View audit logs for Cloud Run events

Logs Explorer

To view bocked deployment events in the Cloud Logging Logs Explorer, do the following:

1. Go to the Cloud Audit Logs Logs Explorer page:

   Go to Logs Explorer .

2. In the Project Selectorat the top of the page, select the Google Cloud project ID of the project in which you run Cloud Run.

3. Enter the following query in the search-query box:

     resource 
    . 
    type 
    = 
    "cloud_run_revision" 
    logName 
    : 
    "cloudaudit.googleapis.com 
    %2F 
    system_event" 
    protoPayload 
    . 
    response 
    . 
    status 
    . 
    conditions 
    . 
    reason 
    = 
    "ContainerImageUnauthorized" 
    
   

4. Select the time range in the time-range selector .

To search within the log entries, click Expand nested fields.

gcloud

To view policy violation events from the past week in Cloud Logging using the Google Cloud CLI, do the following:

 gcloud  
logging  
 read 
  
--order = 
 "desc" 
  
--freshness = 
7d  
 \ 
  
 'resource.type="cloud_run_revision" AND 
 logName:"cloudaudit.googleapis.com%2Fsystem_event" AND 
 protoPayload.response.status.conditions.reason="ContainerImageUnauthorized"' 
 

Logs Explorer

To view breakglass events in the Cloud Logging Logs Explorer, do the following:

1. Go to the Cloud Audit Logs Logs Explorer page:

   Go to Logs Explorer .

2. In the Project Selectorat the top of the page, select the project ID of the project in which you run Cloud Run.

3. Enter the following in the search-query box:

     resource 
    . 
    type 
    = 
    "cloud_run_revision" 
    logName 
    : 
    "cloudaudit.googleapis.com%2Fsystem_event" 
    "breakglass" 
    
   

   To further refine your search, add the following lines:

    resource.labels.service_name = SERVICE_NAME 
   resource.labels.location = LOCATION 
    
   

   View breakglass deployments in Cloud Logging

4. Select the time range in the time-range selector .

To search within the log entries, click Expand nested fields.

gcloud

To view breakglass events from the past week in Cloud Logging using the gcloud CLI, do the following:

 gcloud  
logging  
 read 
  
--order = 
 "desc" 
  
--freshness = 
7d  
 \ 
  
 'resource.type="cloud_run_revision" AND 
 logName:"cloudaudit.googleapis.com%2Fsystem_event" AND 
 "breakglass"' 
 

Logs Explorer

To view fail open events in the Cloud Logging Logs Explorer, do the following:

1. Go to the Cloud Audit Logs Logs Explorer page:

   Go to Logs Explorer .

2. In the Project Selectorat the top of the page, select the project ID of the project in which you run Cloud Run.

3. Enter the following in the search-query box:

      
    resource 
    . 
    type 
    = 
    "cloud_run_revision" 
     
    logName 
    : 
    "cloudaudit.googleapis.com%2Fsystem_event" 
     
    "encountered an error" 
    
   

4. Select the time range in the time-range selector .

To search within the log entries, click Expand nested fields.

gcloud

To view fail open events from the past week in Cloud Logging using the gcloud CLI, do the following:

 gcloud  
logging  
 read 
  
--order = 
 "desc" 
  
--freshness = 
7d  
 \ 
  
 'resource.type="cloud_run_revision" AND 
 logName:"cloudaudit.googleapis.com%2Fsystem_event" AND 
 "encountered an error"' 
 

Logs Explorer

To view dry run events in the Cloud Logging Logs Explorer, do the following:

1. Go to the Cloud Audit Logs Logs Explorer page:

   Go to Logs Explorer .

2. In the Project Selectorat the top of the page, select the project ID of the project in which you run Cloud Run.

3. Enter the following in the search-query box:

     resource 
    . 
    type 
    = 
    "cloud_run_revision" 
    logName 
    : 
    "cloudaudit.googleapis.com%2Fsystem_event" 
    "dry run" 
    
   

4. Select the time range in the time-range selector .

To search within the log entries, click Expand nested fields.

gcloud

To view dry run deployment events from the past week in Cloud Logging using the gcloud CLI, do the following:

 gcloud  
logging  
 read 
  
--order = 
 "desc" 
  
--freshness = 
7d  
 \ 
  
 'resource.type="cloud_run_revision" AND 
 logName:"cloudaudit.googleapis.com%2Fsystem_event" AND 
 "dry run"'