Stay organized with collections
Save and categorize content based on your preferences.
Pub/Sub generates audit logs that capture administrative
and access activities of Pub/Sub resources. Some examples of
these activities include creating a topic, updating a subscription, or
deleting a snapshot. You can use these logs for troubleshooting issues
and ensuring the security of your messaging infrastructure.
Here are some important points to remember regarding audit logs in
Pub/Sub:
Pub/Sub audit logs use the service name pubsub.googleapis.com.
Pub/Sub has different types of logs. These include the following:
Admin activity logs record actions like creating, deleting, or updating
topics and subscriptions.
Data access logs record actions like retrieving a topic or listing
subscriptions.
System event logs record events like removing inactive
subscriptions.
Pub/Sub does not log message operations like publishing,
subscribing, or acknowledging messages.
For more information about audit logs for
Pub/Sub, see Audit logging.
View Pub/Sub audit logs
Logs Explorer provides a centralized location to access all your log data
within Google Cloud. You can use Logs Explorer to view Pub/Sub logs.
Get the required permissions to view Logs Explorer.
Select an existing Google Cloud project, folder, or organization.
To display all audit logs related to Pub/Sub, enter the
following query into the query-editor field:
protoPayload.serviceName="pubsub.googleapis.com"
Figure 1 Enter a query.
Click Run query.
To display the audit logs for a specific resource and audit log type,
in the Query builder pane, do the following:
For All resources, select the Google Cloud resource whose
audit logs you want to see. For example, select Cloud Pub/Sub Topic and then
select the topic name.
For All log names, select the audit log type that you want to see.
For example:
For Admin activity audit logs, select enter activity.
For System event audit logs, select system_event.
The query runs automatically.
How to use audit logs to troubleshoot Pub/Sub issues
Determine the specific problem that you're investigating. Here is a list of
potential issues:
Identify who created, deleted, or modified topics, subscriptions, snapshots,
or schemas.
Track changes to topic or subscription settings.
Verify if a topic or subscription exists and its current status.
However, you cannot use audit logs to troubleshoot issues related to message
publishing and delivery. You won't find logs for message delivery failures,
message duplication, or message ordering problems. Audit logs also won't help
you identify slow subscribers or issues with message acknowledgments.
For troubleshooting message-level issues, you'll need to rely on other tools
like monitoring metrics, dead-letter queues, and application logs.
Based on the issue, construct a query to filter the audit logs.
For example, to find out who deleted a subscription, filter by
protoPayload.methodName="google.pubsub.v1.Publisher.DeleteSubscription".
To investigate a potential error with creating a subscription, filter by
protoPayload.methodName="google.pubsub.v1.Subscriber.CreateSubscription".
Examine the timestamps, principals, and resource names in the log entries
to understand the sequence of events and identify any anomalies.
For more information on how to construct an audit log query for
Pub/Sub, see Audit logging.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-07 UTC."],[],[],null,["# Troubleshoot Pub/Sub issues with audit logs\n\nPub/Sub generates audit logs that capture administrative\nand access activities of Pub/Sub resources. Some examples of\nthese activities include creating a topic, updating a subscription, or\ndeleting a snapshot. You can use these logs for troubleshooting issues\nand ensuring the security of your messaging infrastructure.\n\nHere are some important points to remember regarding audit logs in\nPub/Sub:\n\n- Pub/Sub audit logs use the service name `pubsub.googleapis.com`.\n\n- Pub/Sub has different types of logs. These include the following:\n\n - Admin activity logs record actions like creating, deleting, or updating\n topics and subscriptions.\n\n - Data access logs record actions like retrieving a topic or listing\n subscriptions.\n\n - System event logs record events like removing inactive\n subscriptions.\n\n- Pub/Sub does not log message operations like publishing,\n subscribing, or acknowledging messages.\n\nFor more information about audit logs for\nPub/Sub, see [Audit logging](/pubsub/docs/audit-logging).\n\nView Pub/Sub audit logs\n-----------------------\n\n**Logs Explorer** provides a centralized location to access all your log data\nwithin Google Cloud. You can use **Logs Explorer** to view Pub/Sub logs.\n\n1. Get the required permissions to view **Logs Explorer**.\n\n For more information, see [Before you begin](/logging/docs/view/logs-explorer-interface#before-you-begin).\n2. In the Google Cloud console, go to the **Logs Explorer** page.\n\n [Go to Logs Explorer](https://console.cloud.google.com/logs)\n3. Select an existing Google Cloud project, folder, or organization.\n\n4. To display all audit logs related to Pub/Sub, enter the\n following query into the query-editor field:\n\n protoPayload.serviceName=\"pubsub.googleapis.com\"\n\n **Figure 1** Enter a query.\n5. Click **Run query**.\n\n6. To display the audit logs for a specific resource and audit log type,\n in the Query builder pane, do the following:\n\n 1. For **All resources** , select the Google Cloud resource whose\n audit logs you want to see. For example, select **Cloud Pub/Sub Topic** and then\n select the topic name.\n\n 2. For **All log names**, select the audit log type that you want to see.\n\n For example:\n - For Admin activity audit logs, select enter `activity`.\n\n - For System event audit logs, select `system_event`.\n\nThe query runs automatically.\n\nHow to use audit logs to troubleshoot Pub/Sub issues\n----------------------------------------------------\n\n1. Determine the specific problem that you're investigating. Here is a list of\n potential issues:\n\n - Identify who created, deleted, or modified topics, subscriptions, snapshots,\n or schemas.\n\n - Track changes to topic or subscription settings.\n\n - Verify if a topic or subscription exists and its current status.\n\n However, you cannot use audit logs to troubleshoot issues related to message\n publishing and delivery. You won't find logs for message delivery failures,\n message duplication, or message ordering problems. Audit logs also won't help\n you identify slow subscribers or issues with message acknowledgments.\n For troubleshooting message-level issues, you'll need to rely on other tools\n like monitoring metrics, dead-letter queues, and application logs.\n2. Based on the issue, construct a query to filter the audit logs.\n For example, to find out who deleted a subscription, filter by\n `protoPayload.methodName=\"google.pubsub.v1.Publisher.DeleteSubscription\"`.\n\n To investigate a potential error with creating a subscription, filter by\n `protoPayload.methodName=\"google.pubsub.v1.Subscriber.CreateSubscription\"`.\n3. Examine the timestamps, principals, and resource names in the log entries\n to understand the sequence of events and identify any anomalies.\n\nFor more information on how to construct an audit log query for\nPub/Sub, see [Audit logging](/pubsub/docs/audit-logging)."]]