Logs and metrics

Logging

Cloud NAT logging lets you log NAT connections and errors. When Cloud NAT logging is enabled, one log entry can be generated for each of the following scenarios:

  • When a network connection using NAT is created.
  • When a packet is dropped because no port was available for NAT.

You can choose to log both kinds of events, or only one or the other.

Created logs are sent to Cloud Logging.

Specifications

The following specifications apply to Cloud NAT logging:

  • Cloud NAT logging handles TCP and UDP traffic only.

  • Cloud NAT logging only logs dropped packets if they are egress (outbound) TCP and UDP packets. It does not log dropped incoming packets. For example, if an inbound response to an outbound request is dropped for any reason, no error is logged.

Each VM instance can only generate a certain number of log entries per unit time, proportional to its number of vCPUs. The VM can generate 50-100 log entries per second per vCPU.

  • This rate threshold affects the number of events that can be logged. Even if some events are filtered out, their occurrence counts toward the number of possible log entries. Limiting logs to only errors or only network address translation connections does not necessarily increase the number of viewed log entries. For example, if you choose to log only successful connections, periods of excessive failed connection attempts and NAT errors can still restrict the number of successful connection log entries.

  • Cloud NAT logging does not log every single packet. Even if the VM's rate threshold has not been reached, some conditions can cause events to be omitted from the log. You should rely on the presence of entries in Cloud NAT logging to make informed decisions, but you must not assume that the absence of entries means that an event didn't happen.

Configure logging

To configure Cloud NAT logging, follow these steps.

Enable logging

If logging is enabled, all collected logs are sent to Cloud Logging by default. You can filter these so that only certain logs are sent.

You can also specify these values when you create or edit a NAT gateway. The following directions show how to enable logging for an existing NAT gateway.

Console

  1. In the Google Cloud console, go to the Cloud NAT page.

    Go to Cloud NAT

  2. Click your NAT gateway.

  3. Click Edit.

  4. Click Advanced configurations.

  5. In the Logging section, select one of the following:

    • No logging: disables logging
    • Translation and errors: sends all logs to Logging
    • Translation only: sends a log only when a connection is created; does not log dropped packets
    • Errors only: sends a log when a packet is dropped because no port was available; does not log new connections

  6. Click Save.

gcloud

Use the gcloud compute routers nats update command.

The following commands enable logging for an existing NAT gateway.

In each command, replace the following:

  • NAT_GATEWAY: the name of the NAT gateway
  • ROUTER_NAME: the name of the Cloud Router that hosts the NAT gateway
  • REGION: the region of the Cloud Router

To log network address translation events and errors:

gcloud compute routers nats update NAT_GATEWAY \
    --router=ROUTER_NAME \
    --region=REGION \
    --enable-logging

To log only network address translation events:

gcloud compute routers nats update NAT_GATEWAY \
    --router=ROUTER_NAME \
    --region=REGION \
    --enable-logging \
    --log-filter=TRANSLATIONS_ONLY

To log only errors:

gcloud compute routers nats update NAT_GATEWAY \
    --router=ROUTER_NAME \
    --region=REGION \
    --enable-logging \
    --log-filter=ERRORS_ONLY

Clear log filters

If you have a filter set, you can clear it. Clearing a log filter means that both network address translation events and errors are logged, provided that logging is enabled.

Console

  1. In the Google Cloud console, go to the Cloud NAT page.

    Go to Cloud NAT

  2. Click your NAT gateway.

  3. Click Edit.

  4. Click Advanced configurations.

  5. In the Logging section, select Translation and errors.

  6. Click Save.

gcloud

Use the gcloud compute routers nats update command. The --log-filter=ALL flag in the following command sets the log filter to accept all logs.

gcloud compute routers nats update NAT_GATEWAY \
    --router=ROUTER_NAME \
    --region=REGION \
    --log-filter=ALL

Replace the following:

  • NAT_GATEWAY: the name of the NAT gateway
  • ROUTER_NAME: the name of the Cloud Router that hosts the NAT gateway
  • REGION: the region of the Cloud Router

Disable logging

To disable logging, do the following:

Console

  1. In the Google Cloud console, go to the Cloud NAT page.

    Go to Cloud NAT

  2. Click your NAT gateway.

  3. Click Edit.

  4. Click Advanced configurations.

  5. In the Logging section, select No logging.

  6. Click Save.

gcloud

Use the gcloud compute routers nats update command.

gcloud compute routers nats update NAT_GATEWAY \
    --router=ROUTER_NAME \
    --region=REGION \
    --no-enable-logging

Replace the following:

  • NAT_GATEWAY: the name of the NAT gateway
  • ROUTER_NAME: the name of the Cloud Router that hosts the NAT gateway
  • REGION: the region of the Cloud Router

Determine logging status

To determine the status for logging, do the following:

Console

  1. In the Google Cloud console, go to the Cloud NAT page.

    Go to Cloud NAT

  2. Click your NAT gateway.

  3. Click