# 2.2 Ensure That Sinks Are Configured for All Log Entries (Automated) - Source: https://support.icompaas.com/support/solutions/articles/62000232947-2-2-ensure-that-sinks-are-configured-for-all-log-entries-automated- - Section: [Solutions](https://support.icompaas.com/support/solutions) › [GCP Benchmarks](https://support.icompaas.com/support/solutions/62000112667) › [GCP Knowledge Bases](https://support.icompaas.com/support/solutions/folders/62000169178) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) #### **Profile Applicability:** #### **Level 1** ### **Description:** It is recommended to configure log sinks to export copies of all log entries. These sinks help aggregate logs across multiple projects and export them to destinations like Security Information and Event Management (SIEM) systems for extended retention and analysis. ### **Rationale:** Log entries in Cloud Logging are retained temporarily, but exporting them to external destinations ensures long-term storage and facilitates centralized analysis. Configuring log sinks achieves the following: 1. Aggregation of logs across projects, folders, or organizations. 2. Centralized export to destinations such as Cloud Storage, BigQuery, or Cloud Pub/Sub. 3. Enhanced monitoring, security analysis, and compliance management. To ensure all logs are captured, sinks must be configured without filters and linked to valid destinations. ### **Impact:** While Cloud Logging does not charge for exporting logs, the selected destinations (e.g., Cloud Storage, BigQuery, Pub/Sub) may incur costs based on data storage or transmission. ### **Default Value:** By default, log sinks are not configured in Google Cloud projects. ### **Audit Steps:** #### **Using Google Cloud Console:** 1. Navigate to the Logs Router: [Logs Router Console](https://console.cloud.google.com/logs/router).  ![](https://support.icompaas.com/assets/kb/4d3588f0237989e4.png) 2. For each sink, click the three-dot menu and select View sink details.                   ![](https://support.icompaas.com/assets/kb/d0f7078096ef507f.png) 3. Verify that at least one sink is configured with an empty inclusion filter.                      ![](https://support.icompaas.com/assets/kb/27010ab90a04654f.png) 4. Confirm that the configured destination (e.g., Cloud Storage, BigQuery, or Pub/Sub) exists and is accessible.                   ![](https://support.icompaas.com/assets/kb/83bc69bf26ef8355.png) #### Using Google Cloud CLI: List sinks at the project, folder, or organization level: gcloud logging sinks list --project=PROJECT\_ID gcloud logging sinks list --folder=FOLDER\_ID gcloud logging sinks list --organization=ORGANIZATION\_ID 1. Confirm that at least one sink has no inclusion filter by checking for an empty "filter" field. 2. Ensure the destination exists and is valid. ### **Remediation Steps:** #### **Using Google Cloud Console:** 1. Go to the Logs Router: [Logs Router Console](https://console.cloud.google.com/logs/router).             ![](https://support.icompaas.com/assets/kb/fea0c8e6bc89c207.png) 2. Click + Create Sink. ![](https://support.icompaas.com/assets/kb/daeb281a1a21e1a7.png) 3. Fill in the Sink Details (e.g., name and description).           ![](https://support.icompaas.com/assets/kb/98e8f35550bf4256.png) 4. Select a Sink Destination, such as a Cloud Storage bucket, BigQuery dataset, or Cloud Pub/Sub topic.           ![](https://support.icompaas.com/assets/kb/564fe364063c0f51.png) ![](https://support.icompaas.com/assets/kb/f944c3ab89baa719.png) 5. Ensure no inclusion filter is applied to capture all logs. ![](https://support.icompaas.com/assets/kb/d900c0e97359dc35.png) 6. Click Create Sink. ![](https://support.icompaas.com/assets/kb/7a67f85cf3a356ec.png) #### **Using Google Cloud CLI:** Create a sink to export all log entries to a Cloud Storage bucket: gcloud logging sinks create storage.googleapis.com/ For folder or organization-level sinks (including all child projects): gcloud logging sinks create storage.googleapis.com/ --include-children --folder=FOLDER\_ID | --organization=ORGANIZATION\_ID 1. Ensure the sink is configured without the --log-filter option to export all log entries. **Backout Plan:** ### 1. Restore a Previous Log Sink (If Needed) If a log sink was mistakenly deleted, recreate it using: gcloud logging sinks create storage.googleapis.com/ 2. Restore IAM Policy from Backup If necessary, restore a previous IAM policy: gcloud projects set-iam-policy PROJECT\_ID policy-backup.json ### **References:** 1. [Cloud Logging Overview](https://cloud.google.com/logging/docs/routing/overview) 2. [Configure Log Exports](https://cloud.google.com/logging/docs/export/configure_export_v2) 3. [Cloud Logging Command-Line Reference](https://cloud.google.com/logging/docs/reference/tools/gcloud-logging) [](https://cloud.google.com/logging/docs/routing/overview) ### **CIS Controls:**

Control

Description

IG 1

IG 2

IG 3

8.2 Collect Audit Logs

Enable logging across all enterprise systems for monitoring.

✅

✅

✅

8.3 Ensure Adequate Audit Log Storage

Ensure sufficient storage for logging destinations to meet organizational retention requirements.

✅

✅

✅

6.2 Activate Audit Logging

Enable logging across systems and networking devices.

✅

✅

✅

6.4 Ensure Adequate Storage for Logs

Maintain adequate storage for logs to prevent loss of critical data.

✅

✅

✅

## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.