# 2.11 Ensure Log Metric Filter and Alerts Exist for SQL Instance Configuration Changes (Automated) - Source: https://support.icompaas.com/support/solutions/articles/62000232995-2-11-ensure-log-metric-filter-and-alerts-exist-for-sql-instance-configuration-changes-automated- - Section: [Solutions](https://support.icompaas.com/support/solutions) › [GCP Benchmarks](https://support.icompaas.com/support/solutions/62000112667) › [GCP Knowledge Bases](https://support.icompaas.com/support/solutions/folders/62000169178) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) ### Profile Applicability: ### Level 2 ### Description: Establishing a log metric filter and alert for SQL instance configuration changes is recommended. This ensures that any changes, including critical misconfigurations, are monitored and addressed promptly. ### Rationale: Monitoring configuration changes in Cloud SQL instances can help mitigate security risks and maintain service reliability. Key configuration options, such as enabling auto-backups, high availability, and managing network authorizations, directly impact the security and performance of SQL instances. Detecting misconfigurations early ensures quick resolution and protects the organization’s data integrity. ### Impact: Enabling logging may incur additional costs for log storage and processing, particularly for organizations with high activity levels. ### Default Value: No log metric or alert policy is configured by default for SQL instance configuration changes. ### Audit Steps: #### Using Google Cloud Console: 1. Verify Log Metric Configuration: - Navigate to [Logs-based Metrics](https://console.cloud.google.com/logs/metrics).                           ![](https://support.icompaas.com/assets/kb/f59ad0c964da7588.png) - Under User-defined Metrics, ensure there is a metric with the filter: protoPayload.methodName="cloudsql.instances.update" 2. Verify Alert Policy Configuration: - Navigate to [Alerting](https://console.cloud.google.com/monitoring/alerting).                            **![](https://support.icompaas.com/assets/kb/285c2a980f72d731.png)** - **Ensure an alert policy exists for the log metric with the following conditions:** - **Condition: Triggers for any configuration change.** - **Threshold: Greater than 0.**                                **![](https://support.icompaas.com/assets/kb/8106e61e0dafa1c6.png)** - **Verify notification channels are configured appropriately.**                          **![](https://support.icompaas.com/assets/kb/83d82cc90fecaf98.png)** #### **Using Google Cloud CLI:** 1. Verify Log Metric Configuration: - List all log metrics: gcloud logging metrics list --format json - Confirm there is a metric with the filter: protoPayload.methodName="cloudsql.instances.update" 2. Verify Alert Policy Configuration: - List alerting policies: gcloud alpha monitoring policies list --format json - **Confirm a policy exists where:** - **Filter: Matches the metric.** - **Enabled: true.** ### **Remediation Steps:** #### **Using Google Cloud Console:** 1. **Create a Log Metric:** - Navigate to [Logs-based Metrics](https://console.cloud.google.com/logs/metrics) and click CREATE METRIC.                       **![](https://support.icompaas.com/assets/kb/6b532e3db155cde3.png)**                    **![](https://support.icompaas.com/assets/kb/ac2d7317d594f89a.png)** - **Configure the metric:** **Filter**: protoPayload.methodName="cloudsql.instances.update" - Type: Counter. - **Units: 1 (default).**                                   **![](https://support.icompaas.com/assets/kb/4abfab134c2e2d5c.png)** - Click Create Metric.                            **![](https://support.icompaas.com/assets/kb/409160a411c428e5.png)** 2. Create an Alert Policy: - Locate the new metric under User-defined Metrics.                            **![](https://support.icompaas.com/assets/kb/1e0b7dae3cf0ff15.png)** - Click the three-dot menu and select Create alert from Metric. **![](https://support.icompaas.com/assets/kb/37e3b620e7c21926.png)** - **Configure the alert policy:** - Condition: - Aggregator: Count. - Threshold: Greater than 0. - Configure notification channels as needed. - Save the policy.                                ![](https://support.icompaas.com/assets/kb/c6105a1347cdd63a.png) #### **Using Google Cloud CLI:** **Create a Log Metric:** gcloud logging metrics create \\ --description="Monitor SQL instance configuration changes" \\ --log-filter="protoPayload.methodName='cloudsql.instances.update'" **Create an Alert Policy**: gcloud alpha monitoring policies create \\ --display-name="" \\ --conditions="" \\ --notification-channels="" ### References: 1. [Logs-Based Metrics Documentation](https://cloud.google.com/logging/docs/logs-based-metrics) 2. [Custom Metrics in Monitoring](https://cloud.google.com/monitoring/custom-metrics) 3. [Alerts in Monitoring](https://cloud.google.com/monitoring/alerts) 4. [Cloud Logging CLI Reference](https://cloud.google.com/logging/docs/reference/tools/gcloud-logging) 5. [Cloud SQL MySQL Documentation](https://cloud.google.com/sql/docs/mysql/) 6. [Cloud SQL PostgreSQL Documentation](https://cloud.google.com/sql/docs/postgres/) ### CIS Controls:

Control

Description

IG 1

IG 2

IG 3

8.2 Collect Audit Logs

Enable audit logging across enterprise assets.

✅

✅

✅

8.5 Collect Detailed Audit Logs

Capture detailed logs, including event source, date, user, timestamp, and more.

✅

✅


6.2 Activate Audit Logging

Ensure local logging is enabled on all systems and devices.

✅

✅

✅

6.3 Enable Detailed Logging

Include event source, user details, and timestamp in logs.

✅

✅


## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.