Audit logs overview

Audit logs in Google Distributed Cloud (GDC) air-gapped appliance let you track administrative activities and resource access across your environment. These records help you maintain security and compliance by answering the question "who did what, where, and when?" for system events.

You can review descriptions of audited operations in GDC and sample log file entries when constructing LogQL (Log Query Language) expressions to search your audit logs. For more information, see Query and view logs.

To inspect audit log schemas and component events, review the following references:

• Audited components: Details the key fields in audit logs generated by GDC components, with examples for querying audited operations.
• Audit log sources: Describes the JSON structure and fields for raw audit log entries so that you can monitor, troubleshoot, and audit your environment.