Table of Contents
Query Google cloud logs
Login to Google console cloud and select the project from dropdown list and find the “Logging” product in hamburger menu (it's pinned here in the scrot, you will need to scroll down)
This should open the logs explorer, where you need to select the Resource from the dropdown.
For example to search access from IPs to BigQuery dataset choose BigQuery dataset then use a query, example
resource.type="bigquery_dataset"
logName=("projects/my-test-project/logs/cloudaudit.googleapis.com%2Factivity" OR "projects/my-test-project/logs/cloudaudit.googleapis.com%2Fdata_access")
-"BigQuery Data Transfer Service"
protoPayload.methodName="google.cloud.bigquery.v2.JobService.InsertJob"
-(protoPayload.requestMetadata.callerSuppliedUserAgent="Mozilla/5.0 (compatible; Google-Apps-Script),gzip(gfe)")
-(protoPayload.requestMetadata.callerIp="1.1.1.1")
-(protoPayload.requestMetadata.callerSuppliedUserAgent="Mozilla/5.0 (compatible; Google-Apps-Script; beanserver; +https://script.google.com),gzip(gfe)")
(protoPayload.resourceName="projects/my-test-project/datasets/test_raw_data/tables/TABLE_1")
timestamp>"2022-05-1" AND timestamp <"2022-05-2"
This will show logs that don't have callerIp set to 1.1.1.1 (“-” before parenthesis) among other filters set.
Tested on
- Google cloud console access on May 5th 2022.