Is there a way in the GCP console to see who started a Compute Engine VM that has been running for 1.5 years?
Any way to do this in Console? If not Console, is there an API/SDK option?
Solution 1:
You could try with Logs Explorer.
According to the official documentation, These are the logs retention periods
| Log type | Default retention period | Custom retention |
|---|---|---|
| Admin Activity audit logs | 400 days | Not configurable |
| System Event audit logs | 400 days | Not configurable |
| Access Transparency logs | 400 days | Not configurable |
| Data Access audit logs | 30 days | Configurable |
| Policy Denied audit logs | 30 days | Configurable |
| All other logs | 30 days | Configurable |
This kind of log is in the log type Admin Activity audit logs
Admin Activity audit logs contain log entries for API calls or other administrative actions that modify the configuration or metadata of resources. For example, these logs record when users create VM instances or change Identity and Access Management permissions.
And you can use the following filter on your Log Explorer:
severity=NOTICE
protoPayload.methodName="v1.compute.instances.start"
resource.type="gce_instance"
resource.labels.instance_id="<<INSTANCE_ID>>"
Note: The instance_is a numerical value
And then you could adjust the period on Select time range
Unfortunately it seems that you try to get information older than the default retention period that is 400 days, so maybe you won’t be able to get it.