Cloud Logging

Module: Cloud Logging

Module flag: logging Enabled by default: yes

---

Overview

The Cloud Logging module fetches recent log entries filtered by severity and resource type. Use it for rapid incident triage, error pattern identification, and audit log review.

---

Enable This Module

GCP_PROJECT_ID=my-project ./aura-tracker-gcp --modules logging

---

Required GCP APIs

gcloud services enable logging.googleapis.com

---

Required IAM Permissions

Role	Tools that need it
roles/logging.viewer	All tools

---

Tools

gcp_logging_query_recent

Fetches recent Cloud Logging entries using a filter expression.

Parameters:

Name	Required	Description
project_id	yes	GCP project ID
filter	no	Cloud Logging filter expression; defaults to all logs
severity	no	Minimum severity: DEFAULT, DEBUG, INFO, NOTICE, WARNING, ERROR, CRITICAL, ALERT, EMERGENCY
hours	no	Lookback window in hours (default: 1)
limit	no	Max entries to return (default: 50)

Returns: Timestamp, severity, resource type, resource labels, log name, text payload or JSON payload, trace ID.

---

Prompt Examples

Error triage

"Show me the last 50 ERROR logs from Cloud Run services in project my-project over the past 2 hours."

Service-specific logs

"Fetch recent ERROR and CRITICAL logs for the Cloud Run service payments-api in project my-project."

Audit log review

"Show me recent cloudaudit.googleapis.com/activity logs for project my-project — any IAM policy changes?"

Filter by trace

"Find all logs in project my-project associated with trace ID abc123def456."

---

Related Modules

Module flag	Why you'd combine it
cloudrun	Get service context alongside its logs
monitoring	Correlate log error spikes with metric anomalies
aura	Aura Score includes log-based error signals for GKE
coverage	Coverage analysis checks whether logging signals exist per node