감사 로깅을 구성할 때는 서비스 이름 datastore.googleapis.com을 사용하여 datastore.googleapis.com 및 firestore.googleapis.com.
Once configured, logs for the Cloud Firestore with MongoDB compatibility API include the service namefirestore.googleapis.com`을 모두 구성하세요.
DATA_READ 또는 DATA_WRITE 요청을 처리하는 데 걸린 시간을 보려면 AuditLog의 metadata 객체 내에 있는 processing_duration 필드를 확인합니다.
processing_duration 필드는 데이터베이스가 요청을 처리하는 데 걸린 시간을 설명합니다. 이 값은 최종 사용자 지연 시간보다 작습니다. 특히 네트워크 오버헤드를 포함하지 않습니다.
서비스 이름
Cloud Firestore 감사 로그는 firestore.googleapis.com이라는 서비스 이름을 사용합니다.
이 서비스에 대한 필터:
각 IAM 권한에는 type 속성이 포함되며 그 값은 네 가지 값(ADMIN_READ, ADMIN_WRITE, DATA_READ, DATA_WRITE) 중 하나일 수 있는 열거형입니다. 메서드를 호출하면 Cloud Firestore에서 메서드를 수행하는 데 필요한 권한의 type 속성에 따라 범주가 달라지는 감사 로그를 생성합니다.
DATA_READ, DATA_WRITE, ADMIN_READ의 type 속성 값을 가진 IAM 권한이 필요한 메서드는 데이터 액세스 감사 로그를 생성합니다.
type 속성 값이 ADMIN_WRITE인 IAM 권한이 필요한 메서드는 관리자 활동 감사 로그를 생성합니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["필요한 정보가 없음","missingTheInformationINeed","thumb-down"],["너무 복잡함/단계 수가 너무 많음","tooComplicatedTooManySteps","thumb-down"],["오래됨","outOfDate","thumb-down"],["번역 문제","translationIssue","thumb-down"],["샘플/코드 문제","samplesCodeIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-08-31(UTC)"],[],[],null,["\u003cbr /\u003e\n\n\n|--------------------------------------------------------|\n| *Relevant to Cloud Firestore Enterprise edition only.* |\n\n\u003cbr /\u003e\n\nThis document describes audit logging for Cloud Firestore with MongoDB compatibility. Google Cloud\nservices generate audit logs that record administrative and access activities\nwithin your Google Cloud resources.\n\nFor more information about Cloud Audit Logs, see the following:\n\n- [Types of audit logs](https://cloud.google.com/logging/docs/audit#types)\n- [Audit log entry structure](https://cloud.google.com/logging/docs/audit#audit_log_entry_structure)\n- [Storing and routing audit logs](https://cloud.google.com/logging/docs/audit#storing_and_routing_audit_logs)\n- [Cloud Logging pricing summary](https://cloud.google.com/stackdriver/pricing#logs-pricing-summary)\n- [Enable Data Access audit logs](https://cloud.google.com/logging/docs/audit/configure-data-access)\n\nNotes\n\nWhen configuring audit logging, use the service name `datastore.googleapis.com`\nto configure both `datastore.googleapis.com` and `firestore.googleapis.com.\nOnce configured, logs for the Cloud Firestore with MongoDB compatibility API include the service name`firestore.googleapis.com\\`.\n\nTo view the time it took to process a `DATA_READ` or `DATA_WRITE` request, see\nthe `processing_duration` field within the `metadata` object of an `AuditLog`.\nThe `processing_duration` field describes the time the database took to process\na request. This is smaller than the end-user latency. In particular, it does\nnot include network overhead.\n\nService name\n\nCloud Firestore audit logs use the service name `firestore.googleapis.com`.\nFilter for this service: \n\n protoPayload.serviceName=\"firestore.googleapis.com\"\n\nMethods by permission type\n\nEach IAM permission has a `type` property, whose value is an enum\nthat can be one of four values: `ADMIN_READ`, `ADMIN_WRITE`, `DATA_READ`, or\n`DATA_WRITE`. When you call a method, Cloud Firestore generates an audit log whose category is dependent on the\n`type` property of the permission required to perform the method.\n\nMethods that require an IAM permission with the `type` property\nvalue of `DATA_READ`, `DATA_WRITE`, or `ADMIN_READ` generate\n[Data Access](https://cloud.google.com/logging/docs/audit/configure-data-access) audit logs.\n\nMethods that require an IAM permission with the `type` property\nvalue of `ADMIN_WRITE` generate\n[Admin Activity](https://cloud.google.com/logging/docs/audit#admin-activity) audit logs.\n\n| Permission type | Methods |\n|-----------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|\n| `ADMIN_READ` | `google.cloud.location.Locations.GetLocation` `google.cloud.location.Locations.ListLocations` `google.firestore.admin.v1.FirestoreAdmin.GetBackup` `google.firestore.admin.v1.FirestoreAdmin.GetBackupSchedule` `google.firestore.admin.v1.FirestoreAdmin.GetDatabase` `google.firestore.admin.v1.FirestoreAdmin.GetField` `google.firestore.admin.v1.FirestoreAdmin.GetIndex` `google.firestore.admin.v1.FirestoreAdmin.ListBackupSchedules` `google.firestore.admin.v1.FirestoreAdmin.ListBackups` `google.firestore.admin.v1.FirestoreAdmin.ListDatabases` `google.firestore.admin.v1.FirestoreAdmin.ListFields` `google.firestore.admin.v1.FirestoreAdmin.ListIndexes` `google.firestore.admin.v1beta1.FirestoreAdmin.GetIndex` `google.firestore.admin.v1.MongoDBCompatible.ListIndexes` `google.firestore.admin.v1.MongoDBCompatible.ListDatabases` |\n| `ADMIN_WRITE` | `google.firestore.admin.v1.FirestoreAdmin.CreateBackupSchedule` `google.firestore.admin.v1.FirestoreAdmin.CreateDatabase` `google.firestore.admin.v1.FirestoreAdmin.CreateIndex` `google.firestore.admin.v1.FirestoreAdmin.DeleteBackup` `google.firestore.admin.v1.FirestoreAdmin.DeleteBackupSchedule` `google.firestore.admin.v1.FirestoreAdmin.DeleteDatabase` `google.firestore.admin.v1.FirestoreAdmin.DeleteIndex` `google.firestore.admin.v1.FirestoreAdmin.RestoreDatabase` `google.firestore.admin.v1.FirestoreAdmin.UpdateBackupSchedule` `google.firestore.admin.v1.FirestoreAdmin.UpdateDatabase` `google.firestore.admin.v1.FirestoreAdmin.UpdateField` `google.longrunning.Operations.CancelOperation` `google.longrunning.Operations.DeleteOperation` |\n| `DATA_READ` | `google.firestore.v1.MongoDBCompatible.Find` `google.firestore.v1.MongoDBCompatible.Aggregate` `google.firestore.v1.MongoDBCompatible.GetMore` `google.firestore.v1.MongoDBCompatible.ListCollections` `google.firestore.v1.MongoDBCompatible.Count` `google.firestore.v1.MongoDBCompatible.Distinct` `google.firestore.v1.MongoDBCompatible.CommitTransaction` `google.firestore.v1.MongoDBCompatible.AbortTransaction` `google.firestore.v1.MongoDBCompatible.EndSessions` `google.firestore.v1.MongoDBCompatible.KillCursors` |\n| `DATA_WRITE` | `google.firestore.v1.MongoDBCompatible.Insert` `google.firestore.v1.MongoDBCompatible.Update` `google.firestore.v1.MongoDBCompatible.Delete` `google.firestore.v1.MongoDBCompatible.FindAndModify` `google.firestore.v1.MongoDBCompatible.CreateCollection` |\n\nIdentify request callers\n\nAudit Log entries include information about the identity that performed the\nlogged operation. To identify a request caller, see the following fields within\nan [`AuditLog`](https://cloud.google.com/logging/docs/reference/audit/auditlog/rest/Shared.Types/AuditLog) object:\n\n- The caller's identity is held in the\n [`AuthenticationInfo`](https://cloud.google.com/logging/docs/reference/audit/auditlog/rest/Shared.Types/AuditLog#AuthenticationInfo)\n field. This can include the `principalEmail` of the user. This information\n is [sometimes redacted](https://cloud.google.com/logging/docs/audit#user-id).\n\n- The `callerIp` field within the\n [`requestMetadata`](https://cloud.google.com/logging/docs/reference/audit/auditlog/rest/Shared.Types/AuditLog#requestmetadata)\n object of an `AuditLog` entry includes the IP address of the caller."]]
