Google has 3 main logs you would use to troubleshoot issues.
Google Cloud Activity log
Compute Engine Operations logs
Stackdriver Logs
Google Cloud Activity Logs
This log is similar to an audit log. It shows all the actions taken by admins and service accounts. For example when someone deletes, edits or powers a server on or off is all logged here.
To access this log follow the steps below:
Log into the Google Cloud Console: Https://Console.cloud.google.com
In the home/dashboard screen, hit "Activity" on the top left.
From there you'll see all the changes being made on the project with most recent at the top. It shows (from left to right) timestamp, action, and user/account that did the action.
Compute Engine Operations logs
This log shows you the commands that are ran against the compute engine and its VM instances. It shows the Operation, Target, User that ran it, the Start and End time stamps, and the Status of the command.
To access this log:
Press the 3 lines on the top left to access the modules
Navigate to Compute Engine> Operations
You'll then see the logs as mentioned.
Stackdriver Logs
These logs basically show all live activity going on with several modules. This would be the logs you would use to troubleshoot issues with VPN connections as well, see more information about that here.
To access the logs, open the side menu and scroll down to the Stackdriver section and open Logging > Logs.
Here you can view logs for the entire project, or per resource. You can sort by Resource, Log type, Severity level, and Time frames.