本页面介绍了 Cloud DNS 的日志记录和监控指标，包括 公开区域、专用区域、 和转发区域。 另外还提供了有关监控公共 DNS 更改传播的说明。
使用 Cloud DNS 日志记录
Cloud DNS 日志记录功能会跟踪域名服务器为您的 Virtual Private Cloud (VPC) 网络解析的查询，以及从外部实体直接到公开区域的查询。
所记录的查询可能来自使用同一 VPC 网络的 Compute Engine 虚拟机 (VM) 实例、同一 VPC 网络中的 Google Kubernetes Engine 容器、对等互连区域或入站 DNS 转发。专用 DNS 区域、转发 DNS 区域、备用域名服务器、内部Google Cloud DNS 区域或外部 DNS 区域可能会最终解析查询。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-25。"],[[["\u003cp\u003eCloud DNS logging tracks queries resolved by name servers for your VPC networks and external entities directly querying a public zone, including queries from Compute Engine VMs, Google Kubernetes Engine containers, peering zones, or on-premises clients.\u003c/p\u003e\n"],["\u003cp\u003eLogging can be enabled or disabled for private managed zones using DNS policies through the \u003ccode\u003egcloud dns policies\u003c/code\u003e command with options to create, update, or delete them.\u003c/p\u003e\n"],["\u003cp\u003eLogging for public managed zones can be enabled or disabled with the \u003ccode\u003egcloud dns managed-zones update\u003c/code\u003e command, using either the \u003ccode\u003e--log-dns-queries\u003c/code\u003e or \u003ccode\u003e--no-log-dns-queries\u003c/code\u003e flags.\u003c/p\u003e\n"],["\u003cp\u003eEvery log entry in Cloud DNS has various fields like \u003ccode\u003esource_type\u003c/code\u003e, \u003ccode\u003elocation\u003c/code\u003e, \u003ccode\u003eproject_id\u003c/code\u003e, \u003ccode\u003etarget_type\u003c/code\u003e, \u003ccode\u003equeryName\u003c/code\u003e, and more, which can be used in metrics and provide detailed information about the DNS query.\u003c/p\u003e\n"],["\u003cp\u003eYou can monitor DNS propagation using \u003ccode\u003egcloud\u003c/code\u003e commands to check the status of changes and \u003ccode\u003edig\u003c/code\u003e commands to verify name server updates, allowing you to track when new records are available.\u003c/p\u003e\n"]]],[],null,["# Use logging and monitoring\n\nThis page provides information about logging and monitoring metrics for\nCloud DNS including [public zones](/dns/docs/dns-overview#public_zone),\n[private zones](/dns/docs/overview#private_zone), and\n[forwarding zones](/dns/docs/zones/zones-overview#forwarding_zones). This page also\nprovides instructions for monitoring the propagation of your public DNS changes.\n\nUse Cloud DNS logging\n---------------------\n\nCloud DNS logging tracks queries that name servers resolve for your\nVirtual Private Cloud (VPC) networks, as well as queries from an external entity\ndirectly to a public zone.\n\nLogged queries can come from Compute Engine virtual machine (VM) instances,\nGoogle Kubernetes Engine containers in the same VPC network,\n[peering zones](/dns/docs/zones/zones-overview#peering_zones), or\non-premises clients that use [inbound DNS\nforwarding](/dns/docs/server-policies-overview#dns-server-policy-in).\nPrivate DNS zones, forwarding DNS zones, alternative name servers, internal\nGoogle Cloud DNS zones, or external DNS zones might eventually resolve\nthe queries.\n\nLog records belong to the project that owns the network or public zone that\ncarried the request. In the case of [Shared VPC](/vpc/docs/shared-vpc),\nthe log records belong to the host project because the host project owns the\nnetwork.\n| **Note:** Cloud DNS might respond to queries using cached responses. By default, cached responses are not logged. However, if logging is enabled, at least one prior response is logged before any subsequent cached response is served without logging.\n\n### Enable and disable logging for private managed zones\n\nUse DNS policies to enable or disable logging for your networks. When you enable\nquery logging, every DNS query to a Cloud DNS private\nmanaged zone is logged.\n\nTo enable logging for a network that does not have a DNS policy, run the\n[`dns policies create`](/sdk/gcloud/reference/dns/policies/create) command. \n\n### gcloud\n\n```\ngcloud dns policies create POLICY_NAME \\\n --networks=NETWORK \\\n --enable-logging \\\n --description=DESCRIPTION\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePOLICY_NAME\u003c/var\u003e: the name of the DNS policy\n- \u003cvar translate=\"no\"\u003eNETWORK\u003c/var\u003e: one or more networks in a comma-separated list\n- \u003cvar translate=\"no\"\u003eDESCRIPTION\u003c/var\u003e: a description of the policy\n\nTo enable logging for a network that has an existing DNS policy, run the\n[`dns policies update`](/sdk/gcloud/reference/dns/policies/update) command. \n\n### gcloud\n\n```\ngcloud dns policies update POLICY_NAME \\\n --networks=NETWORK \\\n --enable-logging\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePOLICY_NAME\u003c/var\u003e: the name of the DNS policy\n- \u003cvar translate=\"no\"\u003eNETWORK\u003c/var\u003e: one or more networks in a comma-separated list\n\nTo turn off logging while leaving the policy in place, run the\n[`dns policies update`](/sdk/gcloud/reference/dns/policies/update) command. \n\n### gcloud\n\n```\ngcloud dns policies update POLICY_NAME \\\n --networks=NETWORK \\\n --no-enable-logging\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePOLICY_NAME\u003c/var\u003e: the name of the DNS policy\n- \u003cvar translate=\"no\"\u003eNETWORK\u003c/var\u003e: one or more networks in a comma-separated list\n\nTo delete the policy entirely, run the\n[`dns policies delete`](/sdk/gcloud/reference/dns/policies/delete) command. \n\n### gcloud\n\n```\ngcloud dns policies delete POLICY_NAME \\\n```\n\nReplace \u003cvar translate=\"no\"\u003ePOLICY_NAME\u003c/var\u003e with the name of the DNS policy that\nyou want to delete.\n\n### Enable and disable logging for managed public zones\n\nTo turn on logging for an existing managed public zone, run the\n[`dns managed-zones update`](/sdk/gcloud/reference/dns/managed-zones/update) command. \n\n### gcloud\n\n```\ngcloud dns managed-zones update ZONE_NAME --log-dns-queries \\\n```\n\nReplace \u003cvar translate=\"no\"\u003eZONE_NAME\u003c/var\u003e with the name of the DNS managed zone that\nyou want to enable logging for.\n\nTo turn off logging for an existing public managed zone, run the\n[`dns managed-zones update`](/sdk/gcloud/reference/dns/managed-zones/update) command. \n\n### gcloud\n\n```\ngcloud dns managed-zones update ZONE_NAME --no-log-dns-queries \\\n```\n\nReplace \u003cvar translate=\"no\"\u003eZONE_NAME\u003c/var\u003e with the name of the DNS managed zone that\nyou want to disable logging for.\n\n### View logs\n\nYou can view logs in the Google Cloud console. \n\n### Console\n\nIn the Google Cloud console, go to the **Logs Explorer** page.\n\n[Go to Logs Explorer](https://console.cloud.google.com/logs/viewer?resource=dns_query)\n\n#### View record format fields\n\nEvery log entry has the following fields, if applicable. Some of the fields are\nalso shared with monitoring metrics.\n\nPricing\n-------\n\nAll Cloud DNS logs are written to Cloud Logging. There is no\nseparate charge from Cloud DNS for this service. However, these logs\ncan result in additional storage costs depending on the size of the logs that are\nwritten and stored.\n\nFor calculation purposes, Cloud DNS writes approximately 5 MB of log\ndata for processing 10,000 DNS queries.\n\nFor information about Cloud Logging pricing, see\n[Pricing for Google Cloud Observability: Cloud Logging](/stackdriver/pricing).\n\nTroubleshoot outbound forwarding\n--------------------------------\n\nIf you receive logs containing `SERVFAIL` that are missing certain fields\nsuch as `destinationIP`, `egressIP`, and `egressError`, see the\n[related section in the Troubleshooting documentation](/dns/docs/troubleshooting#outbound-forwarded-queries-receive-servfail-errors).\n\nMonitor metrics\n---------------\n\nCloud DNS exports monitoring metrics to\n[Cloud Monitoring](/monitoring/docs/monitoring-overview).\n\nYou can monitor the rate of DNS queries and responses that point to private\nzones, forwarding zones, policy forwarding, internal Google Cloud zones,\nand the internet. Monitoring is available on the Google Cloud console\n[Monitoring page](https://console.cloud.google.com/monitoring)\nand in the\n[Cloud Monitoring API](/monitoring/api/v3).\n\nPrivate DNS exports the `dns.googleapis.com/query/response_count` delta metric\nthat contains the `response_code` label to count the number of queries per\nresponse code.\n\nThe `response_code` label is of type `string` with the possible values of\n`NOERROR`, `FORMERR`, `SERVFAIL`, `NXDOMAIN`, `NOTIMP`, and `UNKNOWN`.\nFor definitions of these codes, see the\n[IANA DNS RCODEs](https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#dns-parameters-6).\n\nThe metric is exported under the `dns_query` resource type by using the\napplicable fields of the log\n[record format](#dns-log-record-format).\n\nMonitor DNS propagation\n-----------------------\n\nWhen you use the Google Cloud CLI or the REST API to make changes, the changes are\ninitially marked as pending until the operation is completed. You can\nuse the gcloud CLI or the REST API to check on the status of changes\nor get a history of changes.\n\nAn operation is completed (status: `done`) when Cloud DNS has\nsuccessfully updated the system that controls the servers. There might still\nbe delays before all name servers are updated.\n\n### List changes for a managed zone\n\nTo list changes for a managed zone, run the [`dns record-sets changes list`](/sdk/gcloud/reference/dns/record-sets/changes/list) command. \n\n### gcloud\n\n```\ngcloud dns record-sets changes list --zone=ZONE\n```\n\nReplace \u003cvar translate=\"no\"\u003eZONE\u003c/var\u003e with the name of the managed zone whose\nrecord sets you want to manage.\n\n### Verify DNS propagation\n\nTo monitor and verify that the DNS name server has picked up your changes, you\ncan use the `watch` and `dig` commands. The following example demonstrates how\nto look up your name server and check to see when one of your managed zone's\nname servers has picked up a change to an `MX` record.\n| **Note:** The commands `watch` and `dig` are provided by the Linux operating system and are not `gcloud` commands. As such, they don't require the `gcloud` prefix to run. For other operating systems, you might have to install the commands.\n\nTo look up your zone's name servers, run the\n[`dns managed-zones describe`](/sdk/gcloud/reference/dns/managed-zones/describe)\ncommand: \n\n### gcloud\n\n```\ngcloud dns managed-zones describe ZONE_NAME\n```\n\nReplace \u003cvar translate=\"no\"\u003eZONE_NAME\u003c/var\u003e with the name of your Cloud DNS\nzone.\n\nTo check if the records are available yet on your authoritative name server,\nrun the following `dig` command: \n\n### gcloud\n\n```\nwatch dig example.com in MX @ZONE_NAME_SERVER\n```\n\nReplace \u003cvar translate=\"no\"\u003eZONE_NAME_SERVER\u003c/var\u003e with one of the name servers from\nthe managed zone.\n\nThe `watch` command runs the `dig` command every 2 seconds by default. You\ncan use this command to determine when your authoritative name server picks up\nyour change, which should happen within 120 seconds. After your authoritative\nname server has the change, DNS resolvers can start to pick up the new record.\nResolvers that already have the previous record cached wait for the\nprevious TTL value of the record to expire.\n\nTo run `dig` against your system's name server, you can remove the `@\u003caddress\u003e`\nfrom the `dig` command. If you would like to monitor propagation to other name\nservers, you can change the `address` to point to other name servers.\n\nWhat's next\n-----------\n\n- To add, delete, and update records, see [Add, modify, and delete records](/dns/docs/records).\n- To create, update, list, and delete managed zones, see [Managing zones](/dns/docs/zones).\n- To find solutions for common issues that you might encounter when using Cloud DNS, see [Troubleshooting](/dns/docs/troubleshooting).\n- To reference the API, see [Cloud DNS REST API](/dns/docs/reference/v1).\n- To get an overview of Cloud DNS, see [Cloud DNS overview](/dns/docs/overview)."]]
