Home - News ( United States | United Kingdom | Italy | Germany ) - Football scores

Showing content from http://cloud.google.com/load-balancing/docs/https/https-reg-logging-monitoring below:

Regional external Application Load Balancer logging and monitoring | Load Balancing

Stay organized with collections Save and categorize content based on your preferences.

This document shows you how to configure and use

and

with regional external Application Load Balancers.

You can enable, disable, and view logs for an external Application Load Balancer backend service.

You enable or disable logging for each backend service. You can configure whether to log all requests or a randomly sampled fraction.

You must ensure that you don't have a logs exclusion that applies to external Application Load Balancers. For information about how to verify that Cloud HTTP Load Balancer logs are allowed, see Exclusion filters.

The requests (and corresponding responses) handled by load balancer backend virtual machine (VM) instances are sampled. These sampled requests are then processed to generate logs. You control the fraction of the requests that are emitted as log entries according to the logConfig.sampleRate parameter. When logConfig.sampleRate is 1.0 (100%), this means that logs are generated for all of the requests and written to Cloud Logging.

Log records contain required fields and optional fields. The What is logged section lists which fields are optional and which are required. All required fields are always included. You can customize which optional fields you keep.

• If you select include all optional, all optional fields in the log record format are included in the logs. When new optional fields are added to the record format, the logs automatically include the new fields.

• If you select exclude all optional, all optional fields are omitted.

• If you select custom, you can specify the optional fields that you want to include, such as tls.protocol,tls.cipher,orca_load_report.cpu_utilization,orca_load_report.mem_utilization.

For information about customizing optional fields, see Enable logging on a new backend service.

1. In the Google Cloud console, go to the Load Balancing page.

   Go to Load balancing

2. Click the name of your load balancer.

3. Click editEdit.

4. Click Backend Configuration.

5. Select Create a backend service.

6. Complete the required backend service fields.

7. In the Logging section, select the Enable logging checkbox.

8. Set a Sample rate fraction. You can set a number from 0.0 through 1.0, where 0.0 means that no requests are logged and 1.0 means that 100% of the requests are logged. The default value is 1.0.

9. Optional: To include all the optional fields in the logs, in the Optional fields section, click Include all optional fields.

   Pro tip: To specify the CUSTOM option, use the gcloud CLI and the REST API.

10. To finish editing the backend service, click Update.

11. To finish editing the load balancer, click Update.

Create a backend service and enable logging by using the gcloud compute backend-services create command.

gcloud compute backend-services create BACKEND_SERVICE \
    --region=REGION \
    --enable-logging \
    --logging-sample-rate=VALUE \
    --load-balancing-scheme=EXTERNAL_MANAGED \
    --logging-optional=LOGGING_OPTIONAL_MODE \
    --logging-optional-fields=OPTIONAL_FIELDS

where

• --region indicates that the backend service is regional. Use this field for backend services used with regional external Application Load Balancers.
• --enable-logging enables logging for that backend service.
• --logging-sample-rate lets you specify a value from 0.0 through 1.0, where 0.0 means that no requests are logged and 1.0 means that 100% of the requests are logged. This field is only meaningful with the --enable-logging parameter. Enabling logging but setting the sampling rate to 0.0 is equivalent to disabling logging. The default value is 1.0.

• --logging-optional lets you specify the optional fields that you want to include in the logs:

  • INCLUDE_ALL_OPTIONAL to include all optional fields.

  • EXCLUDE_ALL_OPTIONAL (default) to exclude all optional fields.

  • CUSTOM to include a custom list of optional fields that you specify in OPTIONAL_FIELDS.

• --logging-optional-fields lets you specify a comma-separated list of optional fields that you want to include in the logs.

  For example, tls.protocol,tls.cipher can only be set if LOGGING_OPTIONAL_MODE is set to CUSTOM. If you use custom metrics and want to log elements of the ORCA load report, you set LOGGING_OPTIONAL_MODE to CUSTOM and specify which elements must be logged in the OPTIONAL_FIELDS field. For example, orca_load_report.cpu_utilization,orca_load_report.mem_utilization.

1. In the Google Cloud console, go to the Load Balancing page.

   Go to Load balancing

2. Click the name of your load balancer.

3. Click editEdit.

4. Click Backend Configuration.

5. Click editEdit next to your backend service.

6. In the Logging section, select the Enable logging checkbox.

7. In the Sample rate field, set the sampling probability. You can set a number from 0.0 through 1.0, where 0.0 means that no requests are logged and 1.0 means that 100% of the requests are logged. The default value is 1.0.

8. Optional: To include all the optional fields in the logs, in the Optional fields section, click Include all optional fields.

   Pro tip: To specify the CUSTOM option, use the gcloud CLI and the REST API.

9. To finish editing the backend service, click Update.

10. To finish editing the load balancer, click Update.

Enable logging on an existing backend service with the gcloud compute backend-services update command.

gcloud compute backend-services update BACKEND_SERVICE \
    --region=REGION \
    --enable-logging \
    --logging-sample-rate=VALUE \
    --logging-optional=LOGGING_OPTIONAL_MODE \
    --logging-optional-fields=OPTIONAL_FIELDS

where

• --region indicates that the backend service is regional. Use this field for backend services used with regional external Application Load Balancers.
• --enable-logging enables logging for that backend service.
• --logging-sample-rate lets you specify a value from 0.0 through 1.0, where 0.0 means that no requests are logged and 1.0 means that 100% of the requests are logged. Only meaningful with the --enable-logging parameter. Enabling logging but setting the sampling rate to 0.0 is equivalent to disabling logging. The default value is 1.0.

• --logging-optional lets you specify the optional fields that you want to include in the logs.

  • INCLUDE_ALL_OPTIONAL to include all optional fields.

  • EXCLUDE_ALL_OPTIONAL (default) to exclude all optional fields.

  • CUSTOM to include a custom list of optional fields that you specify in OPTIONAL_FIELDS.

• --logging-optional-fields lets you specify a comma-separated list of optional fields that you want to include in the logs.

  For example, tls.protocol,tls.cipher. Can only be set if LOGGING_OPTIONAL_MODE is set to CUSTOM.

1. In the Google Cloud console, go to the Load Balancing page.

   Go to Load balancing

2. Click the name of your load balancer.

3. Click editEdit.

4. Click Backend Configuration.

5. Click editEdit next to your backend service.

6. To disable logging entirely, in the Logging section, clear the Enable logging checkbox.

7. If you leave logging enabled, you can set a different Sample rate fraction. You can set a number from 0.0 through 1.0, where 0.0 means that no requests are logged and 1.0 means that 100% of the requests are logged. The default value is 1.0. For example, 0.2 means 20% of the sampled requests generate logs.

8. To finish editing the backend service, click Update.

9. To finish editing the load balancer, click Update.

Disable logging on a backend service with the gcloud compute backend-services update command.

Disabling logging entirely

gcloud compute backend-services update BACKEND_SERVICE \
    --region=REGION \
    --no-enable-logging

where

• --region indicates that the backend service is regional. Use this field for backend services used with regional external Application Load Balancers.
• --no-enable-logging disables logging for that backend service.

Enabling logging optional fields on an existing backend service

gcloud compute backend-services update BACKEND_SERVICE \
    --global \
    --enable-logging \
    --logging-sample-rate=VALUE \
    --logging-optional=LOGGING_OPTIONAL_MODE \
    --logging-optional-fields=OPTIONAL_FIELDS

where

• --logging-sample-rate lets you specify a value from 0.0 through 1.0, where 0.0 means that no requests are logged and 1.0 means that 100% of the requests are logged. Only meaningful with the --enable-logging parameter. Enabling logging but setting the sampling rate to 0.0 is equivalent to disabling logging. The default value is 1.0.

• --logging-optional lets you specify the optional fields that you want to include in the logs:

  • INCLUDE_ALL_OPTIONAL to include all optional fields.

  • EXCLUDE_ALL_OPTIONAL (default) to exclude all optional fields.

  • CUSTOM to include a custom list of optional fields that you specify in OPTIONAL_FIELDS.

• --logging-optional-fields lets you specify a comma-separated list of optional fields that you want to include in the logs.

  For example, tls.protocol,tls.cipher can only be set if LOGGING_OPTIONAL_MODE is set to CUSTOM. If you use custom metrics and want to log elements of the ORCA load report, you set LOGGING_OPTIONAL_MODE to CUSTOM and specify which elements must be logged in the OPTIONAL_FIELDS field. For example, orca_load_report.cpu_utilization,orca_load_report.mem_utilization.

Updating logging optional mode from CUSTOM to others

gcloud compute backend-services update BACKEND_SERVICE \
    --global \
    --enable-logging \
    --logging-sample-rate=VALUE \
    --logging-optional=LOGGING_OPTIONAL_MODE \
    --logging-optional-fields=

where

• --logging-optional lets you specify the optional fields that you want to include in the logs:

  • INCLUDE_ALL_OPTIONAL to include all optional fields.

  • EXCLUDE_ALL_OPTIONAL (default) to exclude all optional fields.

• --logging-optional-fields must be explicitly configured as shown to clear any existing CUSTOM fields. The API doesn't let you combine a non-CUSTOM mode with CUSTOM fields.

Modifying the logging sample rate

gcloud compute backend-services update BACKEND_SERVICE \
    --global | --region=REGION \
    --logging-sample-rate=VALUE

HTTP(S) logs are indexed first by a forwarding rule, then by a URL map.

To view logs, go to the Logs Explorer page:

Go to Logs Explorer

• To view all logs, in the Resource filter menu, select Cloud HTTP Load Balancer > All forwarding rules.

• To view logs for one forwarding rule, select a single forwarding rule name.

• To view logs for one URL map, select a forwarding rule, and then select a URL map.

Log fields of type boolean typically only appear if they have a value of true. If a boolean field has a value of false, that field is omitted from the log.

UTF-8 encoding is enforced for log fields. Characters that are not UTF-8 characters are replaced with question marks. For regional external Application Load Balancers, you can export logs-based metrics using resource logs (resource.type="http_external_regional_lb_rule").

External Application Load Balancer log entries contain information useful for monitoring and debugging your HTTP(S) traffic. Log records contain required fields, which are the default fields of every log record.

Log records contain optional fields that add additional information about your HTTP(S) traffic. Optional fields can be omitted to save storage costs.

Some log fields are in a multi-field format, with more than one piece of data in a given field. For example, the

field is of the

format, which contains the TLS protocol and TLS cipher in a single field. These multi-field fields are described in the following record format table.

The MonitoredResource is the resource type associated with a log entry.

The MonitoredResourceDescriptor describes the schema of a MonitoredResource object by using a type name and a set of labels. For more information, see Resource labels.

• proxyStatus
• tls
• backendTargetProjectNumber
• mtls
• authzPolicyInfo
• backendNetworkName
• orca_load_report

The proxyStatus field holds a string that specifies why the regional external Application Load Balancer returned the HttpRequest.status.

The field isn't logged if the value is an empty string. This can happen if the proxy or backend doesn't return a status code or the status code that is returned isn't 0, 4XX, or 5XX.

The proxyStatus field has two parts:

• proxyStatus error
• Optional: proxyStatus details

The tls field holds the TlsInfo field that specifies the TLS metadata for the connection between the client and the load balancer. This field is only available if the client is using TLS/SSL encryption.

Use the --logging-optional-fields parameter to specify which elements must be logged:

• tls.protocol
• tls.cipher

You can't set --logging-optional-fields to tls to specify all elements.

The mtls field holds the MtlsInfo value that specifies the mTLS metadata for the connection between the client and the load balancer. This field is only available if the load balancer uses frontend mutual TLS (mTLS).

The orca_load_report field contains some or all elements of the ORCA load report returned by the backend. This field is only present if the backend returns an ORCA load report and you configured the load balancer to log the ORCA load report.

Use the --logging-optional-fields parameter to specify which of the following elements of the ORCA load report must be logged:

• orca_load_report.cpu_utilization
• orca_load_report.mem_utilization
• orca_load_report.request_cost
• orca_load_report.utilization
• orca_load_report.rps_fractional
• orca_load_report.eps
• orca_load_report.named_metrics
• orca_load_report.application_utilization

You can also set --logging-optional-fields to orca_load_report to specify that all elements must be logged.

true if the client has provided a certificate during the TLS handshake; otherwise, false.

true if the client certificate chain is verified against a configured TrustStore; otherwise, false.

Predefined strings representing the error conditions. For more information about the error strings, see Client validation mode.

Base64-encoded SHA-256 fingerprint of the client certificate.

The serial number of the client certificate. If the serial number is longer than 50 bytes, the string client_cert_serial_number_exceeded_size_limit is added to client_cert_error, and the serial number is set to an empty string.

Timestamp (RFC 3339 date string format) before which the client certificate isn't valid. For example, 2022-07-01T18:05:09+00:00.

Timestamp (RFC 3339 date string format) after which the client certificate isn't valid. For example, 2022-07-01T18:05:09+00:00.

The SPIFFE ID from the subject alternative name (SAN) field. If the value isn't valid or exceeds 2048 bytes, the SPIFFE ID is set to an empty string.

If the SPIFFE ID is longer than 2048 bytes, the string client_cert_spiffe_id_exceeded_size_limit is added to client_cert_error.

Comma-separated Base64-encoded list of the SAN extensions of type URI. The SAN extensions are extracted from the client certificate. The SPIFFE ID is not included in the client_cert_uri_sans field.

If the client_cert_uri_sans field is longer than 512 bytes, the string client_cert_uri_sans_exceeded_size_limit is added to client_cert_error, and the comma-separated list is set to an empty string.

Comma-separated Base64-encoded list of the SAN extensions of type DNSName. The SAN extensions are extracted from the client certificate.

If the client_cert_dnsname_sans field is longer than 512 bytes, the string client_cert_dnsname_sans_exceeded_size_limit is added to client_cert_error, and the comma-separated list is set to an empty string.

Base64-encoded full Issuer field from the certificate.

If the client_cert_issuer_dn field is longer than 512 bytes, the string client_cert_issuer_dn_exceeded_size_limit is added to client_cert_error, and client_cert_issuer_dn is set to an empty string.

Base64-encoded full Subject field from the certificate.

If the client_cert_subject_dn field is longer than 512 bytes, the string client_cert_subject_dn_exceeded_size_limit is added to client_cert_error, and client_cert_subject_dn is set to an empty string.

The client leaf certificate for an established mTLS connection where the certificate passed validation. Certificate encoding is compliant with RFC 9440: the binary DER certificate is encoded using Base64 (without line breaks, spaces, or other characters outside the Base64 alphabet) and delimited with colons on either side.

If client_cert_leaf exceeds 16 KB unencoded, the string client_cert_validated_leaf_exceeded_size_limit is added to client_cert_error, and client_cert_leaf is set to an empty string.

The comma-delimited list of certificates, in standard TLS order, of the client certificate chain for an established mTLS connection where the client certificate passed validation, not including the leaf certificate. Certificate encoding is compliant with RFC 9440.

If the combined size of client_cert_leaf and client_cert_chain before Base64 encoding exceeds 16 KB, the string client_cert_validated_chain_exceeded_size_limit is added to client_cert_error, and client_cert_chain is set to an empty string.

The following table lists the resource labels for resource.type="http_external_regional_lb_rule".

• UNMATCHED refers to a request that matches no URL path rules, so it uses the default path rule.
• UNKNOWN indicates an internal error or a failed TLS connection.

The proxyStatus field contains a string that specifies why the load balancer returned an error. There are two parts in the proxyStatus field, proxyStatus error and proxyStatus details. This section describes the strings that are supported in the proxyStatus error field.

The proxyStatus error field is applicable to the following load balancers:

• Regional external Application Load Balancer
• Cross-region internal Application Load Balancer
• Regional internal Application Load Balancer

The load balancer's connection to the backend ended before a complete response is received.

This proxyStatus error is returned during any of the following scenarios:

• The load balancer's connection to the backend ended before a complete response is received.
• The TLS connection failed on the SSL handshake, and the client didn't establish a connection with the load balancer.

The load balancer is configured to limit the number of connections it has to the backend, and that limit has been exceeded.

This proxyStatus error is returned during any of the following scenarios:

• If any backend is in maintenance mode, the traffic can't be routed to the backend.
• If the request is locally rate limited.
• Envoy is handling error conditions such as running out of memory.

The proxyStatus field contains a string that specifies why the load balancer returned an error. There are two parts in the proxyStatus field, proxyStatus error and proxyStatus details. The proxyStatus details field is optional and is shown only when additional information is available. This section describes the strings that are supported in the proxyStatus details field.

The proxyStatus details field is applicable to the following load balancers:

• Regional external Application Load Balancer
• Regional internal Application Load Balancer
• Cross-region internal Application Load Balancer

The connection between the load balancer and client exceeded the idle timeout.

The backend timed out while generating a response.

The HTTP request headers received from a client contain at least one character that isn't allowed under an applicable HTTP specification.

For example, header field names that include a double quotation mark (") or any characters outside of the standard ASCII range (that is, any byte >= 0x80) are invalid.

For more information, see:

• The "5.5. Field Values" section of RFC 9110
• The "5. Field Syntax" section of RFC 9112
• The "8.2.1. Field Validity" section of RFC 9113

When the TLS connection between the client and the load balancer fails before any backend is selected, log entries record the errors. You can configure the backend services with different log sample rates. When a TLS connection fails, the failed TLS connection log sample rate is the highest sample rate for any backend service. For example, if you have configured two backend services with logging sample rate as 0.3 and 0.5, the failed TLS connection log sample rate is 0.5.

You can identify failed TLS connections by checking for these log entry details:

• proxyStatus error type is tls_alert_received, tls_certificate_error, tls_protocol_error, or connection_terminated.
• There is no backend information.

The following sample shows a failed TLS log entry with the proxyStatus error field:

   json_payload:    {
   @type: "type.googleapis.com/google.cloud.loadbalancing.type.LoadBalancerLogEntry"
   proxyStatus: "error="tls_alert_received"; details="server_to_client: handshake_failure""
   log_name: "projects/529254013417/logs/mockservice.googleapis.com%20name"
   }
   http_request {
    latency {
      nanos: 12412000
    }
    protocol: "HTTP/1.0"
    remote_ip: "127.0.0.2"
   }
  resource {
    type: "mock_internal_http_lb_rule"
    labels {
      backend_name: ""
      backend_scope: ""
      backend_scope_type: "UNKNOWN"
      backend_target_name: ""
      backend_target_type: "UNKNOWN"
      backend_type: "UNKNOWN"
      forwarding_rule_name: "l7-ilb-https-forwarding-rule-dev"
      matched_url_path_rule: "UNKNOWN"
      network_name: "lb-network"
      region: "REGION"
      target_proxy_name: "l7-ilb-https-proxy-dev"
      url_map_name: ""
    }
  }
  timestamp: "2023-08-15T16:49:30.850785Z"
  

The authz_info object in the Load Balancer Log Entry JSON payload contains information about authorization policies. You can configure log-based metrics for traffic allowed or denied by these policies. Check more authorization policies log details.

The name is empty for the following reasons:

• No ALLOW policy matches the request and the request is denied.
• No DENY policy matches the request and the request is allowed.

• allowed_as_no_deny_policies_matched_request
• denied_as_no_allow_policies_matched_request
• denied_by_authz_extension
• denied_by_cloud_iap

You can interact with the external Application Load Balancer logs by using the Cloud Logging API. The Logging API provides ways to interactively filter logs that have specific fields set. It exports matching logs to Cloud Logging, Cloud Storage, BigQuery, or Pub/Sub. For more information about the Logging API, see Logging API overview.

The load balancer exports monitoring data to Monitoring.

You can use monitoring metrics to do the following:

• Evaluate a load balancer's configuration, usage, and performance
• Troubleshoot problems
• Improve resource utilization and user experience

In addition to the predefined dashboards in Monitoring, you can create custom dashboards, set up alerts, and query the metrics through the Cloud Monitoring API.

You can create alerting policies to monitor the values of metrics and to notify you when those metrics violate a condition.

1. In the Google Cloud console, go to the notifications Alerting page:

   Go to Alerting

   If you use the search bar to find this page, then select the result whose subheading is Monitoring.

2. If you haven't created your notification channels and if you want to be notified, then click Edit Notification Channels and add your notification channels. Return to the Alerting page after you add your channels.
3. From the Alerting page, select Create policy.
4. To select the metric, expand the Select a metric menu and then do the following:
   1. To limit the menu to relevant entries, enter Regional External Application Load Balancer Rule into the filter bar. If there are no results after you filter the menu, then disable the Show only active resources & metrics toggle.
   2. For the Resource type, select Regional External Application Load Balancer Rule.
   3. Select a Metric category and a Metric, and then select Apply.
5. Click Next.
6. The settings in the Configure alert trigger page determine when the alert is triggered. Select a condition type and, if necessary, specify a threshold. For more information, see Create metric-threshold alerting policies.
7. Click Next.
8. Optional: To add notifications to your alerting policy, click Notification channels. In the dialog, select one or more notification channels from the menu, and then click OK.
9. Optional: Update the Incident autoclose duration. This field determines when Monitoring closes incidents in the absence of metric data.
10. Optional: Click Documentation, and then add any information that you want included in a notification message.
11. Click Alert name and enter a name for the alerting policy.
12. Click Create Policy.

For more information, see

.

You can create custom Cloud Monitoring dashboards for the load balancer's metrics:

1. In the Google Cloud console, go to the Monitoring page.

   Go to Monitoring

2. Select Dashboards > Create Dashboard.

3. Click Add Chart, and then give the chart a title.

4. To identify the time series to be displayed, choose a resource type and metric type:

   1. In the Resource & Metric section, click the chart, and then in the Select a metric section, select from the available options:
   2. For a regional external Application Load Balancer, select the resource type Regional External Application Load Balancer Rule.
   3. Click Apply.

5. To specify monitoring filters, click Filters > Add filter.

6. Click Save.

Metrics for the external Application Load Balancers are exported to Cloud Monitoring in 1-minute granularity batches. Monitoring data is retained for six (6) weeks.

The dashboard provides data analysis in default intervals of 1H (one hour), 6H (six hours), 1D (one day), 1W (one week), and 6W (six weeks). You can manually request analysis in any interval from 6W to 1 minute.

You can monitor the following metrics for external Application Load Balancers.

The following metrics for regional external Application Load Balancers are reported into Cloud Monitoring. These metrics are prepended with loadbalancing.googleapis.com/.

A distribution of the total latency. Total latency is the time in milliseconds between the first byte of the request received by the proxy and the last byte of the response sent by the proxy. It includes: the time taken by the proxy to process the request, the time taken for the request to be sent from the proxy to the backend, the time taken by the backend to process the request, the time taken for the response to be sent back to the proxy, and the time taken for the proxy to process the response and send the response to the client.

It doesn't include the RTT between the client and the proxy. Additionally, pauses between requests on the same connection that use Connection: keep-alive do not affect the measurement. This measurement is typically reduced to the 95th percentile in Cloud Monitoring views.

A distribution of the backend latency. Backend latency is the time in milliseconds between the last byte of the request sent to the backend and the last byte of the response received by the proxy. It includes the time taken by the backend to process the request and the time taken for the response to be sent back to the proxy.

You can apply filters for metrics for external Application Load Balancers.

Metrics are aggregated for each regional external Application Load Balancer. You can filter aggregated metrics by using the following dimensions for resource.type="http_external_regional_lb_rule".

• UNMATCHED refers to a request that doesn't match any URL path rules, so it uses the default path rule.
• UNKNOWN indicates an internal error.

• Read conceptual information about external Application Load Balancers.

Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2025-08-07 UTC.

[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-07 UTC."],[],[]]

RetroSearch is an open source project built by @garambo | Open a GitHub Issue

Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo

HTML: 3.2 | Encoding: UTF-8 | Version: 0.7.4