4.4.2. Cloud Logging: Audit Logs, Log Routing, and Exports
💡 First Principle: Every log in Cloud Logging eventually ends up in exactly one place unless you deliberately route it elsewhere — understanding log buckets, routers, and exports is understanding how to redirect that default flow toward wherever the log actually needs to live for compliance, analysis, or retention.
Audit logs — including VPC Flow Logs (network traffic metadata) and firewall logs (which rules matched which traffic) — must be explicitly configured and enabled for many log types (Data Access audit logs, in particular, are off by default due to volume). Exporting logs to external systems — on-premises, BigQuery for SQL-based analysis, or Cloud Storage for cheap long-term archival — is how you escape the default retention window entirely. Log buckets are the storage destination logs land in; log analytics lets you run SQL-like queries directly against a log bucket's contents; log routers define the rules determining which logs go to which bucket, sink, or export destination in the first place.
Viewing and filtering logs, and viewing specific log message details, both happen through the Logs Explorer, which supports structured filtering by resource type, severity, and free-text search across the log payload.
⚠️ Exam Trap: A scenario describing logs that need to persist far longer than 30 days, or be joined against other business data for reporting, is testing whether you know exporting to BigQuery or Cloud Storage is required — assuming the default log bucket handles long-term retention on its own is exactly the misconception the exam is checking for.
Reflection Question: A security team needs to retain audit logs for three years to satisfy a compliance requirement, well beyond the default log bucket's retention. What's the correct approach, and which two destinations are the typical choices?
