Logs and metrics

This page explains how Certificate Manager logs various types of information about its operation and how to view that information.

Logs

To view Certificate Manager logs, use the Logs Explorer in the Google Cloud console.

Certificate Manager provides Google Cloud logs described in Google Cloud logs .

Certificate Manager uses Cloud Logging to capture and store logs. Certificate Manager logging is always enabled and only captures a minimal amount of information specifically related to certificate expiration. The Certificate Manager monitored resource type is certificatemanager.googleapis.com/Project .

You can also capture and retrieve Certificate Manager logs using Cloud Logging. See the documentation for Cloud Logging client libraries for information on how to configure this logging mechanism.

Configure log alerts

You can configure alerts for events that Certificate Manager writes to Cloud Logging, such as certificate expiration. For instructions, see Configure log-based alerts .

For example, to configure an alert for certificates that have expired, use the following as the alert query:

logName = "projects/ PROJECT_ID 
/logs/certificatemanager.googleapis.com%2Fcertificates_expiry" AND jsonPayload.state = "EXPIRED"

If you want to configure an alert for certificates that are close to expiration, use the following as the alert query:

logName = "projects/ PROJECT_ID 
/logs/certificatemanager.googleapis.com%2Fcertificates_expiry" AND jsonPayload.state = "CLOSE_TO_EXPIRY"

Replace PROJECT_ID with the ID of the target Google Cloud project.

For Google-managed certificates CLOSE_TO_EXPIRY logs are generated daily, starting 5-10 days before expiration, depending on the certificate's lifetime and renewal process. For self-managed certificates too, CLOSE_TO_EXPIRY logs are generated daily, starting 10 days before expiration.

Metrics

This section lists the metrics supported by Certificate Manager. To view Certificate Manager metrics, use the Metrics Explorer in the Google Cloud console.

Standard metrics

Certificate Manager writes the following standard Cloud Monitoring API metrics:

Metric

Description

serviceruntime.googleapis.com/api/request_count

Kind: Delta
Type: INT64
Unit: 1

Cumulative count of completed requests. The following labels apply:

protocol indicates the request's protocol, such as http or grpc .
response_code is the HTTP (or equivalent for gRPC) response code for HTTP/gRPC requests. See code list .
response_code_class is the class (or equivalent for gRPC) of the response code, such as `200` or `400`.
grpc_status_code is the gRPC response code or its HTTP equivalent. See code list .

serviceruntime.googleapis.com/api/request_latencies

Kind: Delta
Type: DISTRIBUTION
Unit: Seconds

Distribution of latencies for non-streaming requests.

serviceruntime.googleapis.com/api/request_sizes

Kind: Delta
Type: DISTRIBUTION
Unit: Byte

Distribution of request sizes. Request size is recorded when a request completes.

serviceruntime.googleapis.com/api/response_sizes

Kind: Delta
Type: DISTRIBUTION
Unit: Byte

Distribution of response sizes. Response size is recorded when a request completes.

Custom metrics

Additionally, Certificate Manager writes the following custom metrics using the Cloud Monitoring API:

Metric

Description

certificatemanager.googleapis.com/project/certificates

Kind: GAUGE
Type: INT64
Unit: 1

Number of certificates provisioned within the target Google Cloud project. The following labels apply:

type indicates whether the certificate is Google-managed ( MANAGED ) or self-managed ( SELF_MANAGED ).
scope indicates whether the certificate scope is Cloud Load Balancing ( DEFAULT ) or Media CDN ( EDGE_CACHE ).
is_active indicates whether the certificate is active. Valid values are true and false .

certificatemanager.googleapis.com/map/entries

Kind: GAUGE
Type: INT64
Unit: 1

Number of certificate map entries provisioned within the target Google Cloud project. The following labels apply:

is_primary indicates whether the certificate map entry is the primary entry in the certificate map. Valid values are true and false .

Logs and metrics Stay organized with collections Save and categorize content based on your preferences.