Skip to main content
emisar

Google Cloud Logging and Monitoring operations

v0.3.12

Google Cloud Logging and Monitoring diagnostics plus governed alert control: bounded log discovery and queries, metric queries, metric descriptors, Cloud Interconnect attachment utilization, and alert-policy reads, and enable or disable of one exact alert policy. Logging and metric reads plus the alert-policy mutations use stable Google Cloud REST APIs — the mutations patch only the policy's enabled field; the alert-policy list uses the GA gcloud command.

6 allowed by default 2 need approval by default
Pack ID
gcp-monitoring
Vendor
emisar
OS
linux
Actions
8
Required binaries. Install these on the host before relying on the pack. An action that calls a missing binary fails at run time.
gcloud curl jq sha256sum

Use this pack with your agent

New to emisar? Start with the quickstart to connect one Linux host and verify an action. With a runner connected, review this pack's actions and host requirements, then follow installing and verifying a published pack. Your policy decides which actions run, wait for approval, or are denied.

Connect a CLI agent, Claude.ai or ChatGPT to discover the installed actions through the same infrastructure MCP.

Install

emisar pack install fetches this pack, re-validates it, and verifies its content hash against the --hash below before copying it into the runner's packs dir. That hash covers the exact bytes this page was built from, so a tampered copy is rejected. The command reloads a running daemon itself, so you don't need to restart it manually.

on the runner host 
sudo emisar pack install gcp-monitoring --hash sha256:4c4277a991ee8b1e41d6db6e9f9d2590317fa241e573c1a0599bbcc98f93bf64

Setup

Uses gcloud authentication on the runner host. The Logging, metric, and alert-policy REST actions obtain a short-lived access token from gcloud and send it only to fixed Google Cloud API endpoints without placing it in argv or output.

Environment

Set these on the runner host, then add each name to execution.inherit_env so the value reaches the action.

  • CLOUDSDK_CONFIG

    Optional gcloud configuration directory.

  • CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE

    Optional path to a credential file that overrides the active gcloud account.

Notes

  • Any credential/config env you set must be allowlisted in the runner's execution.inherit_env ; attached service accounts and workload identity need no credential env.
  • Grant least privilege for the actions you enable: a named log view can grant roles/logging.viewAccessor on that view and be passed to gcp.log_entries; project-wide ordinary Logging reads need roles/logging.viewer, and private and Data Access logs additionally need roles/logging.privateLogViewer. Monitoring reads need roles/monitoring.viewer, and alert-policy enable or disable needs roles/monitoring.alertPolicyEditor-equivalent permissions. User or quota-project credentials may also need serviceusage.services.use on the named project for the X-Goog-User-Project quota header.
  • For a credential file, populate a dedicated CLOUDSDK_CONFIG with gcloud auth login --cred-file=... or set CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE ; ordinary gcloud commands do not authenticate from GOOGLE_APPLICATION_CREDENTIALS.
  • This remote-target pack declares no host detection signal and is never auto-suggested merely because gcloud is installed.
  • Metric query pageSize with view=FULL caps returned points rather than the number of time-series objects; follow next_page_cursor for another page.

Verify it works

Runs gcp.alert_policies, a low-risk read that confirms the pack can reach its target. Run it on the host once the pack is installed; pack install runs it for you.

on the runner host 
sudo emisar pack verify gcp-monitoring

Install and configure a pack walks through the whole sequence on a host.

Actions 8 total

View on GitHub
  • gcp.alert_policies exec low Low: read-only or trivially reversible

    gcloud monitoring policies list

    List alerting policies in one Google Cloud project.

    Arguments
    Name Type Required
    project string Yes
    limit integer No

    See the action source for defaults, validation, and limits.

    Link to this action View source on GitHub
  • gcp.alert_policy_disable script high High: can disrupt service

    Disable a Cloud Monitoring alert policy

    Disable one exact alerting policy so its conditions stop evaluating and notifying. Incidents the policy would catch go unnoticed until it is re-enabled with gcp.alert_policy_enable — that is the rollback. Idempotent: disabling an already-disabled policy succeeds and changes nothing. Returns the updated policy.

    Arguments
    Name Type Required
    project string Yes
    policy string Yes

    See the action source for defaults, validation, and limits.

    Link to this action View source on GitHub
  • gcp.alert_policy_enable script high High: can disrupt service

    Enable a Cloud Monitoring alert policy

    Enable one exact alerting policy so its conditions evaluate and notify again. Idempotent: enabling an already-enabled policy succeeds and changes nothing. Returns the updated policy; roll back with gcp.alert_policy_disable.

    Arguments
    Name Type Required
    project string Yes
    policy string Yes

    See the action source for defaults, validation, and limits.

    Link to this action View source on GitHub
  • gcp.interconnect_utilization script low Low: read-only or trivially reversible

    Query Cloud Interconnect attachment utilization

    Query capacity plus received and sent byte rates for one Cloud Interconnect attachment, then calculate independent ingress and egress utilization ratios. The link is full duplex, so directions are never summed. The window reaches 730 days at a coarse alignment: window / alignment_seconds must fit the 1000-point page each metric is read in.

    Arguments
    Name Type Required
    project string Yes
    attachment string Yes
    region string Yes
    window_minutes integer No
    alignment_seconds integer No

    See the action source for defaults, validation, and limits.

    Link to this action View source on GitHub
  • gcp.log_entries script medium Medium: changes state, easily reversible

    Query recent Cloud Logging entries

    Query up to five recent Cloud Logging entries in a Google Cloud project or a named view in its global _Default bucket, optionally narrowed by minimum severity, resource type, exact log ID, and exact jsonPayload.message. Returns fixed, clipped diagnostic fields including jsonPayload.job and error, plus a continuation cursor; log content is arbitrary application output, so redaction is best-effort and the result should be treated as sensitive diagnostics.

    Arguments
    Name Type Required
    project string Yes
    minimum_severity string No
    resource_type string No
    log_id string No
    view_id string No
    json_message string No
    window_minutes integer No
    page_size integer No
    page_cursor string No

    See the action source for defaults, validation, and limits.

    Link to this action View source on GitHub
  • gcp.log_names script low Low: read-only or trivially reversible

    List Cloud Logging log names

    List one bounded page of log names that contain entries in a Google Cloud project. Use the returned continuation cursor to inspect the next page.

    Arguments
    Name Type Required
    project string Yes
    page_size integer No
    page_cursor string No

    See the action source for defaults, validation, and limits.

    Link to this action View source on GitHub
  • gcp.metric_descriptors script low Low: read-only or trivially reversible

    List Cloud Monitoring metric descriptors

    List active metric descriptors in one project, optionally restricted to a metric-type prefix. Returns a next_page_cursor when another page exists.

    Arguments
    Name Type Required
    project string Yes
    type_prefix string No
    active_only boolean No
    page_size integer No
    page_cursor string No

    See the action source for defaults, validation, and limits.

    Link to this action View source on GitHub
  • gcp.metric_query script low Low: read-only or trivially reversible

    Query Cloud Monitoring time series

    Query one metric type over a trailing window ending now, optionally narrowing by a Monitoring resource filter. Returns FULL time-series data and a next_page_cursor when another page exists. The window reaches 730 days, Google's retention for Compute Engine, GKE, Cloud Storage, BigQuery, Cloud SQL, load balancer, custom, agent and Prometheus metrics (full resolution for six weeks, 10-minute points after that); every other family, including log-based metrics, keeps six weeks. Beyond a day, set an aligner (ALIGN_RATE for counters, ALIGN_MEAN for gauges) and pick alignment_seconds so window / alignment fits in one page; ALIGN_NONE returns raw samples and pages through them. Google answers a response over 200 MB with HTTP 429: raise alignment_seconds or narrow resource_filter.

    Arguments
    Name Type Required
    project string Yes
    metric_type string Yes
    resource_filter string No
    window_minutes integer No
    alignment_seconds integer No
    aligner string No
    page_size integer No
    page_cursor string No

    See the action source for defaults, validation, and limits.

    Link to this action View source on GitHub
← Back to registry
Pack reference  Publish your own