[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-11。"],[],[],null,["# Set up audit logging for a domain\n\nThis topic shows you how to enable and view Managed Microsoft AD audit logs for a domain.\nFor information about Cloud Audit Logs for Managed Microsoft AD, see\n[Managed Microsoft AD audit logging](/managed-microsoft-ad/docs/audit-logging).\n\nEnable Managed Microsoft AD audit logs\n--------------------------------------\n\nYou can enable Managed Microsoft AD audit logs during domain creation or by\nupdating an existing domain.\n\n### At domain creation\n\nTo enable Managed Microsoft AD audit logs during domain creation, run the\nfollowing gcloud CLI command. \n\n```\ngcloud active-directory domains create DOMAIN_NAME --enable-audit-logs\n```\n\n### Update existing domain\n\nTo update a domain to enable Managed Microsoft AD audit logs, complete the\nfollowing steps. \n\n### Console\n\n1. Go to the [Managed Microsoft AD](https://console.cloud.google.com/security/cloud-ad) page in the Google Cloud console. \n [Go to the Managed Microsoft AD page](https://console.cloud.google.com/security/cloud-ad)\n2. On the Managed Microsoft AD page, in the list of instances, select the domain where you want to enable audit logs.\n3. On the domain details page, select **View audit logs** , and then select **Configure logs** from the dropdown.\n4. In the **Configure audit logs** pane, under **Turn off/on logs** , toggle logs to **On**.\n\n### gcloud\n\nRun the following gcloud CLI command. \n\n```\ngcloud active-directory domains update DOMAIN_NAME --enable-audit-logs\n```\n\nTo limit what is logged, you can use\n[logs exclusions](/logging/docs/exclusions).\n\nNote that logs stored in your project are chargeable. Learn more about\n[pricing for Cloud Logging](/stackdriver/pricing#logging-costs).\n\nDisable Managed Microsoft AD audit logs\n---------------------------------------\n\nTo disable Managed Microsoft AD audit logs, complete the following steps. \n\n### Console\n\n1. Go to the [Managed Microsoft AD](https://console.cloud.google.com/security/cloud-ad) page in the Google Cloud console. \n [Go to the Managed Microsoft AD page](https://console.cloud.google.com/security/cloud-ad)\n2. On the Managed Microsoft AD page, in the list of instances, select the domain where you want to disable audit logs.\n3. On the domain details page, select **View audit logs** , and then select **Configure logs** from the dropdown.\n4. In the **Configure audit logs** pane, under **Turn off/on logs** , toggle logs to **Off**.\n\n### gcloud\n\nRun the following gcloud CLI command. \n\n```\ngcloud active-directory domains update DOMAIN_NAME --no-enable-audit-logs\n```\n\nVerify logging status\n---------------------\n\nTo verify that logging is enabled or disabled, complete the following steps, run\nthe following gcloud CLI command. \n\n```\ngcloud active-directory domains describe DOMAIN_NAME\n```\n\nIn the response, verify the value of the `auditLogsEnabled` field.\n\nView logs\n---------\n\nManaged Microsoft AD audit logs are only available for domains that are\nenabled to collect logs.\n\nTo view Managed Microsoft AD audit logs, you must have the\n`roles/logging.viewer` Identity and Access Management (IAM) permission. Learn about\n[granting permissions](/iam/docs/granting-changing-revoking-access).\n\nTo view the Managed Microsoft AD audit logs for your domain, complete the\nfollowing steps. \n\n### Logs Explorer\n\n1. Go to the [Logs Explorer](https://console.cloud.google.com/logs/query) page in the Google Cloud console. \n [Go to the Logs Explorer page](https://console.cloud.google.com/logs/query)\n2. In the **Query Builder**, enter the following values.\n\n ```\n resource.type=\"microsoft_ad_domain\"\n resource.labels.fqdn=\"DOMAIN_NAME\"\n ```\n\n To filter by event IDs, add the following line to your advanced filter. \n\n ```\n jsonPayload.ID=EVENT_ID\n ```\n3. Select **Run Filter**.\n\nLearn about the [Logs Explorer](/logging/docs/view/logs-explorer-summary).\n\n### Logs Explorer\n\n1. Go to the [Logs Explorer](https://console.cloud.google.com/logs/query) page in the Google Cloud console. \n [Go to the Logs Explorer page](https://console.cloud.google.com/logs/query)\n2. In the filter textbox, click keyboard_arrow_down, and then select **Convert to advanced filter**.\n3. In the advanced filter textbox, enter the following values.\n\n ```\n resource.type=\"microsoft_ad_domain\"\n resource.labels.fqdn=\"DOMAIN_NAME\"\n ```\n\n To filter by event IDs, add the following line to your advanced filter. \n\n ```\n jsonPayload.ID=EVENT_ID\n ```\n4. Select **Submit Filter**.\n\nLearn about the [Logs Explorer](/logging/docs/view/logs-explorer-interface).\n\n### gcloud\n\nRun the following gcloud CLI command. \n\n```\ngcloud logging read FILTER\n```\n\nWhere \u003cvar translate=\"no\"\u003eFILTER\u003c/var\u003e is an expression to identify a set of log entries.\nTo read log entries in folders, billing accounts, or organizations, add the\n`--folder`, `--billing-account`, or `--organization` flags.\n\nTo read all the logs for your domain, you can run the following command. \n\n```\ngcloud logging read \"resource.type=microsoft_ad_domain AND resource.labels.fqdn=DOMAIN_NAME\"\n```\n\nLearn about\n[reading log entries with the gcloud CLI](/logging/docs/reference/tools/gcloud-logging#reading_log_entries)\nand the [`gcloud logging read` command](/sdk/gcloud/reference/logging/read).\n\nInterpret logs\n--------------\n\nEach `log_entry` contains the following fields.\n\n- The `log_name` is the event log where this event is logged.\n- The `provider_name` is the event provider that published this event.\n- The `version` is the version number for the event.\n- The `event_id` is identifier for this event.\n- The `machine_name` is the computer on which this event was logged.\n- The `xml` is the XML representation of the event. It conforms to the [event schema](https://docs.microsoft.com/en-us/windows/win32/wes/eventschema-schema).\n- The `message` is a human-readable representation of the event.\n\n### Exported event IDs\n\nThe following table shows the event IDs that are exported.\n\nIf you find any event IDs are missing and you do not see them listed in the\n[Exported Event IDs table](#event-ids), you can use the\n[Issue Tracker](https://issuetracker.google.com/issues/new?component=809523)\nto file a bug. Use the component\n**Public Trackers \\\u003e Cloud Platform \\\u003e Identity \\& Security \\\u003e Managed Service for Microsoft AD**.\n\nExport logs\n-----------\n\nYou can export Managed Microsoft AD audit logs to\nPub/Sub, BigQuery, or Cloud Storage. Learn\n[how to export logs to other Google Cloud services](/logging/docs/export).\n\nYou can also export logs for compliance requirements, [security and access analytics](/solutions/exporting-stackdriver-logging-for-security-and-access-analytics), and to external\n\nSIEMs such as [Splunk](/solutions/exporting-stackdriver-logging-for-splunk) and\nDatadog."]]
