An enterprise running high-throughput microservices on Google Kubernetes Engine (GKE) and Cloud Bigtable is experiencing high observability costs due to massive Cloud Logging volumes. The DevOps team must optimize logging costs according to FinOps best practices while satisfying the following architectural requirements: Prevent high-volume DATA_READ and DATA_WRITE audit logs generated by trusted backend service accounts from creating cost overhead. Eliminate storage costs for routine GKE health check (/healthz) and informational debug logs while preserving critical error and security logs in Cloud Logging for 30-day operational triage. Retain long-term compliance audit logs for 7 years at minimum cost without paying extended Cloud Logging bucket retention fees. Which logging architecture strategy should the DevOps team implement?

Exempt backend service accounts via IAM Data Access audit configurations, add exclusion filters for debug and health check logs on the _Default log sink, and route compliance logs via a custom sink to a Cloud Storage bucket configured with Object Lifecycle Management.: ### What the Recommended FinOps Solution Is This solution implements a multi-tier log optimization architecture that controls log volume at generation, ingestion, and retention tiers by combining **IAM Audit Configuration exemptions**, **Log Router exclusion filters**, and **Cloud Storage log sinks**. ### How It Meets All Requirements - **Service Account Audit Log Management**: Exempting service accounts in the project's **Data Access audit configuration** prevents high-volume Bigtable `DATA_READ` and `DATA_WRITE` logs from being generated at the source. This completely eliminates the API and processing load before log entry creation. - **Eliminating Debug and Health Check Ingestion**: Adding an **exclusion filter** to the `_Default` sink drops routine `/healthz` and verbose debug logs before they are written to the `_Default` log bucket. Cloud Logging only charges for logs stored in log buckets (beyond the free tier); excluded logs incur no storage charges while allowing critical errors to flow through for standard 30-day operational triage. - **Cost-Efficient 7-Year Archival**: Creating a dedicated log sink directed to a **Google Cloud Storage** bucket avoids Cloud Logging's retention charges for logs stored beyond the default 30-day period. Applying **Object Lifecycle Management** transitions the data to Archive storage class over time, minimizing 7-year retention expenses. ### Key Advantages and Capabilities - **Upstream Cost Avoidance**: Audit exemptions stop log generation before entering the Logging API pipeline. - **Zero-Storage Ingestion Control**: Log Router exclusion filters eliminate log bucket storage fees without losing critical error visibility. - **Tiered Cold Storage**: Cloud Storage offers cost-optimized storage classes (Nearline, Coldline, Archive) compared to log bucket retention fees. - **Granular Filter Logic**: Inclusion and exclusion expressions use standard Logging Query Language for precise filtering. ### Why This Is Optimal This architecture manages costs at every stage of the log lifecycle: generation (IAM exemptions), ingestion/storage (sink exclusions), and retention (Cloud Storage lifecycle policies). It maintains required operational and compliance visibility at the lowest possible cost.

Optimize Cloud Logging Ingestion Routing Retention 2 | Professional Cloud DevOps Engineer

Optimize Cloud Logging Ingestion Routing Retention 2

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise running high-throughput microservices on Google Kubernetes Engine (GKE) and Cloud Bigtable is experiencing high observability costs due to massive Cloud Logging volumes. The DevOps team must optimize logging costs according to FinOps best practices while satisfying the following architectural requirements:

Prevent high-volume DATA_READ and DATA_WRITE audit logs generated by trusted backend service accounts from creating cost overhead.
Eliminate storage costs for routine GKE health check (/healthz) and informational debug logs while preserving critical error and security logs in Cloud Logging for 30-day operational triage.
Retain long-term compliance audit logs for 7 years at minimum cost without paying extended Cloud Logging bucket retention fees.

Which logging architecture strategy should the DevOps team implement?

Disable the _Default log sink entirely, route all unparsed logs into BigQuery via a continuous streaming sink, and configure BigQuery scheduled queries to drop debug rows every 24 hours.

Create a custom user-defined log bucket configured with a 2,555-day retention period, route all logs using an aggregated sink, and apply field-level access control to redact debug and health check payloads.

Add exclusion filters to the _Required log sink to drop Data Access logs, and deploy a Cloud Run job that executes daily to delete expired debug entries from the _Default log bucket.

Exempt backend service accounts via IAM Data Access audit configurations, add exclusion filters for debug and health check logs on the _Default log sink, and route compliance logs via a custom sink to a Cloud Storage bucket configured with Object Lifecycle Management.

Professional Cloud DevOps Engineer

Optimize Cloud Logging Ingestion Routing Retention 2

Related questions