Welcome to the lecture on audit logs. In this lecture, we'll cover the basics of audit logs in Google Cloud Platform and learn how to view these logs in a GCP project. But first, what is an audit log? In a real-world GCP project, there are many users, many applications, and many cloud resources. All these components interact with each other in legitimate ways. For example, a user named Alice may try to access a GCP bucket that she is authorized to read. Similarly, a user named Bob may delete a VM that he's authorized to delete. 

These are legitimate authorized operations, but what if the VM got deleted and Bob says he did not delete it? What if a user named Eve tried to access a bucket that she's not authorized to access? If there is no record of these types of events, it's impossible to backtrack and audit when some security-related incidents happen. 

In the previous examples, if we had recorded every time a user accessed a data item in GCP or deleted a VM, we could identify the root problems using these logs. This is exactly what an audit log does. An audit log is a record of the critical events in a system, along with information such as when the event happened, who initiated it, and other information which can help in the case of a security breach. 

There are thousands, and even millions, of such operations that can happen in a production Google Cloud project. GCP provides scalable logging and search tools, including a dashboard,  where you can see these logs in a centralized place. 

So, let's learn about the audit logs in GCP. The goal of the audit logs is to help an auditor know who did what and when. In GCP, there are three main types of audit logs: admin activity logs, data access logs, and system events logs. Admin activity logs are associated with administrative actions initiated by human users. Some examples of admin activity log entries include events such as a user creating a VM or a project owner adding users or changing access for existing users. Data access audit logs record actions associated with API calls, which read or modify metadata, resources, or actual data. Finally, the third type of audit log in GCP is system event audit logs. They capture administrative actions which are not initiated by human users, but by GCP's system infrastructure.