This page provides information about logging and monitoring metrics for Cloud DNS including public zones, private zones, and forwarding zones. This page also provides instructions for monitoring the propagation of your public DNS changes.
Use Cloud DNS logging
Cloud DNS logging tracks queries that name servers resolve for your Virtual Private Cloud (VPC) networks, as well as queries from an external entity directly to a public zone.
Logged queries can come from Compute Engine virtual machine (VM) instances, Google Kubernetes Engine containers in the same VPC network, peering zones, or on-premises clients that use inbound DNS forwarding. Private DNS zones, forwarding DNS zones, alternative name servers, internal Google Cloud DNS zones, or external DNS zones might eventually resolve the queries.
Log records belong to the project that owns the network or public zone that carried the request. In the case of Shared VPC, the log records belong to the host project because the host project owns the network.
Enable logging for private managed zones
Use DNS policies to enable or disable logging for your networks. When you enable query logging, every DNS query to a Cloud DNS private managed zone is logged.
To enable logging for a network that does not have a DNS policy, complete the following steps.
Console
In the Google Cloud console, go to the Create a DNS policy page.
For Name, enter a name for your policy.
Optionally, enter a description for Description.
For Logs, select On.
In the Networks section, click Add networks and choose the networks you need.
Click Create.
gcloud
Run the
dns policies create command.
gcloud dns policies create POLICY_NAME \
--networks=NETWORK \
--enable-logging \
--description=DESCRIPTIONReplace the following:
POLICY_NAME: the name of the DNS policyNETWORK: one or more networks in a comma-separated listDESCRIPTION: a description of the policy
To enable logging for a network that has an existing DNS policy, complete the following steps.
Console
In the Google Cloud console, go to the Cloud DNS policies page.
Click the DNS server policy you want to update.
Click Edit policy
In the Logs section, select On.
Click Save.
gcloud
Run the
dns policies update command.
gcloud dns policies update POLICY_NAME \
--networks=NETWORK \
--enable-logging
Replace the following:
POLICY_NAME: the name of the DNS policyNETWORK: one or more networks in a comma-separated list
Disable logging for private managed zones
To turn off logging while leaving the policy in place, complete the following steps.
Console
In the Google Cloud console, go to the Cloud DNS policies page.
Click the DNS server policy you want to update.
Click Edit policy
In the Logs section, select Off.
Click Save.
gcloud
Run the
dns policies update command.
gcloud dns policies update POLICY_NAME \
--networks=NETWORK \
--no-enable-loggingReplace the following:
POLICY_NAME: the name of the DNS policyNETWORK: one or more networks in a comma-separated list
Enable logging for managed public zones
To turn on logging for an existing managed public zone, complete the following steps.
Console
In the Google Cloud console, go to the Cloud DNS zones page.
Click the managed public zone you want to enable logging.
Click Edit.
In the Cloud Logging section, click On.
Click Save.
gcloud
Run the
dns managed-zones update
command.
gcloud dns managed-zones update ZONE_NAME --log-dns-queries \
Replace ZONE_NAME with the name of the DNS managed zone that
you want to enable logging for.
Disable logging for managed public zones
To turn off logging for an existing public managed zone.
Console
In the Google Cloud console, go to the Cloud DNS zones page.
Click the managed public zone you want to enable logging.
Click Edit.
In the Cloud Logging section, click Off.
Click Save.
gcloud
Run the
dns managed-zones update
command.
gcloud dns managed-zones update ZONE_NAME --no-log-dns-queries \
Replace ZONE_NAME with the name of the DNS managed zone that
you want to disable logging for.
View logs
You can view logs in the Google Cloud console.
Console
In the Google Cloud console, go to the Logs Explorer page.
View record format fields
Every log entry has the following fields, if applicable. Some of the fields are also shared with monitoring metrics.
| Field | Field type | Description | Used in metrics |
|---|---|---|---|
alias_query_response_code |
String | The response code returned from the query to resolve the ALIAS record's canonical name | Yes |
authAnswer |
Boolean / DNS | Authoritative answer, IANA DNS Parameters: DNS Header Flags | No |
destinationIP |
String / Target | Target IP address, only applicable for forwarding cases | No |
egressError |
String | Egress proxy error, the actual error reported by the egress proxy as received from the on-premises DNS server This field can be used to differentiate an actual SERVFAIL returned by the on-premises DNS versus a network error encountered by the egress proxy |
No |
healthyIps |
String | Set of IP addresses in the ResourceRecordSet that are known to be
|
No |
location |
String | Google Cloud region, for example us-east1, from
which the response was served |
Yes |
project_id |
String | Google Cloud project ID of the network from which the query was received | Yes |
protocol |
String / DNS | TCP | UDP |
No |
queryName |
String / DNS | DNS query name, RFC 1035 4.1.2 | No |
queryType |
String / DNS | DNS query type, IANA DNS Parameters: Resource Record (RR) TYPEs | No |
responseCode |
Number / DNS | Response code, IANA DNS Parameters: DNS RCODEs | No |
rdata |
String / DNS | DNS answer in presentation format, IANA DNS Parameters: Resource Record (RR) TYPEs, truncated to 260 bytes | No |
sourceIP |
String / Source | IP originating the query | No |
sourceNetwork |
String / Source | Network from which the query reached our system | No |
source_type |
String |