Question

Difficulty: MediumConfiguring Cloud Logging, Monitoring, and Operational Alerting

An operations team needs to set up automated alerting for specific application error logs occurring in a Compute Engine environment. Order the configuration steps from first to last to establish a complete log-based alerting workflow.

  1. 1Define a filter query in Cloud Logging to isolate the specific application log entries indicating critical errors.
  2. 2Create a counter log-based metric based on the constructed log filter query.
  3. 3Build a Cloud Monitoring alert policy with a threshold condition monitoring the custom log-based metric.
  4. 4Attach a notification channel (e.g., Slack or Email) to the alert policy to send operational notifications when triggered.

Answer

The correct operational sequence begins with defining the log filter query in Cloud Logging, followed by building a custom log-based metric, configuring the Cloud Monitoring alert policy threshold on that metric, and finally attaching notification channels to deliver the alerts.
To alert on log events, you must first construct a log filter query in Cloud Logging to identify matching log lines. Second, you convert those matching logs into a time-series metric by creating a log-based metric. Third, you set up an alert policy within Cloud Monitoring that monitors the log-based metric threshold. Finally, you attach notification channels to the alert policy to notify personnel when the condition is violated.

Step-by-Step Solution

1
Construct the log query filter in Cloud Logging
Specific error log entries are precisely selected from the project log streams.
Log-based metrics require a precise filter string to select which log events should be counted.
2
Create a custom counter log-based metric
A new time series metric (logging.googleapis.com/user/<metric_name>) is generated whenever matching log events arrive.
Cloud Monitoring cannot directly set alert policies on raw unstructured logs; log entries must first be converted into numerical metric time-series data.
3
Create an Alert Policy in Cloud Monitoring using the log-based metric
Threshold condition and aggregation window (e.g., rate of error logs > 5 over 5 minutes) are established.
Alerting policies evaluate conditions against metric time series data to determine incident status.
4
Configure and attach notification channels to the Alert Policy
Alert notifications are routed to on-call engineers via SMS, Email, PagerDuty, or Webhooks when incidents open.
Notification channels direct alert state changes to operational teams.

Key Concept

Configuring custom log-based metrics and operational alert policies in Google Cloud Monitoring
Estimated Time:1m 30s
Rate this question