \u003ccode\u003eSTDERR\u003c/code\u003e and checking for workload return codes to identify failure points.\u003c/p\u003e\n"],["\u003cp\u003eThe debug Confidential Space image allows for remote SSH access to the VM after workload completion, enabling in-depth diagnosis of issues before switching to the production image.\u003c/p\u003e\n"],["\u003cp\u003eMemory usage monitoring can be enabled for workloads, providing visibility through Cloud Logging or Metrics Explorer, but it requires enablement by both the workload author and operator.\u003c/p\u003e\n"],["\u003cp\u003eWorkload operators can use an interactive shell within the container of a Confidential VM to diagnose issues after connecting via SSH.\u003c/p\u003e\n"],["\u003cp\u003eReturn codes from the workload or launcher, which are displayed in the console and can be redirected to cloud logging, provide crucial information about the success or failure of the workload.\u003c/p\u003e\n"]]],[],null,["# Monitor and debug workloads\n\n[Workload author](/confidential-computing/confidential-space/docs/confidential-space-overview#roles) [Workload operator](/confidential-computing/confidential-space/docs/confidential-space-overview#roles)\n\n*** ** * ** ***\n\nWhen building, testing, and running a workload, it can be useful to monitor its\nprogress to debug issues. The following tools are available to use for\nmonitoring and debugging:\n\n- **Cloud Logging** : As the first step in troubleshooting a Confidential Space\n workload, you can\n [redirect `STDOUT` and `STDERR` to Cloud Logging](/confidential-computing/confidential-space/docs/deploy-workloads#tee-container-log-redirect),\n and then\n [check it for workload return codes](#logging) to see where a failure\n occurred.\n\n- **The debug Confidential Space image** : The\n [debug Confidential Space image](/confidential-computing/confidential-space/docs/confidential-space-images#types_of_images)\n keeps the Confidential VM running the workload operational after the workload has\n completed, and runs an SSH server. This lets you remotely log into the VM to\n diagnose issues. It's useful to use the debug image until you're confident\n that your code is behaving as it should. When it's time to start working on\n sensitive production data, switch to the production Confidential Space\n image.\n\n- **Memory usage monitoring** : You can view the memory usage of the workload in\n [Cloud Logging](/logging) or\n [Metrics Explorer](/monitoring/charts/metrics-explorer).\n The\n [workload author needs to allow it](/confidential-computing/confidential-space/docs/reference/launch-policies#monitoring-memory-allow),\n and the\n [workload operator needs to enable it](/confidential-computing/confidential-space/docs/reference/metadata-variables#tee-memory-monitoring-enable)\n before memory usage is tracked.\n\n- **Interactive shell** : After using SSH to connect to your workload\n Confidential VM, you can use the\n `sudo ctr task exec -t --exec-id shell tee-container bash` command to enter\n an interactive shell inside the container to diagnose workload issues.\n\nLogging\n-------\n\nLike any command line program, the workload `STDOUT` and `STDERR` can be\ndisplayed in the console. It can also be redirected to Cloud Logging by the\nworkload operator setting the\n[`tee-container-log-redirect`](/confidential-computing/confidential-space/docs/deploy-workloads#tee-container-log-redirect)\nmetadata key to `true` or `cloud_logging` on the Confidential Space VM, and\nensuring that the service account running the workload has the\n`logging.logWriter` role.\n\nRedirection can be prevented by the workload author with the\n[`log_redirect` launch policy](/confidential-computing/confidential-space/docs/create-customize-workloads#log-redirect).\n\nTo reduce your risk profile, log the minimum amount of information, and don't\nlog sensitive information.\n\n### View Confidential Space logs\n\nIf the service account attached to your Confidential Space VM has been granted the\n`logging.logWriter` role and you've redirected logs to Cloud Logging, you can\ntroubleshoot errors by viewing the VM's logs:\n\n1. Go to **Logging** in the workload operator's project in the\n Google Cloud console.\n\n [Go to Logging](https://console.cloud.google.com/logs)\n2. Next to the **Query** tab, click the time range to set the logging period\n you want to view.\n\n3. Filter the logs by the following log fields if they're available:\n\n - **Resource type:** VM Instance\n\n - **Instance ID:** The instance ID of the Confidential VM\n\n - **Log name:** confidential-space-launcher\n\n4. Read the failure message to find out what the problem is. A resource might\n not have been set up properly, the attribute conditions in your data\n collaborators' WIP providers might not match the claims made by the\n Confidential Space workload, or the workload itself might have had an error.\n\nReturn codes\n------------\n\nReturn codes are displayed in the console when running the\n[launcher](/docs/security/confidential-space#attestation-process)\nand workload, and can be redirected to Cloud Logging.\n\nThe return codes are described in the following table:\n\nIf a workload fails, a workload operator only receives the message\n`workload finished with a non-zero return code`, without further context. For a\nproduction image, the launcher can be set to restart on failure with\n[`tee-restart-policy=OnFailure`](/confidential-computing/confidential-space/docs/deploy-workloads#tee-restart-policy)."]]
