On a GCP Compute Engine instance, OS is Ubuntu 18.04, Stackdriver logging agent is installed.
Any idea why Stackdriver doesn't ingest
auth.log by default? What would be the best way to do it?
Ended up simply adding an additional entry in
<source> @type tail # Parse the timestamp, but still collect the entire line as 'message' format /^(?<message>(?<time>[^ ]*\s*[^ ]* [^ ]*) .*)$/ path /var/log/auth.log pos_file /var/lib/google-fluentd/pos/auth.log.pos read_from_head true tag auth </source>
The answer to your first question is that The VM images for Compute Engine don't include the Logging agent by default. To answer your second question, You need to install the Stackdriver Logging agent on your VM. Please follow the information and instructions here. I could reproduce that to ensure it works. After installing the agent, you will be able to see SSH connections in Stackdriver Logging, for example, their header looks like this: "..session opened for user USER". It also logs when the SSH session is closed; its header looks like this: "...session closed for user USER".