Home / server / Questions / 1049706
Accepted
Kevin Buchs
Asked: 2021-01-14 09:55:57 +0800 CST

Is there a way in the GCP console to see who started a Compute Engine VM that has been running for 1.5 years?

  • 772

Any way to do this in Console? If not Console, is there an API/SDK option?

google-cloud-platform console google-compute-engine

1 Answers

  1. Best Answer

    You could try with Logs Explorer.
    According to the official documentation, These are the logs retention periods

    Log type Default retention period Custom retention
    Admin Activity audit logs 400 days Not configurable
    System Event audit logs 400 days Not configurable
    Access Transparency logs 400 days Not configurable
    Data Access audit logs 30 days Configurable
    Policy Denied audit logs 30 days Configurable
    All other logs 30 days Configurable

    This kind of log is in the log type Admin Activity audit logs

    Admin Activity audit logs contain log entries for API calls or other administrative actions that modify the configuration or metadata of resources. For example, these logs record when users create VM instances or change Identity and Access Management permissions.

    And you can use the following filter on your Log Explorer:

    severity=NOTICE
protoPayload.methodName="v1.compute.instances.start"
resource.type="gce_instance"
resource.labels.instance_id="<<INSTANCE_ID>>"

    Note: The instance_is a numerical value

    And then you could adjust the period on Select time range

    enter image description here

    Unfortunately it seems that you try to get information older than the default retention period that is 400 days, so maybe you won’t be able to get it.

    • 4