Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Menggunakan logging kebijakan jaringan
Halaman ini menjelaskan cara mengaktifkan logging kebijakan jaringan di cluster GKE dan cara mengekspor log.
Ringkasan
Kebijakan jaringan
adalah firewall tingkat Pod; kebijakan ini menentukan traffic jaringan yang diizinkan
untuk dikirim dan diterima Pod. Log kebijakan jaringan mencatat peristiwa kebijakan jaringan. Anda dapat mencatat semua peristiwa atau memilih untuk mencatat peristiwa berdasarkan kriteria berikut:
Koneksi yang diizinkan.
Koneksi ditolak.
Koneksi yang diizinkan oleh kebijakan tertentu.
Koneksi ditolak ke Pod di namespace tertentu.
Mengaktifkan logging
Logging kebijakan jaringan tidak diaktifkan secara default. Untuk mengetahui informasi tentang cara mengaktifkan logging dan memilih peristiwa yang akan dicatat, lihat Menggunakan logging kebijakan jaringan di dokumentasi Google Kubernetes Engine.
Mengakses log
Log kebijakan jaringan diupload secara otomatis ke Cloud Logging.
Anda dapat mengakses log melalui Logs Explorer atau dengan Google Cloud CLI. Anda juga dapat mengekspor log dari Cloud Logging ke sink pilihan Anda.
Anda juga dapat membuat kueri menggunakan Query builder. Untuk membuat kueri log kebijakan jaringan, pilih policy-action di menu drop-down Log name. Jika
tidak ada log yang tersedia, policy-action tidak akan muncul di menu drop-
down.
Akses lokal ke log kebijakan jaringan
Jika Anda memiliki akses ke sistem file node, log kebijakan jaringan tersedia di setiap node dalam file lokal /var/log/network/policy_action.log*. Node
merotasi file log saat file log saat ini mencapai 10 MB. Hingga lima file log sebelumnya akan disimpan.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-07-31 UTC."],[],[],null,["# Use network policy logging\n==========================\n\nThis page explains how to enable network policy logging in an\nGKE cluster and how to export logs.\n\nOverview\n--------\n\n[Network policies](https://kubernetes.io/docs/concepts/services-networking/network-policies/)\nare Pod-level firewalls; they specify the network traffic that Pods are allowed\nto send and receive. Network policy logs record network policy events. You can\nlog all events or you can choose to log events based on the following criteria:\n\n- Allowed connections.\n- Denied connections.\n- Connections allowed by specific policies.\n- Connections denied to Pods in specific namespaces.\n\nEnabling logging\n----------------\n\nNetwork policy logging is not enabled by default. For information on enabling\nlogging and selecting which events to log, see\n[Using network policy logging](/kubernetes-engine/docs/how-to/network-policy-logging)\nin the Google Kubernetes Engine documentation.\n\nAccessing logs\n--------------\n\nNetwork policy logs are automatically uploaded to [Cloud Logging](/logging/docs).\nYou can access logs through the Logs Explorer or with the Google Cloud CLI. You can also\n[export logs from Cloud Logging](/logging/docs/export) to the sink of your choice. \n\n### gcloud\n\n gcloud logging read --project \"\u003cvar translate=\"no\"\u003ePROJECT_NAME\u003c/var\u003e\" 'resource.type=\"k8s_node\" \\\n resource.labels.location=\"\u003cvar translate=\"no\"\u003eCLUSTER_LOCATION\u003c/var\u003e\" \\\n resource.labels.cluster_name=\"azureClusters/\u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e\" \\\n logName=\"projects/\u003cvar translate=\"no\"\u003ePROJECT_NAME\u003c/var\u003e/logs/policy-action\"'\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePROJECT_NAME\u003c/var\u003e: your Google Cloud project\n- \u003cvar translate=\"no\"\u003eCLUSTER_LOCATION\u003c/var\u003e: the Google Cloud location your cluster is managed from\n- \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e: the name of your cluster\n\n### Cloud Logging\n\n1. Go to the **Logs Explorer** page in Google Cloud console.\n\n [Go to Logs Explorer](https://console.cloud.google.com/logs/query)\n2. Click **Query builder**.\n\n3. Use the following query to find all network policy log records:\n\n resource.type=\"k8s_node\"\n resource.labels.location=\"\u003cvar translate=\"no\"\u003eCLUSTER_LOCATION\u003c/var\u003e\"\n resource.labels.cluster_name=\"azureClusters/\u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e\"\n logName=\"projects/\u003cvar translate=\"no\"\u003ePROJECT_NAME\u003c/var\u003e/logs/policy-action\"\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eCLUSTER_LOCATION\u003c/var\u003e: the Google Cloud location your cluster is managed from\n - \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e: the name of your cluster.\n - \u003cvar translate=\"no\"\u003ePROJECT_NAME\u003c/var\u003e: your Google Cloud project.\n\nTo learn how to use the Logs Explorer, see\n[Using the Logs Explorer](/logging/docs/view/logs-explorer-interface).\n\nYou can also build a query using the **Query builder** . To query for network\npolicy logs, select **policy-action** in the **Log name** drop-down list. If\nthere are no logs available, **policy-action** does not appear in the drop-\ndown list.\n\n### Local access to network policy logs\n\nIf you have access to a node's file system, network policy logs are available on\neach node in the local file `/var/log/network/policy_action.log*`. Nodes\nrotate log files when the current log file reaches 10 MB. Up to five previous\nlog files are stored.\n\nWhat's next\n-----------\n\n- Learn [how to configure network policy logging](/kubernetes-engine/docs/how-to/network-policy-logging)"]]
