Database health issues

Database Center aggregates and categorizes database health issues across the projects in your Google Cloud organization(s) into a single dashboard. Database Center uses data from your Google Cloud projects and Security Command Center to aggregate and categorize database health issues based on the resources in your Google Cloud organization. Some companies might have more than one organization.

In Database Center, resources are the clusters and virtual machines that handle your workloads. An individual resource is a named unit of compute or storage. For example, in Cloud SQL, an instance and a read replica are separate individual resources.

A database group refers to all cloud computing resources that serve a set of data. For example, in Cloud SQL, one database group includes a primary instance and all the read replica instances associated with it.

Health issue categories

To help you view the most important aspects of your database fleet health at a glance, Database Center organizes health issues into industry-standard categories including cost, performance and capacity, availability, data protection, security, and industry compliance.

A database health issue is any topic that you want to monitor to ensure that your fleet is healthy and that your applications are robust and secure.

You can customize which databases and health issues Database Center displays. When you customize health issues, your customizations only apply to your view of the organization. Health issue customizations are saved at the per-user level.

Health issue categories are described as follows:

Health issue category Description

Availability configuration

Availability issues track resource configurations that affect durability, fault tolerance, and downtime.

Cost

Cost issues help you optimize your database fleet for cost-saving opportunities.

Data protection

Data protection issues help you ensure the following:

  • Your data is properly backed up.
  • You store backups for a sufficient period of time.
  • There are no gaps in your overall data protection strategy.

Security

Security issues help you perform the following types of tasks:

  • Identify security misconfigurations and vulnerabilities.
  • Identify and address cyber security risks.
  • Detect threats to your Google Cloud database resources.
  • Monitor and manage regulatory compliance.

Industry compliance

Industry compliance issues help you ensure that the database resources in your organization are compliant with common industry standards. Database Center helps you monitor compliance for the following industry standards:

  • CIS Google Cloud Foundation 2.0
  • CIS Google Cloud Foundation 1.3
  • CIS Google Cloud Foundation 1.2
  • CIS Google Cloud Foundation 1.1
  • CIS Google Cloud Foundation 1.0
  • NIST 800-53
  • ISO-27001
  • PCI-DSS v3.2.1

Performance and capacity

Performance and capacity issues help you determine if your resource usage is putting your database performance at risk. These issues highlight the following:

  • Instances with high CPU or memory utilization.
  • Instances that are running low on storage capacity.
  • Databases with a large number of tables or high table utilization
  • Temporary tables affecting database performance

Other

Other issues include miscellaneous configurations that can help you with the following:

  • Query troubleshooting, like "query durations not logged"
  • Errors and logging scope, like "verbose error logging"
  • Settings related to connections and users, like "connection attempts not logged"

Health issue tiers

Supported health issues are in one of three tiers:

  1. Built-in: included by default with Database Center
  2. Gemini: requires you to enable Gemini Cloud Assist.
  3. Security Command Center (SCC): requires you to enable the Security Command Center

Database Center doesn't check for issues that are dependent on Security Command Center (SCC) or Gemini Cloud Assist unless you have the specific tiers enabled. If Security Command Center or Gemini Cloud Assist aren't enabled, then all issue checks display as passing in the user interface.

For more information on how to enable the Gemini Cloud Assist or Security Command Center tiers, see Set up Database Center.

Supported health issues

All available health issues are shown in the following table by default. To view health issues for a specific tier, database, or category use the Select tier, Select database, or Select category drop-downs. To clear all selections, click Clear all.


Category Issue Tier AlloyDB for PostgreSQL Bigtable Cloud SQL for MySQL Cloud SQL for PostgreSQL Cloud SQL for SQL Server Firestore Memorystore Spanner
Availability Database resource not failover protected Built-in ✔ ✔ ✔ ✔ ✔
Availability Not replicating across regions Built-in ✔ ✔ ✔ ✔ ✔ ✔
Availability Suspended resource Built-in ✔
Availability Not multi-regional for disaster recovery Built-in ✔
Availability Maintenance policy not set Other ✔
Cost Idle database resource Gemini ✔ ✔ ✔
Cost Overprovisioned database resource Gemini ✔ ✔ ✔
Data protection No automated backup policy Built-in ✔ ✔ ✔ ✔ ✔ ✔
Data protection Short backup retention Built-in ✔ ✔ ✔ ✔ ✔ ✔
Data protection Last backup failed Built-in ✔ ✔ ✔ ✔ ✔
Data protection Last backup older than 24 hours Built-in ✔ ✔ ✔ ✔ ✔ ✔
Data protection Deletion protection not enabled Built-in ✔ ✔
Data protection Short backup retention Built-in ✔
Data protection No point-in-time recovery Built-in ✔
Industry compliance Violates CIS Google Cloud Foundation 2.0 SCC ✔ ✔ ✔ ✔
Industry compliance Violates CIS Google Cloud Foundation 1.3 SCC ✔ ✔ ✔
Industry compliance Violates CIS Google Cloud Foundation 1.2 SCC ✔ ✔ ✔
Industry compliance Violates CIS Google Cloud Foundation 1.1 SCC ✔ ✔ ✔
Industry compliance Violates CIS Google Cloud Foundation 1.0 SCC ✔ ✔ ✔
Industry compliance Violates NIST 800-53 SCC ✔ ✔ ✔ ✔
Industry compliance Violates ISO-27001 SCC ✔ ✔ ✔ ✔
Industry compliance Violates PCI-DSS v3.2.1 SCC ✔ ✔
Industry compliance Violates NIST 800-53 R5 SCC ✔ ✔ ✔
Industry compliance Violates NIST Cybersecurity Framework 1.0 SCC ✔ ✔ ✔ ✔
Industry compliance Violates ISO-27001 v2022 SCC ✔ ✔ ✔ ✔
Industry compliance Violates PCI-DSS v4.0 SCC ✔ ✔ ✔ ✔
Industry compliance Violates SOC2 v2017 SCC ✔ ✔ ✔ ✔
Industry compliance Violates Cloud Controls Matrix 4 SCC ✔ ✔ ✔ ✔
Industry compliance Violates CIS Critical Security Controls 8.0 SCC ✔ ✔ ✔
Industry compliance Violates HIPAA SCC ✔ ✔ ✔
Other Logs not optimized for troubleshooting SCC ✔
Other Query durations not logged SCC ✔
Other Error logging misconfigured for statement severity SCC ✔ ✔
Other Error logging misconfigured for message severity SCC ✔ ✔
Other Verbose error logging SCC ✔ ✔
Other User granted all permissions SCC ✔ ✔
Other Query lock waits not logged SCC ✔
Other Error logging misconfigured for statements SCC ✔
Other Query statistics logged SCC ✔
Other Excessive logging of client hostname SCC ✔
Other Excessive logging of parser statistics SCC ✔
Other Excessive logging of planner statistics SCC ✔
Other Not logging temporary files SCC ✔
Other Not logging only DDL statements SCC ✔
Other Logging query statement statistics SCC ✔
Other Concurrent connections max configured SCC ✔
Other User options configured SCC ✔
Other Connection attempts not logged SCC ✔
Other Disconnections not logged SCC ✔
Other Logging excessive statement info SCC ✔
Other Data exported to external Cloud Storage bucket SCC ✔ ✔ ✔
Other Data exported to public Cloud Storage bucket SCC ✔ ✔ ✔
Other Writes to user table by superuser SCC ✔ ✔ ✔
Security Public IP enabled Built-in ✔ ✔ ✔
Security Broad public IP range Built-in ✔ ✔ ✔
Security Unencrypted connections Built-in ✔ ✔ ✔ ✔
Security No root password SCC ✔
Security Weak root password SCC ✔ ✔ ✔ ✔
Security Encryption key not customer-managed SCC ✔ ✔ ✔
Security Contained database authentication not required SCC ✔
Security Exposed to external scripts SCC ✔
Security Exposed to local data loads SCC ✔
Security Exposed to remote access SCC ✔
Security Database names exposed SCC ✔
Security Sensitive trace info not masked SCC ✔
Security Auditing not enabled Built-in ✔ ✔ ✔ ✔
Security Server certificate expiring Built-in ✔ ✔ ✔ ✔
Security Violates policy restricting public IP Built-in ✔ ✔ ✔
Security Violates policy restricting authorized networks Built-in ✔ ✔ ✔
Security No password policy Built-in ✔ ✔ ✔
Security No user password policy Built-in ✔ ✔
Performance and capacity High number of tables Built-in ✔(E+)
Performance and capacity High transaction ID utilization Built-in ✔(E+)
Performance and capacity High number of open tables Built-in ✔
Performance and capacity Connections burdening disk Built-in ✔(E+)
Performance and capacity Temp tables impacting performance Built-in ✔(E+)
Performance and capacity Transaction logs burdening disk Built-in ✔(E+)
Performance and capacity Nearing cluster quota limit Built-in ✔
Performance and capacity High resource utilization Built-in ✔ ✔ ✔ ✔ ✔ ✔
Performance and capacity Hotspot detected Built-in ✔ ✔
Performance and capacity Nearing or at storage capacity Built-in ✔ ✔
Performance and capacity Expensive commands Built-in ✔
Performance and capacity Inefficient queries SCC ✔ ✔ ✔

Supported health issues in Preview

The following health issues are in Preview for the specified database products:

Health check Product
Deletion protection not enabled Spanner
Last backup older than 24 hours Spanner
High resource utilization Bigtable
Hotspot detected Bigtable
Nearing or at storage capacity Bigtable
Deletion protection not enabled Bigtable
Suspended resource Bigtable
High resource utilization Memorystore
Expensive commands Memorystore
Maintenance policy not set Memorystore
No point-in-time recovery Firestore
No automated backup policy Firestore
Inefficient queries Cloud SQL

Security issues supported by Security Command Center pricing tiers

Security Command Center Built-in tier supports the following health issues for Cloud SQL in Database Center:

  • Public IP enabled
  • Exposed to public access

Security Command Center Premium tier supports the following health issues in Database Center:

  • Industry compliance violations
  • Unencrypted connections
  • Databases not auditable
  • No password
  • Weak password
  • Encryption key not customer-managed
  • Server authentication not required
  • Exposed by ownership chaining
  • Exposed to external scripts
  • Exposed to local data loads
  • Logs not optimized for troubleshooting
  • Connection attempts not logged
  • Disconnections not logged
  • Query durations not logged
  • Verbose error logging
  • Error logging misconfigured for statements
  • Error logging misconfigured for statement severity
  • Error log misconfigured for message severity
  • Not logging only DDL statements
  • Exposed to remote access
  • Database names exposed
  • Sensitive trace info not masked

For more information, see Security Command Center pricing tiers.

What's next