Hey Folks I am currently working with the audit logs and I am trying to see logs related to the compute operation
Let’s say for example If I am going to create the instance in the project, I am getting two same logs of the same event (duplication of the event) basically I can see. compute.instances.insert twice instead of once and same for the delete , I have tried to do the same operation via the CLI and console both leads to duplication of events , is this intended one or the bug from the GCP 
On my side I see two events too, but there are not the same
One has operation.first=true and the other operation.last=true , so I think this is intended
The first contain the request and response information, but the last didn’t
I’m not sure, but maybe the second event (last=true) is more a “operation done” event
Cool thanks for the update , surprisingly its happening only for the compute audit logs , not for other operations like creating the bucket , updating the IAM and other interesting thing is https://cloud.google.com/logging/docs/reference/audit/auditlog/rest/Shared.Types/AuditLog|Audit-logs docs/definition doesn’t have anything related to the Operation
Maybe because an instance has multiple state (running, off, pending, …) ? I don’t found any information in the documentation neither
Mm , Ya I suspect the same ,
Do they have different insertids for the second event ?
Based on my research for first log is generated when the request is made and second log is generated when the operation is succesfful
are you sure , for me the insert id is different but the operation id is same
He asks about the insertid, but yes the operationId is the same for me too
Ya for me the
Insert id is different but the operation id is same
Kevin seems to be right — I’m looking at both beta.compute.instances.insert and compute.instances.stop logs right now where it duplicated the logs, has the same “operationId” but different insert i.d.s. and the operation first: true is set on one and last:true another … one of them has requestMetaData, authorization info where it says it was granted, and a response element with fields; the other has all of those things missing but otherwise the same fields. The timestamps are slightly different too in both. Strangely the one that is “last” seems to have less info in all cases I see.
