<p>How can I configure GCP to send me alerts when nodes events (create / shutdown) happen?
I would like to receive email alerting me about the cluster scaling.</p>

<p>tks</p>

Marcos Vidolin
<p>First, note that you can retrieve such events in <a href="https://cloud.google.com/logging/docs/view/overview" rel="nofollow noreferrer">Stackdriver Logging</a> by using the following filter :</p>

<pre><code>logName="projects/[PROJECT_NAME]/logs/cloudaudit.googleapis.com%2Factivity" AND
(
    protoPayload.methodName="io.k8s.core.v1.nodes.create" OR
    protoPayload.methodName="io.k8s.core.v1.nodes.delete"
)
</code></pre>

<p>This filter will retrieve only audit activity log entries (<code>cloudaudit.googleapis.com%2Factivity</code>) in your project <code>[PROJECT_NAME]</code>, corresponding to a node creation event (<code>io.k8s.core.v1.nodes.create</code>) or deletion (<code>io.k8s.core.v1.nodes.delete</code>).</p>

<p>To be alerted when such a log is generated, there are multiple possibilities.</p>

<p>You could configure a <a href="https://cloud.google.com/logging/docs/export/" rel="nofollow noreferrer">sink</a> to a Pub/Sub topic based on this filter, and then <a href="https://cloud.google.com/functions/docs/calling/pubsub" rel="nofollow noreferrer">trigger a Cloud Function</a> when a filtered log entry is created. This Cloud Function will define the logic to send you a mail. This is probably the solution I'd choose, since this use case <a href="https://cloud.google.com/functions/docs/calling/logging" rel="nofollow noreferrer">is described in the documentation</a>.</p>

<p>Otherwise, you could define a <a href="https://cloud.google.com/logging/docs/logs-based-metrics/" rel="nofollow noreferrer">logs-based metric</a> based on this filter (or one logs-based metric for creation and another for deletion), and configure an <a href="https://cloud.google.com/monitoring/alerts/" rel="nofollow noreferrer">alert in Stackdriver Monitoring</a> when this log-based metric is increased. This alert could be configured to send an email. However, I won't suggest you to implement this, because this is not a real "alert" (in the sense of "something went wrong"), but rather an information. You probably don't want to have incidents opened in Stackdriver Monitoring every time a node is created or deleted. But you can keep the idea of one/multiple logs-based metric and process it/them with a custom application.</p>
