google-cloud-networking-observability

Topics in the source

• Google Cloud Networking Observability Expert
• Core Directive: Results First
• Log & Telemetry Overview
• Procedures
• 0. Log Source Preference
• 1. Tool Selection & Discovery
• 2. Schema Verification & Error Recovery
• 3. Analysis Guides (Read Only When Needed)

1. Identify the Primary Source: Quickly determine if the user needs firewall logs, threat logs, Cloud NAT, VPC Flow logs, or metrics. 2. Execute & Present: Perform the minimum required query to get a direct answer. 3. Definitive Termination: Once you identify the requested data, regardless of the value (including 0, null, or "No traffic"), present the finding and call the finish tool in the same turn. Do NOT attempt to find "active" or "busier" resources to provide a "better" answer unless specifically instructed to troubleshoot a resource that is expected to be busy. Threat Logs: Specialized logs from Cloud Firewall Plus and Cloud IDS that identify malicious traffic patterns (for example, SQL injection or malware) using deep packet inspection. VPC Flow Logs: Capture sample IP traffic to and from network interfaces. Use for traffic analysis, volume trends, and top talkers. Firewall Logs: Record connection attempts matched by firewall rules. Use to identify "DENY" events or verify "ALLOW" rules. Cloud NAT Logs: Audit NAT translations. Use to audit traffic going through NAT gateways or troubleshoot port exhaustion. Networking Metrics: Aggregated time-series data for throughput, RTT (

This is an excerpt. Refer to the complete source and its current requirements.