Artifact Registry Cleanup does not log

Zach5

I've setup my cloud project and artifact registry for cleanup policies that should log to google cloud logging. However, those logs never appear. It has been weeks of monitoring. I don't believe this feature is working as expected. I only ever see `Docker-Startupload`, `Docker-FinishUpload`, update repoistory event, but I see nothing about cleaning up.

(you'd think a site like this would have inline and code block markup available.)

MaxImbrox

Hi @Zach5,

EDIT: I think that this is not really a problem, because as per documentation, you can see Audit Logging of AR, like READ and WRITE in the repository. Which kind of logs did you expect? Some related to the build?

Zach5

You're wrong. I'm referring to testing the cleanup policies with a dry run. See the documentation here: https://cloud.google.com/artifact-registry/docs/repositories/cleanup-policy#dry-run

I find it annoying to be told my problem is not a problem. Read the documentation before being dismissive in the future please.

Roderick

Hi @Zach5, thanks so much for bringing your question to the Google Cloud Community and providing a bit more context to the issue you're having. @MaxImbrox appreciate your trying to help.

Full Disclosure: I am not an expert in this product area, however I believe you're absolutely right. While Artifact Registry does have cleanup policies, the deletion events triggered by these policies are not logged in Cloud Logging by default. The logs you are seeing (Docker-Startupload, Docker-FinishUpload) are related to the upload process of artifacts, not their deletion.

Where to Find Cleanup Logs

The effects of your cleanup policies can be analyzed in the Artifact Registry Data Access audit logs. To view these logs, follow these steps:

Enable Data Access Audit Logs: In the Cloud Console, navigate to the "Logging" section and ensure that "Data Access" audit logs are enabled for the Artifact Registry service. This is crucial, as these logs specifically record the actions taken by the cleanup policies.
Filter the Logs: In the Logs Explorer, use the following filters to narrow down the results:
- Resource type: "Artifact Registry"
- Log name: "data_access"
- Search for relevant keywords: "DELETE", "cleanup", or the specific names of your cleanup policies.

By examining these logs, you should be able to see which artifacts were deleted as a result of your cleanup policies.

Important Considerations

Dry Run: Before implementing your cleanup policies, it's strongly recommended to test them in "dry run" mode. This allows you to see which artifacts would be deleted without actually removing them.
Quota: Artifact Registry has a quota for the number of delete requests per project. Exceeding this quota could prevent your cleanup policies from functioning as expected.

Additional Troubleshooting

If you are still not seeing the desired logs, double-check the following:

Policy Configuration: Ensure that your cleanup policies are correctly configured and that the conditions for deletion are being met.
Timing: Cleanup policies may not run immediately. There could be a delay between the policy being triggered and the artifacts being deleted.

Hopefully an expert in this area will weight in! If you have any further questions or need more assistance, feel free to ask!

Zach5

@Roderick I appreciate you're help. The query isn't surfacing anything from dry-runs. I only see image upload events and repository update events. I'll move forward by reducing the complexity of the policies in place to a single "if older than" policy and see if anything changes.

I've submitted the product feedback via google cloud but it's worth noting it would be helpful if more dry-run information were logged. For instance I don't know if the policy executed, or if the policy matched anything.