A financial company is designing an operational observability strategy for a web application running on Compute Engine instances. To optimize Cloud Logging costs, the operations team must minimize the ingestion of high-volume verbose debug logs into the log bucket while ensuring that administrative security events trigger automated operational alerts in real time. Which TWO architectural and configuration actions should the team implement to meet these requirements? (Select TWO.)
- Configure an exclusion filter on the _Default log bucket to drop low-severity debug log entries prior to log ingestion.Answer
- Create a counter log-based metric filtered for administrative log events and attach a Cloud Monitoring alerting policy to that metric.Answer
- CAssign the primitive Editor (roles/editor) role to the custom service account attached to the Compute Engine instances to allow metric writing.
- DGrant the Service Account Admin (roles/iam.serviceAccountAdmin) role to operations engineers so they can run Compute Engine instances under the application service account.
- EAdd a log exclusion filter that drops all log entries with a severity of ERROR or higher to prevent log storage spikes.
Answer
The team should configure an exclusion filter on the _Default log bucket to drop low-severity debug logs and create a counter log-based metric for administrative events attached to a Cloud Monitoring alerting policy.
Configuring exclusion filters on the default log bucket prevents unwanted high-volume debug logs from being ingested into storage, effectively reducing costs. Additionally, creating a counter log-based metric for targeted administrative log events allows Cloud Monitoring to track log occurrences as time-series metrics and trigger automated alerts when thresholds are reached.
Step-by-Step Solution
Key Concept
Log Ingestion Control and Log-Based Metric Alerting