​
Event Information

  1. The google.logging.v2.MetricsServiceV2.DeleteLogMetric event in GCP for Logging indicates that a log metric has been deleted.
  2. This event is triggered when a user or an automated process deletes a log metric using the Metrics API in GCP.
  3. The event provides information about the deleted log metric, such as the metric name, project ID, and the user or service account that initiated the deletion.

​
Examples

  • Unauthorized access: If the necessary access controls and permissions are not properly configured, an unauthorized user may be able to delete log metrics using the google.logging.v2.MetricsServiceV2.DeleteLogMetric API. This can lead to the loss of important log data and impact the security of the system.
  • Lack of audit trail: If there is no proper logging and monitoring in place, it may be difficult to track and investigate the deletion of log metrics. This can hinder the ability to identify any malicious activity or unauthorized deletions, impacting the security of the system.
  • Data loss: If log metrics are deleted without proper backups or redundancy mechanisms, it can result in the permanent loss of valuable log data. This can impact the ability to detect and respond to security incidents, as well as hinder compliance with regulatory requirements.

​
Remediation

​
Using Console

  1. Enable GCP Logging:
    • Open the GCP Console and navigate to the Logging page.
    • Click on “Logs Explorer” in the left-hand menu.
    • Select the desired project from the drop-down menu.
    • Click on “Create Sink” to create a new log sink.
    • Choose the log type you want to export, such as “Admin Activity” or “Data Access”.
    • Select the destination for the logs, such as BigQuery, Pub/Sub, or Cloud Storage.
    • Configure any additional settings, such as filter expressions or log format.
    • Click on “Create Sink” to save the configuration.
  2. Set up Log-Based Metrics:
    • Open the GCP Console and navigate to the Logging page.
    • Click on “Metrics Explorer” in the left-hand menu.
    • Select the desired project from the drop-down menu.
    • Click on “Create Metric” to create a new log-based metric.
    • Define the metric name, description, and filter expression.
    • Configure the aggregation type and interval for the metric.
    • Optionally, add labels to the metric for better organization.
    • Click on “Create Metric” to save the configuration.
  3. Create Alerting Policies:
    • Open the GCP Console and navigate to the Monitoring page.
    • Click on “Alerting” in the left-hand menu.
    • Select the desired project from the drop-down menu.
    • Click on “Create Policy” to create a new alerting policy.
    • Define the policy name, condition, and trigger threshold.
    • Choose the notification channels to receive alerts, such as email or SMS.
    • Configure any additional settings, such as notification delay or documentation.
    • Click on “Save” to save the policy configuration.
Note: These steps may vary slightly depending on the specific version of the GCP Console and the user’s access permissions. It is recommended to refer to the official GCP documentation for detailed instructions.

​
Using CLI

  1. Enable GCP Logging for a specific project:
  • Use the command gcloud logging project-logs create to create a new log sink for the project.
  • Specify the log sink’s destination using the --destination flag, which can be a Cloud Storage bucket, BigQuery dataset, or Pub/Sub topic.
  • Use the --log-filter flag to define the logs you want to export to the log sink.
  1. Configure GCP Logging to export logs to Cloud Storage:
  • Use the command gcloud logging sinks create to create a new log sink.
  • Specify the log sink’s destination using the --destination flag, providing the Cloud Storage bucket’s name.
  • Use the --log-filter flag to define the logs you want to export to the log sink.
  1. Export GCP Audit Logs to BigQuery:
  • Use the command gcloud logging sinks create to create a new log sink.
  • Specify the log sink’s destination using the --destination flag, providing the BigQuery dataset’s name.
  • Use the --log-filter flag to define the logs you want to export to the log sink.
  • Add the --include-children flag to include logs from child resources.
Note: The above commands assume that you have the necessary permissions to create log sinks and access the specified destinations.

​
Using Python

To remediate GCP Logging issues using Python, you can use the following approaches:
  1. Enable GCP Logging API:
    • Use the google-cloud-logging library to enable the GCP Logging API.
    • Install the library using pip install google-cloud-logging.
    • Use the following Python script to enable the GCP Logging API:
    from google.cloud import logging_v2

def enable_logging_api(project_id):
    client = logging_v2.LoggingServiceV2Client()
    project_name = f"projects/{project_id}"
    client.update_project(project_name, {"logging_service": "logging.googleapis.com"})

enable_logging_api("your-project-id")
  2. Create a Log Sink:
    • Use the google-cloud-logging library to create a log sink.
    • Install the library using pip install google-cloud-logging.
    • Use the following Python script to create a log sink:
    from google.cloud import logging_v2

def create_log_sink(project_id, sink_name, destination_bucket):
    client = logging_v2.ConfigServiceV2Client()
    project_name = f"projects/{project_id}"
    sink = {
        "name": sink_name,
        "destination": f"storage.googleapis.com/{destination_bucket}",
        "filter": "severity >= ERROR",
    }
    client.create_sink(project_name, sink)

create_log_sink("your-project-id", "your-sink-name", "your-destination-bucket")
  3. Export Logs to BigQuery:
    • Use the google-cloud-logging library to export logs to BigQuery.
    • Install the library using pip install google-cloud-logging.
    • Use the following Python script to export logs to BigQuery:
    from google.cloud import logging_v2

def export_logs_to_bigquery(project_id, dataset_id, table_id):
    client = logging_v2.ConfigServiceV2Client()
    project_name = f"projects/{project_id}"
    destination = f"bigquery.googleapis.com/projects/{project_id}/datasets/{dataset_id}/tables/{table_id}"
    sink = {
        "name": "export-logs-to-bigquery",
        "destination": destination,
        "filter": "severity >= ERROR",
    }
    client.create_sink(project_name, sink)

export_logs_to_bigquery("your-project-id", "your-dataset-id", "your-table-id")
Please note that you need to replace the placeholders (your-project-id, your-sink-name, your-destination-bucket, your-dataset-id, your-table-id) with the actual values specific to your GCP environment.