Logs and metrics

This page explains how Certificate Manager logs various types ofinformation about its operation and how to view that information.

Logs

To view Certificate Manager logs, use theLogs Explorer in the Google Cloud console.

Certificate Manager provides Google Cloud logs described inGoogle Cloud logs.

Certificate Manager uses Cloud Logging to capture andstore logs. Certificate Manager logging is always enabled andonly captures a minimal amount of information specifically related tocertificate expiration. The Certificate Manager monitored resource typeiscertificatemanager.googleapis.com/Project.

You can also capture and retrieve Certificate Manager logs usingCloud Logging. See the documentation forCloud Logging client librariesfor information on how to configure this logging mechanism.

Configure log alerts

You can configure alerts for events that Certificate Manager writes toCloud Logging, such as certificate expiration. For instructions, seeConfigure log-based alerts.

For example, to configure an alert for certificates that have expired, use the following as the alert query:

logName = "projects/PROJECT_ID/logs/certificatemanager.googleapis.com%2Fcertificates_expiry" AND jsonPayload.state = "EXPIRED"

If you want to configure an alert for certificates that are close to expiration, use the following as the alert query:

logName = "projects/PROJECT_ID/logs/certificatemanager.googleapis.com%2Fcertificates_expiry" AND jsonPayload.state = "CLOSE_TO_EXPIRY"

ReplacePROJECT_ID with the ID of the target Google Cloud project.

For Google-managed certificatesCLOSE_TO_EXPIRY logs are generated daily, starting 5-10 days beforeexpiration, depending on the certificate's lifetime and renewal process. For self-managedcertificates too,CLOSE_TO_EXPIRY logs are generated daily, starting 10 days before expiration.

Metrics

This section lists the metrics supported by Certificate Manager.To view Certificate Manager metrics, use theMetrics Explorer in theGoogle Cloud console.

Standard metrics

Certificate Manager writes the following standardCloud Monitoring API metrics:

MetricDescription
serviceruntime.googleapis.com/api/request_count
  • Kind:Delta
  • Type:INT64
  • Unit:1
Cumulative count of completed requests. The following labels apply:
  • protocol indicates the request's protocol, such ashttp orgrpc.
  • response_code is the HTTP (or equivalent for gRPC) response code for HTTP/gRPC requests. Seecode list.
  • response_code_class is the class (or equivalent for gRPC) of the response code, such as `200` or `400`.
  • grpc_status_code is the gRPC response code or its HTTP equivalent. Seecode list.
serviceruntime.googleapis.com/api/request_latencies
  • Kind:Delta
  • Type:DISTRIBUTION
  • Unit:Seconds
Distribution of latencies for non-streaming requests.
serviceruntime.googleapis.com/api/request_sizes
  • Kind:Delta
  • Type:DISTRIBUTION
  • Unit:Byte
Distribution of request sizes. Request size is recorded when a request completes.
serviceruntime.googleapis.com/api/response_sizes
  • Kind:Delta
  • Type:DISTRIBUTION
  • Unit:Byte
Distribution of response sizes. Response size is recorded when a request completes.

Custom metrics

Additionally, Certificate Manager writes the following custommetrics using the Cloud Monitoring API:

MetricDescription
certificatemanager.googleapis.com/project/certificates
  • Kind:GAUGE
  • Type:INT64
  • Unit:1
Number of certificates provisioned within the target Google Cloud project. The following labels apply:
  • type indicates whether the certificate is Google-managed (MANAGED) or self-managed (SELF_MANAGED).
  • scope indicates whether the certificate scope is Cloud Load Balancing (DEFAULT) or Media CDN (EDGE_CACHE).
  • is_active indicates whether the certificate is active. Valid values aretrue andfalse.
certificatemanager.googleapis.com/map/entries
  • Kind:GAUGE
  • Type:INT64
  • Unit:1
Number of certificate map entries provisioned within the target Google Cloud project. The following labels apply:
  • is_primary indicates whether the certificate map entry is the primary entry in the certificate map. Valid values aretrue andfalse.

What's next

Except as otherwise noted, the content of this page is licensed under theCreative Commons Attribution 4.0 License, and code samples are licensed under theApache 2.0 License. For details, see theGoogle Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2026-02-19 UTC.