Internal passthrough Network Load Balancer logging and monitoring

Console

1. In the Google Cloud console, go to the Load balancing page.

   Go to Load balancing

2. Click the name of your load balancer.

3. Click editEdit, and then click Backend Configuration.

4. Select Create a backend service, and then complete the required backend service fields.

5. Click Enable logging.

6. Set a Sample rate fraction. You can set a rate to 0.0 through 1.0 (default).

7. Optional: To include all the optional fields in the logs, in the Optional fields section, click Include all optional fields.

8. To finish editing the backend service, click Update.

9. To finish editing the load balancer, click Update.

gcloud

Create a backend service and enable logging by using the gcloud compute backend-services create command.

gcloud compute backend-services create BACKEND_SERVICE \
  --region=REGION \
  --enable-logging \
  --logging-sample-rate=SAMPLE_RATE
  --logging-optional=LOGGING_OPTIONAL \
  --logging-optional-fields=OPTIONAL_FIELDS

Replace the following:

• BACKEND_SERVICE: the name of the backend service.
• REGION: the region of the backend service to create.

• SAMPLE_RATE: this field can only be specified if logging is enabled for this backend service.

  The value of the field must be from 0.0 to 1.0, where 0.0 means that no logs are reported and 1.0 means that logs are generated for all of the sampled packets. Enabling logging but setting the sampling rate to 0.0 is equivalent to disabling logging. The default value is 1.0.

• LOGGING_OPTIONAL: the optional annotations that you want to include in the logs:

  • INCLUDE_ALL_OPTIONAL to include all optional annotations.

  • EXCLUDE_ALL_OPTIONAL (default) to exclude all optional annotations.

  • CUSTOM to include a custom list of optional fields that you specify in OPTIONAL_FIELDS.

• OPTIONAL_FIELDS: a comma-separated list of optional fields that you want to include in the logs.

  For example, serverInstance.vm, serverGkeDetails. Can only be set if LOGGING_OPTIONAL is set to CUSTOM.

API

Make a POST request to the regionBackendServices.insert method.

 POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION/backendServices
 

Exclude all optional fields

 {
 "name": "BACKEND_SERVICE",
  "loadBalancingScheme": "INTERNAL",
  "logConfig": {
   "enable": true,
   "sampleRate": SAMPLE_RATE,
   "optionalMode": "EXCLUDE_ALL_OPTIONAL"
  }
 }

Include all optional fields

{
 "name": "BACKEND_SERVICE",
 "loadBalancingScheme": "INTERNAL",
 "logConfig": {
   "enable": true,
   "sampleRate": SAMPLE_RATE,
   "optionalMode": "INCLUDE_ALL_OPTIONAL"
  }
}

Include a custom list of optional fields

{
 "name": "BACKEND_SERVICE",
 "loadBalancingScheme": "INTERNAL",
 "logConfig": {
   "enable": true,
   "sampleRate": SAMPLE_RATE,
   "optionalMode": "CUSTOM",
   "optionalFields": ["field1","field2",...]
  }
}

Console

1. In the Google Cloud console, go to the Load balancing page.

   Go to Load balancing

2. Click the name of your load balancer.

3. Click editEdit, and then click Backend Configuration.

4. Next to your backend service, click editEdit.

5. Click Enable logging.

6. Set a Sample rate fraction. You can set a rate to 0.0 through 1.0 (default).

7. Optional: To include all the optional fields in the logs, in the Optional fields section, click Include all optional fields.

8. To finish editing the backend service, click Update.

9. To finish editing the load balancer, click Update.

gcloud

Enable logging on an existing backend service with the gcloud compute backend-services update command.

gcloud compute backend-services update BACKEND_SERVICE \
--region=REGION \
--enable-logging \
--logging-sample-rate=SAMPLE_RATE \
--logging-optional=LOGGING_OPTIONAL \
--logging-optional-fields=OPTIONAL_FIELDS

Replace the following:

• BACKEND_SERVICE: the name of the backend service.
• REGION: the region of the backend service to create.

• SAMPLE_RATE: this field can only be specified if logging is enabled for this backend service.

  The value of the field must be from 0.0 to 1.0, where 0.0 means that no logs are reported and 1.0 means that logs are generated for all of the sampled packets. Enabling logging but setting the sampling rate to 0.0 is equivalent to disabling logging. The default value is 1.0.

• LOGGING_OPTIONAL: the optional annotations that you want to include in the logs.

  • INCLUDE_ALL_OPTIONAL to include all optional annotations.

  • EXCLUDE_ALL_OPTIONAL (default) to exclude all optional annotations.

  • CUSTOM to include a custom list of optional fields that you specify in OPTIONAL_FIELDS.

• OPTIONAL_FIELDS: a comma-separated list of optional fields that you want to include in the logs.

  For example, serverInstance.vm,serverGkeDetails. Can only be set if LOGGING_OPTIONAL is set to CUSTOM.

API

Make a PATCH request to the regionBackendServices/patch method.

 PATCH https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION/backendServices/BACKEND_SERVICE
 

Exclude all optional fields

 "logConfig": {
   "enable": true,
   "sampleRate": SAMPLE_RATE,
   "optionalMode": "EXCLUDE_ALL_OPTIONAL"
  }
 

Include all optional fields

 "logConfig": {
   "enable": true,
   "sampleRate": SAMPLE_RATE,
   "optionalMode": "INCLUDE_ALL_OPTIONAL"
  }
 

Include a custom list of optional fields

 "logConfig": {
   "enable": true,
   "sampleRate": SAMPLE_RATE,
   "optionalMode": "CUSTOM",
   "optionalFields": ["field1","field2",...]
  }

Console

1. In the Google Cloud console, go to the Load balancing page.

   Go to Load balancing

2. Click the name of your load balancer.

3. Click editEdit, and then click Backend Configuration.

4. To disable logging entirely, clear Enable logging.

5. If you leave logging enabled, you can set a different Sample rate fraction. You can set the rate to 0.0 through 1.0 (default). To only generate logs for 20% of the sampled packets, set the value to 0.2.

6. To finish editing the backend service, click Update.

7. To finish editing the load balancer, click Update.

gcloud

Disable logging on a backend service with the gcloud compute backend-services update command.

gcloud compute backend-services update BACKEND_SERVICE \
  --region=REGION \
  --no-enable-logging

Replace the following:

• BACKEND_SERVICE: the name of the backend service.
• REGION: the region of the backend service to create.

API

Make a PATCH request to the regionBackendServices/patch method.

 PATCH https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION/backendServices/BACKEND_SERVICE

 {
 "logConfig": {
   "enable": false
  }
 }
 

Console

1. In the Google Cloud console, go to the Logs Explorer page.

   Go to Logs Explorer

2. Select the Internal Passthrough Network Load Balancer Rule resource type.

3. Select the loadbalancing.googleapis.com/flows log name.

Console query

1. In the Google Cloud console, go to the Logs Explorer page.

   Go to Logs Explorer

2. Click the Show query toggle.

3. Paste the following into the query field. Replace PROJECT_ID with your project ID.

   resource.type="loadbalancing.googleapis.com/InternalNetworkLoadBalancerRule"
   logName="projects/PROJECT_ID/logs/loadbalancing.googleapis.com%2Fflows"
   

4. Click Run query.

Console query

1. In the Google Cloud console, go to the Logs Explorer page.

   Go to Logs Explorer

2. Click the Show query toggle.

3. Paste the following into the query field. Replace PROJECT_ID with your project ID and BACKEND_SERVICE_NAME with the name of your backend service.

   resource.type="loadbalancing.googleapis.com/InternalNetworkLoadBalancerRule"
   logName="projects/PROJECT_ID/logs/loadbalancing.googleapis.com%2Fflows"
   resource.labels.backend_service_name="BACKEND_SERVICE_NAME"
   

4. Click Run query.

Console query

1. In the Google Cloud console, go to the Logs Explorer page.

   Go to Logs Explorer

2. Click the Show query toggle.

3. Paste the following into the query field. Replace PROJECT_ID with your project ID and the BACKEND_GROUP_NAME with the name of the instance group or NEG.

   resource.type="loadbalancing.googleapis.com/InternalNetworkLoadBalancerRule"
   logName="projects/PROJECT_ID/logs/loadbalancing.googleapis.com%2Fflows"
   resource.labels.backend_group_name="BACKEND_GROUP_NAME"
   

4. Click Run query.

Console

1. In the Google Cloud console, go to the Monitoring page.

   Go to Monitoring

2. If Resources appears in the navigation pane, select Resources, and then select Google Cloud Load Balancers. Otherwise, select Dashboards, and then select the dashboard named Google Cloud Load Balancers.

3. Click the name of your load balancer.

In the left pane, you can see various details for the selected load balancer. In the right pane, you can see time series graphs. Click the Breakdowns link to see specific breakdowns. The left pane presents currently configured data, while the right pane can present data served by historical configurations not currently reflected in the left pane.

Console

1. In the Google Cloud console, go to the Monitoring page.

   Go to Monitoring

2. Select Dashboards > Create Dashboard.

3. Click Add Chart.

4. Give the chart a title.

5. Select metrics and filters. For metrics, the resource type is Internal Passthrough TCP Network Load Balancer Rule (internal_tcp_lb_rule) or Internal Passthrough UDP Network Load Balancer Rule (internal_udp_lb_rule).

6. Click Save.

Console

You can create alerting policies to monitor the values of metrics and to notify you when those metrics violate a condition.

1. In the Google Cloud console, go to the notifications Alerting page:

   Go to Alerting

   If you use the search bar to find this page, then select the result whose subheading is Monitoring.

2. If you haven't created your notification channels and if you want to be notified, then click Edit Notification Channels and add your notification channels. Return to the Alerting page after you add your channels.
3. From the Alerting page, select Create policy.
4. To select the metric, expand the Select a metric menu and then do the following:
   1. To limit the menu to relevant entries, enter Google Cloud TCP Load Balancer or Google Cloud UDP Load Balancer into the filter bar. If there are no results after you filter the menu, then disable the Show only active resources & metrics toggle.
   2. For the Resource type, select Google Cloud TCP Load Balancer or Google Cloud UDP Load Balancer.
   3. Select a Metric category and a Metric, and then select Apply.
5. Click Next.
6. The settings in the Configure alert trigger page determine when the alert is triggered. Select a condition type and, if necessary, specify a threshold. For more information, see Create metric-threshold alerting policies.
7. Click Next.
8. Optional: To add notifications to your alerting policy, click Notification channels. In the dialog, select one or more notification channels from the menu, and then click OK.
9. Optional: Update the Incident autoclose duration. This field determines when Monitoring closes incidents in the absence of metric data.
10. Optional: Click Documentation, and then add any information that you want included in a notification message.
11. Click Alert name and enter a name for the alerting policy.
12. Click Create Policy.