Your architecture calls for the centralized collection of all admin activity and VM system logs within your project. How should you collect these logs from both VMs and services?

Cloud Logging automatically collects certain logs, including Admin Activity audit logs, which track administrative changes and other actions. However, for logs generated within a virtual machine's operating system, such as system logs (e.g., syslog, Windows Event Log) or application logs, the Cloud Logging agent must be installed on that VM. The agent streams these logs from the VM to the Cloud Logging API, centralizing them with other project logs. This combination provides comprehensive log coverage.

A. VM system logs are not collected automatically; they require the installation of the Cloud Logging agent on each VM.
C. Using a custom syslogd instance is a non-standard, manual approach that lacks the integration and features of the native Cloud Logging service.
D. The Logging agent only collects logs from the specific instance it is installed on, not from the entire project or other services.

1. Google Cloud Documentation, "Overview of Cloud Audit Logs". It states, "Cloud Audit Logs maintains three audit logs for each Cloud project...: Admin Activity, Data Access, and System Event." These are collected by default.

2. Google Cloud Documentation, "About the Logging agent". It specifies, "You can use the Logging agent to send logs from your own applications and from third-party applications to Cloud Logging... The agent is pre-installed on some Compute Engine VM images." This confirms the agent is needed for VM-specific logs.

3. Google Cloud Documentation, "Default logs". This page lists which logs are collected by default and which require the agent. It explicitly mentions syslog as a log collected by the agent.