Logging

5.7 Logging

5.7.1 Ensure Stackdriver Kubernetes Logging and Monitoring is Enabled (Automated)

Recommended Action

Using Command Line:

STACKDRIVER KUBERNETES ENGINE MONITORING SUPPORT (PREFERRED): To enable Stackdriver Kubernetes Engine Monitoring for an existing cluster, run the following command:

gcloud container clusters update [CLUSTER_NAME] \
  --zone [COMPUTE_ZONE] \
  --enable-stackdriver-kubernetes

LEGACY STACKDRIVER SUPPORT: Both Logging and Monitoring support must be enabled. To enable Legacy Stackdriver Logging for an existing cluster, run the following command:

gcloud container clusters update [CLUSTER_NAME] --zone [COMPUTE_ZONE] \
  --logging-service logging.googleapis.com

To enable Legacy Stackdriver Monitoring for an existing cluster, run the following command:

gcloud container clusters update [CLUSTER_NAME] --zone [COMPUTE_ZONE] \
  --monitoring-service monitoring.googleapis.com

5.7.2 Enable Linux auditd logging (Manual)

Recommended Action

Using Command Line: Download the example manifests:

curl https://raw.githubusercontent.com/GoogleCloudPlatform/k8s-node-tools/master/os-audit/cos-auditd-logging.yaml \
  > cos-auditd-logging.yaml

Edit the example manifests if needed. Then, deploy them:

kubectl apply -f cos-auditd-logging.yaml

Verify that the logging Pods have started. If you defined a different Namespace in your manifests, replace cos-auditd with the name of the namespace you’re using:

kubectl get pods --namespace=cos-auditd