An IT operations team needs to set up observability for a fleet of Compute Engine virtual machines. They require collecting detailed system memory and disk utilization metrics, as well as automatically exporting all ERROR and CRITICAL level application logs to a centralized BigQuery dataset located in a separate security administration project. Which TWO actions should the team take to meet these requirements following Google Cloud recommended practices?
- Install and configure the unified Google Cloud Ops Agent on the Compute Engine VM instances.Cevap
- Create a Log Router sink in Cloud Logging with a severity filter of ERROR or higher, and assign the sink's writer service account the BigQuery Data Editor role on the target dataset.Cevap
- CInstall both the standalone legacy Stackdriver Monitoring Agent and the legacy Stackdriver Logging Agent on each virtual machine.
- DGrant the Project Owner primitive role to the Log Router service account on the organization level.
Cevap
The team must install the unified Google Cloud Ops Agent on the Compute Engine VM instances and create a Log Router sink targeting BigQuery while granting the sink's writer service account the BigQuery Data Editor role.
To collect system-level memory and detailed disk telemetry alongside logs from Compute Engine VMs, installing the unified Google Cloud Ops Agent is the standard Google Cloud recommendation. For exporting specific log levels across projects, setting up a Log Router sink with a severity filter targeting BigQuery and assigning the sink's writer identity the BigQuery Data Editor role properly establishes routing with least-privilege security.
Adım Adım Çözüm
Anahtar Kavram
Telemetry collection via Google Cloud Ops Agent and Log Router sink delegation with IAM least privilege