Home - News ( United States | United Kingdom | Italy | Germany ) - Football scores

Showing content from http://cloud.google.com/load-balancing/docs/tcp/tcp-ssl-proxy-logging-monitoring below:

Proxy Network Load Balancer logging and monitoring | Load Balancing

Stay organized with collections Save and categorize content based on your preferences.

This page shows you how to configure and use Cloud Logging and Cloud Monitoring for proxy Network Load Balancers.

The following table specifies the resource names for the load balancers.

Regional external proxy Network Load Balancer

Regional internal proxy Network Load Balancer

Cross-region internal proxy Network Load Balancer

Global external proxy Network Load Balancer

Logs provide useful information for troubleshooting and monitoring load balancers. Logs are aggregated for each connection and give you insight into how each connection is routed to the serving backends.

There are no additional charges for using logs. However, based on how you import logs, standard pricing for Cloud Logging, BigQuery, or Pub/Sub applies. Also, enabling logs does not affect the performance of the load balancer.

The connections that leave and enter load balancer backend virtual machine (VM) instances are sampled. These sampled connections are then processed to generate logs. You control the fraction of the connections that are emitted as log entries according to the logConfig.sampleRate parameter. When logConfig.sampleRate is 1.0 (100%), this means that logs are generated for all of the connections and written to Cloud Logging.

Use the gcloud compute backend-services create command.

For regional external proxy Network Load Balancers and regional internal proxy Network Load Balancers:

    gcloud compute backend-services create BACKEND_SERVICE \
        --region=REGION \
        --enable-logging \
        --logging-sample-rate=SAMPLE_RATE
    

For global external proxy Network Load Balancers, classic proxy Network Load Balancers, or cross-region internal proxy Network Load Balancers:

    gcloud compute backend-services create BACKEND_SERVICE \
        --global \
        --enable-logging \
        --logging-sample-rate=SAMPLE_RATE
    

Replace the following:

• BACKEND_SERVICE: the name of the backend service.
• REGION: the region of the backend service to create.
• SAMPLE_RATE: this field can only be specified if logging is enabled for this backend service.

  The value of the field must be from 0.0 to 1.0, where 0.0 means that no logs are reported and 1.0 means that all connections are logged. Enabling logging but setting the sampling rate to 0.0 is equivalent to disabling logging. The default value is 1.0.

Make a POST request to the regionBackendServices.insert method:

For regional internal proxy Network Load Balancers:

    {
    "name": "BACKEND_SERVICE",
    "loadBalancingScheme": "INTERNAL_MANAGED",
    "logConfig": {
       "enable": true,
       "sampleRate": SAMPLE_RATE
      }
    }
    

For regional external proxy Network Load Balancers:

    {
    "name": "BACKEND_SERVICE",
    "loadBalancingScheme": "EXTERNAL_MANAGED",
    "logConfig": {
       "enable": true,
       "sampleRate": SAMPLE_RATE
      }
    }
    

For global external proxy Network Load Balancers:

Make a POST request to the backendServices.insert method:

    {
    "name": "BACKEND_SERVICE",
    "loadBalancingScheme": "EXTERNAL_MANAGED",
    "logConfig": {
       "enable": true,
       "sampleRate": SAMPLE_RATE
      }
    }
    

For classic proxy Network Load Balancers:

Make a POST request to the backendServices.insert method:

    {
    "name": "BACKEND_SERVICE",
    "loadBalancingScheme": "EXTERNAL",
    "logConfig": {
       "enable": true,
       "sampleRate": SAMPLE_RATE
      }
    }
    

For cross-region internal proxy Network Load Balancers:

Make a POST request to the backendServices.insert method:

    {
    "name": "BACKEND_SERVICE",
    "loadBalancingScheme": "INTERNAL_MANAGED",
    "logConfig": {
       "enable": true,
       "sampleRate": SAMPLE_RATE
      }
    }
    

Replace the following:

• BACKEND_SERVICE: the name of the backend service.
• SAMPLE_RATE: this field can only be specified if logging is enabled for this backend service.

  The value of the field must be from 0.0 to 1.0, where 0.0 means that no logs are reported and 1.0 means that all connections are logged. Enabling logging but setting the sampling rate to 0.0 is equivalent to disabling logging. The default value is 1.0.

Use the gcloud compute backend-services update command.

For regional external proxy Network Load Balancers and regional internal proxy Network Load Balancers:

    gcloud compute backend-services update BACKEND_SERVICE \
        --region=REGION \
        --enable-logging \
        --logging-sample-rate=SAMPLE_RATE
    

For global external proxy Network Load Balancers, classic proxy Network Load Balancers, or cross-region internal proxy Network Load Balancers:

    gcloud compute backend-services update BACKEND_SERVICE \
        --global \
        --enable-logging \
        --logging-sample-rate=SAMPLE_RATE
    

Replace the following:

• BACKEND_SERVICE: the name of the backend service.
• REGION: the region of the backend service to create.
• SAMPLE_RATE: this field can only be specified if logging is enabled for this backend service.

  The value of the field must be from 0.0 to 1.0, where 0.0 means that no logs are reported and 1.0 means that all connections are logged. Enabling logging but setting the sampling rate to 0.0 is equivalent to disabling logging. The default value is 1.0.

Make a PATCH request to the regionBackendServices/patch method:

      PATCH https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION/backendServices/BACKEND_SERVICE
     

For regional internal proxy Network Load Balancers:

    {
    "name": "BACKEND_SERVICE",
    "loadBalancingScheme": "INTERNAL_MANAGED",
    "logConfig": {
       "enable": true,
       "sampleRate": SAMPLE_RATE
      }
    }
    

For regional external proxy Network Load Balancers:

    {
    "name": "BACKEND_SERVICE",
    "loadBalancingScheme": "EXTERNAL_MANAGED",
    "logConfig": {
       "enable": true,
       "sampleRate": SAMPLE_RATE
      }
    }
    

For global external proxy Network Load Balancers:

Make a PATCH request to the backendServices/patch method:

      PATCH https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/global/backendServices/BACKEND_SERVICE
    {
    "name": "BACKEND_SERVICE",
    "loadBalancingScheme": "EXTERNAL_MANAGED",
    "logConfig": {
       "enable": true,
       "sampleRate": SAMPLE_RATE
      }
    }
    

For classic proxy Network Load Balancers:

Make a PATCH request to the backendServices/patch method:

      PATCH https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/global/backendServices/BACKEND_SERVICE
    {
    "name": "BACKEND_SERVICE",
    "loadBalancingScheme": "EXTERNAL",
    "logConfig": {
       "enable": true,
       "sampleRate": SAMPLE_RATE
      }
    }
    

For cross-region internal proxy Network Load Balancers:

Make a PATCH request to the backendServices/patch method:

      PATCH https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/global/backendServices/BACKEND_SERVICE
    {
    "name": "BACKEND_SERVICE",
    "loadBalancingScheme": "INTERNAL_MANAGED",
    "logConfig": {
       "enable": true,
       "sampleRate": SAMPLE_RATE
      }
    }
    

Replace the following:

• PROJECT_ID: the name of your project.
• BACKEND_SERVICE: the name of the backend service.
• SAMPLE_RATE: this field can only be specified if logging is enabled for this backend service.

  The value of the field must be from 0.0 to 1.0, where 0.0 means that no logs are reported and 1.0 means that all connections are logged. Enabling logging but setting the sampling rate to 0.0 is equivalent to disabling logging. The default value is 1.0.

Use the gcloud compute backend-services update command.

For regional external proxy Network Load Balancers and regional internal proxy Network Load Balancers:

gcloud compute backend-services update BACKEND_SERVICE \
   --region=REGION \
   --no-enable-logging

For global external proxy Network Load Balancers, classic proxy Network Load Balancers, or cross-region internal proxy Network Load Balancers:

gcloud compute backend-services update BACKEND_SERVICE \
   --global \
   --no-enable-logging

Replace the following:

• BACKEND_SERVICE: the name of the backend service.
• REGION: the region of the backend service.

For regional external proxy Network Load Balancers and regional internal proxy Network Load Balancers:

Make a PATCH request to the regionBackendServices/patch method:

 PATCH https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION/backendServices/BACKEND_SERVICE
  {
  "logConfig": {
    "enable": false
   }
  }
 

For global external proxy Network Load Balancers, classic proxy Network Load Balancers, or cross-region internal proxy Network Load Balancers:

Make a PATCH request to the backendServices/patch method:

 PATCH https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/global/backendServices/BACKEND_SERVICE
  {
  "logConfig": {
    "enable": false
   }
  }
 

Replace the following:

• PROJECT_ID: the name of your project.
• REGION: the region of the backend service.
• BACKEND_SERVICE: the name of the backend service.

When logs are ingested into Cloud Logging and not excluded through a Log Router sink, you can read logs by using the Cloud Logging API and the Google Cloud CLI.

To view all the logs, complete the following steps.

1. In the Google Cloud console, go to the Logs Explorer page.

   Go to Logs Explorer

2. Select the Proxy Network Load Balancer Rule resource type.

   Note: For classic proxy Network Load Balancers, select Global External Proxy Network Load Balancer Rule resource type.

3. Select the loadbalancing.googleapis.com/connections log name.

1. In the Google Cloud console, go to the Logs Explorer page.

   Go to Logs Explorer

2. Click the Show query toggle.

3. Paste the following into the query field.

   resource.type="LOG_RESOURCE_TYPE"
   logName="projects/PROJECT_ID/logs/loadbalancing.googleapis.com/connections"
   

4. Click Run query.

Replace the following:

• LOG_RESOURCE_TYPE: the logging monitored-resource type set to either l4_proxy_rule or tcp_ssl_proxy_rule.
• PROJECT_ID: the name of your project.

To view the logs for a specific backend service, complete the following steps.

1. In the Google Cloud console, go to the Logs Explorer page.

   Go to Logs Explorer

2. Click the Show query toggle.

3. Paste the following into the query field.

   resource.type="LOG_RESOURCE_TYPE"
   logName="projects/PROJECT_ID/logs/loadbalancing.googleapis.com/connections"
   resource.labels.backend_service_name="BACKEND_SERVICE_NAME"
   

4. Click Run query.

Replace the following:

• LOG_RESOURCE_TYPE: the logging monitored-resource type set to either l4_proxy_rule or tcp_ssl_proxy_rule.
• PROJECT_ID: the name of your project.
• BACKEND_SERVICE_NAME: the name of the backend service.

To view the logs for a specific backend instance group, complete the following steps.

1. In the Google Cloud console, go to the Logs Explorer page.

   Go to Logs Explorer

2. Click the Show query toggle.

3. Paste the following into the query field.

   resource.type="LOG_RESOURCE_TYPE"
   logName="projects/PROJECT_ID/logs/loadbalancing.googleapis.com/connections"
   resource.labels.backend_group_name="BACKEND_GROUP_NAME"
   

4. Click Run query.

Replace the following:

• LOG_RESOURCE_TYPE: the logging monitored-resource type set to either l4_proxy_rule or tcp_ssl_proxy_rule.
• PROJECT_ID: the name of your project.
• BACKEND_GROUP_NAME: the name of the instance group.

Log entries contain information useful for monitoring and debugging your traffic. Log records contain required fields, which are the default fields of every log record.

The MonitoredResource is the resource type associated with a log entry.

The MonitoredResourceDescriptor describes the schema of a MonitoredResource object by using a type name and a set of labels. For more information, see Resource labels.

• statusDetails
• Google Cloud Armor security policy log entries

• The proxyStatus field contains a string that specifies why the global external proxy Network Load Balancer, regional external proxy Network Load Balancer, and internal proxy Network Load Balancer returned the error code. This field is not supported for classic proxy Network Load Balancers.

  The field is not logged if the value is an empty string. This can happen if the proxy returns an error code that is not 0, 4XX, or 5XX.

  The proxyStatus field has two parts:

  • proxyStatus error
  • Optional: proxyStatus details
• backendNetworkName: specifies the VPC network of the backend.

Log records contain required fields, which are the default fields of every log record.

Some log fields contain more than one piece of data in a given field—these log fields are in a multi-field format. For example, the connection field is of the IpConnection format, which contains the source and destination IP address and port, plus the protocol, in a single field. These multi-field log fields are described in the following record format table.

The following table lists all the required log fields for the resource l4_proxy_rule.

The proxyStatus field contains a string that specifies why the load balancer returned an error. There are two parts in the proxyStatus field, proxyStatus error and proxyStatus details. This section describes the strings that are supported in the proxyStatus error field.

The proxyStatus error field is applicable to the following load balancers:

• Global external proxy Network Load Balancer
• Regional external proxy Network Load Balancer
• Cross-region internal proxy Network Load Balancer
• Regional internal proxy Network Load Balancer

The load balancer's connection to the backend ended before a complete response is received.

This proxyStatus error is returned during any of the following scenarios:

• The load balancer's connection to the backend ended before a complete response is received.
• The TLS connection failed on the SSL handshake, and the client didn't establish a connection with the load balancer.

The load balancer is configured to limit the number of connections it has to the backend, and that limit has been exceeded.

This proxyStatus error is returned during any of the following scenarios:

• If any backend is in maintenance mode, the traffic can't be routed to the backend.
• If the request is locally rate limited.
• Envoy is handling error conditions such as running out of memory.

The proxyStatus field contains a string that specifies why the load balancer returned an error. There are two parts in the proxyStatus field, proxyStatus error and proxyStatus details. The proxyStatus details field is optional and is shown only when additional information is available. This section describes the strings that are supported in the proxyStatus details field.

The proxyStatus details field is applicable to the following load balancers:

• Global external proxy Network Load Balancer
• Regional external proxy Network Load Balancer
• Regional internal proxy Network Load Balancer
• Cross-region internal proxy Network Load Balancer

When the TLS connection between the client and the load balancer fails before any backend is selected, log entries record the errors. You can configure the backend services with different log sample rates. When a TLS connection fails, the failed TLS connection log sample rate is the highest sample rate for any backend service. For example, if you have configured two backend services with logging sample rate as 0.3 and 0.5, the failed TLS connection log sample rate is 0.5.

You can identify failed TLS connections by checking for these log entry details:

• proxyStatus error type is tls_alert_received, tls_certificate_error, tls_protocol_error, or connection_terminated.
• There is no backend information.

The following sample shows a failed TLS log entry with the proxyStatus error field:

   json_payload:    {
   @type: "type.googleapis.com/google.cloud.loadbalancing.type.LoadBalancerLogEntry"
   proxyStatus: "error="tls_alert_received"; details="server_to_client: handshake_failure""
   log_name: "projects/529254013417/logs/mockservice.googleapis.com%20name"
   }
   http_request {
    latency {
      nanos: 12412000
    }
    protocol: "HTTP/1.0"
    remote_ip: "127.0.0.2"
   }
  resource {
    type: "mock_internal_http_lb_rule"
    labels {
      backend_name: ""
      backend_scope: ""
      backend_scope_type: "UNKNOWN"
      backend_target_name: ""
      backend_target_type: "UNKNOWN"
      backend_type: "UNKNOWN"
      forwarding_rule_name: "l7-ilb-https-forwarding-rule-dev"
      matched_url_path_rule: "UNKNOWN"
      network_name: "lb-network"
      region: "REGION"
      target_proxy_name: "l7-ilb-https-proxy-dev"
      url_map_name: ""
    }
  }
  timestamp: "2023-08-15T16:49:30.850785Z"
  

The following table lists the resource labels for resource type l4_proxy_rule.

The type of backend, either an instance group or a NEG, or unknown.

Cloud Logging logs requests when the backend_type is UNKNOWN even if logging is disabled. For example, if a client closes the connection to the load balancer before the load balancer can pick a backend, the backend_type is set to UNKNOWN and the request is logged. These logs provide useful debugging information about client requests that were closed because the load balancer couldn't select a backend.

The proxy Network Load Balancers export monitoring data to Cloud Monitoring.

Monitoring metrics can be used to do the following:

• Evaluate a load balancer's configuration, usage, and performance.
• Troubleshoot problems.
• Improve resource utilization and user experience.

In addition to the predefined dashboards in Monitoring, you can create custom dashboards, set up alerts, and query metrics by using the Cloud Monitoring API.

1. In the Google Cloud console, go to the Monitoring page.

   Go to Monitoring

2. If Resources appears in the navigation pane, select Resources, and then select Google Cloud Load Balancers. Otherwise, select Dashboards, and then select the dashboard named Google Cloud Load Balancers.

3. Click the name of your load balancer.

In the left pane, you can see various details for this load balancer. In the right pane, you can see timeseries graphs. To see specific breakdowns, click Breakdowns.

Metrics for the load balancers are exported to Monitoring in one-minute granularity batches. Monitoring data is retained for six (6) weeks. Metrics are based on sampled traffic (sampling rate is dynamic and cannot be adjusted).

The dashboard provides data analysis in default intervals of 1H (one hour), 6H (six hours), 1D (one day), 1W (one week), and 6W (six weeks). You can manually request analysis in any interval from six weeks to one minute.

The following metrics for classic proxy Network Load Balancers are reported into Monitoring.

The following metrics for regional internal proxy Network Load Balancers, regional external proxy Network Load Balancers, cross-region internal proxy Network Load Balancer, and global external proxy Network Load Balancers are reported into Monitoring.

Metrics are aggregated for each load balancer. Metrics can be further broken down by the following dimensions.

• To learn how SSL policies work, see the SSL policies overview.
• To learn how external proxy Network Load Balancers work, see the External proxy Network Load Balancer overview.
• To learn how internal proxy Network Load Balancers work, see the Internal proxy Network Load Balancer overview.

Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2025-08-07 UTC.

[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-07 UTC."],[],[]]

RetroSearch is an open source project built by @garambo | Open a GitHub Issue

Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo

HTML: 3.2 | Encoding: UTF-8 | Version: 0.7.4