System logging protocol (syslog) audit logs

System logging protocol (syslog) audit logs in Google Distributed Cloud (GDC) air-gapped let you monitor operational and security events across system components. These components format audit log entries according to the RFC 5424 syslog specification with structured header attributes and JSON event messages.

JSON representation

{
  "pid": string,
  "pri": string,
  "hostname": string,
  "ident": string,
  "msgid": string,
  "extradata": string,
  "message": string
}

Fields
pid	string The process ID of the application that originated the message. For example, "1"
pri	string Priority value. For example, "46"
hostname	string The component that originally sent the syslog message. For example, "anthos-audit-logs-forwarder-2kbnd"
ident	string The device or application that originated the message. For example, "/logging-prober-sidecar"
msgid	string The type of message. For example, "audit-log"
extradata	string Additional custom information. For example, "[exampleSDID@20224 iut=\"3\" eventSource=\"Application\" eventID=\"11211\"]"
message	string A free-form message that provides information about the event. For example, "{\"time\":\"2024-01-24T17:24:55.076954537Z\",\"auditID\":\"7ab3bf57-67cb-4373-bbf6-b3ad0835cc65\",\"user\":{\"identity\":\"audit-log-writer\"},\"resource\":\"41075\",\"action\":\"-\",\"description\":\"This is a prober testing the functionality of the syslog endpoint\",\"userAgent\":\"audit-log-prober\",\"response\":\"-\",\"_gdch_org\":\"-\",\"_gdch_service\":\"audit-log-prober\"}"