Google prefix in audit logs

[roinisimi]

Hi all, 

There seems to be an inconsistency in method names. For example, in the context of buckets, collecting all method names from my audit log reveals `google.storage.buckets.get`, but also `storage.buckets.get`. 

Why is that? Is it deterministic/random? What am I missing?

[KirTitievsky]

Not certain of the details, but here's a guess to look into: Cloud Storage supports several APIs, including XML (S3-compable) & gRPC.  In addition, the UI uses an separate, internal-only API.  I wonder if these inconsistencies have to do with which API is used.  

[roinisimi]

Any documentation about it?

[KirTitievsky]

You will find documentation on the JSON and XML service APIs here. This reference does not answer the question which client uses which service API. Nor does it say anything about what the UI uses.  But it's a start.  If you are interested in particular clients (e.g. the Python client library ), you can look at their invidual documentation or code to figure out which APIs are used. 

[KirTitievsky]

Actually, I take that back. I've tested bucket creation using gsutil, gcloud, UI and the python client libraries and they all generate cloud.storage.create log entries. So maybe there is something else going on. @roinisimi what else can you share about the differences between the audit log entries that use different prefixes?

[roinisimi]

Not much really, I collected all events from our org and saw the difference between these two. Both had pretty much the same amount of hits. I Can't tell what triggered each event