Monitor Private Service Connect connections (original) (raw)

This page describes how to monitor both the producer and consumer sides of Private Service Connect connections.

Private Service Connect exposes key metrics to Cloud Monitoring that give you insights into your Private Service Connect connections.

Metrics are sent automatically to Monitoring. There, you can create custom dashboards, set up alerts, and query the metrics.

For information about monitoring Private Service Connect connections that aren't supported by Private Service Connect metrics, seeLimitations.

Monitor published services

You can monitor published services by using predefined dashboards or Google Cloud metrics.

View dashboards for published services

Private Service Connect provides a set of predefined dashboards that display the following metrics for a published service:

• Connected forwarding rules
• NAT IP addresses in use
• Open connections
• New connections
• Closed connections
• Network traffic
• Network packets
• Dropped sent packets
• Dropped received packets

To view predefined dashboards from the details page of a particular Private Service Connect published service, follow these steps:

Console

1. In the Google Cloud console, go to the Private Service Connect page.
   Go to Private Service Connect
2. Click the Published services tab.
3. Click an existing service.
4. Click the Monitoring tab.
   You can change the view of the charts by using the control at the top of the page. Hovering over a point on the graph gives you details for that specific time.

Metrics for published services

The "metric type" strings in this table must be prefixed with compute.googleapis.com/. That prefix has been omitted from the entries in the table.

For a full list of Google Cloud metrics, seeGoogle Cloud metrics.

For information about using these metrics for troubleshooting, seepublished service troubleshooting.

Monitor endpoints and backends that connect to published services

This section describes how to monitor Private Service Connect endpoints and backends that connect to published services. The available options depend on the type of consumer (endpoint or backend).

This section doesn't apply to endpoints or backends that connect to Google APIs. For information about monitoring Google APIs, seeLimitations.

View dashboards for endpoints

Private Service Connect provides a set of predefined dashboards that display the following metrics for endpoints that connect to published services:

• Open connections
• New connections
• Closed connections
• Network traffic
• Network packets
• Dropped sent packets
• Dropped received packets

To view predefined dashboards from the details page of a particular Private Service Connect endpoint, follow these steps:

Console

1. In the Google Cloud console, go to the Private Service Connect page.
   Go to Private Service Connect
2. Click the Connected endpoints tab.
3. Click an endpoint that connects to a published service.
4. Click the Monitoring tab.
   You can change the view of the charts by using the control at the top of the page. Hovering over a point on the graph gives you details for that specific time.

Metrics for endpoints and backends

Both Private Service Connect endpoints andbackends are monitored asPrivate Service Connect Endpoint resources.

The metrics in this table are not generated for endpoints or backends that connect to Google APIs.

The "metric type" strings in this table must be prefixed with compute.googleapis.com/. That prefix has been omitted from the entries in the table.

For a full list of Google Cloud metrics, seeGoogle Cloud metrics.

For information about using these metrics to troubleshoot endpoints, seeendpoint troubleshooting.

For information about using these metrics to troubleshoot backends, seebackend troubleshooting.

Define alerting policies

To create a metrics-based alerting policy, follow these steps. Use a resource type of Service Attachment for metrics about published services. Use a resource type of Private Service Connect Endpoint for metrics about endpoints or backends.

Console

You can create alerting policies to monitor the values of metrics and to notify you when those metrics violate a condition.

1. In the Google Cloud console, go to theAlerting page:
   Go to Alerting
   If you use the search bar to find this page, then select the result whose subheading isMonitoring.
2. If you haven't created your notification channels and if you want to be notified, then clickEdit Notification Channels and add your notification channels. Return to theAlerting page after you add your channels.
3. From the Alerting page, select Create policy.
4. To select the metric, expand the Select a metric menu and then do the following:
   1. To limit the menu to relevant entries, enter the resource type into the filter bar. If there are no results after you filter the menu, then disable the Show only active resources & metrics toggle.
   2. For the Resource type, select the resource type.
   3. For the Metric category, select Private_service_connect.
   4. For the Metric, select the metric to use for this policy.
   5. Select Apply.
5. Click Next.
6. The settings in the Configure alert trigger page determine when the alert is triggered. Select a condition type and, if necessary, specify a threshold. For more information, seeCreate metric-threshold alerting policies.
7. Click Next.
8. Optional: To add notifications to your alerting policy, clickNotification channels. In the dialog, select one or more notification channels from the menu, and then click OK.
9. Optional: Update the Incident autoclose duration. This field determines when Monitoring closes incidents in the absence of metric data.
10. Optional: Click Documentation, and then add any information that you want included in a notification message.
11. Click Alert name and enter a name for the alerting policy.
12. Click Create Policy. For more information, see Alerting overview.

View logs

You can view logs for Private Service Connect endpoints and published services by using Cloud Logging. Cloud Logging is a fully managed service that lets you store, search, analyze, monitor, and alert on logging data and events.

• Audit logs let you monitor Private Service Connect activity. Admin Activity audit logs are always written.
• VPC Flow Logs lets you monitor Private Service Connect traffic. You must enable VPC Flow Logs for each subnet, VLAN attachment for Cloud Interconnect, or Cloud VPN tunnel that you want to monitor.

You can use these logs to correlate events between the service consumer and service producer. For example, if the connection status of a consumer forwarding rule changes unexpectedly, you can request that the service producer verify their logs for any service attachment deletion or update events.

Console

1. In the Google Cloud console, go to the Logs Explorer page.
   Go to Logs Explorer
2. If you don't see the query editor field in the Query pane, click theShow query toggle.
3. In the query editor field, enter a query. For example, to view an endpoint's connection status change, enter the following query, replacing CONSUMER_PROJECT_ID with the consumer project ID:
   resource.type="gce_forwarding_rule"
   log_name="projects/CONSUMER_PROJECT_ID/logs/cloudaudit.googleapis.com%2Fsystem_event"
   protoPayload.methodName="LogPscConnectionStatusUpdate"
   For more examples of queries that you can run to view common logging events, see Common logging events for endpoints.
4. Click Run query.

For more information about querying your audit logs, see Viewing audit logs.

Common logging events for published services

The following table lists common logging events for Private Service Connect published services.

Replace the following:

• PRODUCER_PROJECT_ID: the project ID of the service producer.
• CONSUMER_PROJECT_ID: the project ID of the service consumer.
• PSC_SUBNET_REGEX: a regular expression that matches a pattern in the Private Service Connect subnet. For example, replace PSC_SUBNET_REGEX with 172\.16\.[0-1] if the Private Service Connect subnet is 172.16.0.0/23.
• VM_INSTANCE_PREFIX: the prefix of the backend VM instances.

Common logging events for endpoints

The following table lists common logging events for Private Service Connect endpoints.

Replace the following:

• CONSUMER_PROJECT_ID: the project ID of the service consumer.
• PSC_ENDPOINT_IP_ADDRESS: the IP address of the Private Service Connect endpoint.
• VM_INSTANCE_NAME: the name of a source VM instance in the project of the service consumer.
• GATEWAY_NAME: the name of a source VLAN attachment or Cloud VPN tunnel in the project of the service consumer.

Logging events for Composite Health

If a published service is configured to useComposite Health, you can use the following queries in the Logs Explorer to viewhealth state transitions. These logs are generated each time a monitored resource changes its state—for example, from HEALTHY to UNHEALTHY.

Logging is enabled by default for producer resources (health sources and composite health checks) and consumer resources (Private Service Connect NEGs that connect to published services that use Composite Health).

Replace PROJECT_ID with your project ID.

Limitations

Private Service Connect metrics have the following limitations:

• Unsupported load balancers: Private Service Connect metrics aren't generated for services that are published through global external proxy Network Load Balancers or global external Application Load Balancers.
  To monitor services that use these load balancers, use the load balancer's metrics and logs. For more information, see the following:
  • Proxy Network Load Balancer logging and monitoring
  • Global external Application Load Balancer logging and monitoring
• Google APIs: Private Service Connect metrics aren't available for endpoints or backends that connect to Google APIs. You can use one of the following alternative methods to monitor connections to Google APIs:
  • Use load balancer monitoring with Private Service Connect backends: If you connect to Google APIs by using a Private Service Connect backend, you can use the load balancer's metrics and logging to monitor API traffic. For more information, seeExternal Application Load Balancer logging and monitoring.
  • Use VPC Flow Logs with Private Service Connect endpoints: If you connect to Google APIs by using a Private Service Connect endpoint, you can monitor API traffic by configuring VPC Flow Logs. You can analyze information from VPC Flow Logs by usingFlow Analyzer.

What's next

• Learn more about Monitoring
• Learn more about Logging