<p>Not sure if you sorted this out, but I had to do something similar to get who started the instance so I can badger them into stopping the instance if they are not using it. I put together a Logging query:</p>

<p><code>resource.type = gce_instance AND (jsonPayload.event_subtype = compute.instances.start OR jsonPayload.event_subtype = compute.instances.insert ) AND jsonPayload.event_type = GCE_OPERATION_DONE AND timestamp &gt;= "2018-10-29T14:28:34-07:00" AND jsonPayload.actor.user!="" AND jsonPayload.resource.name=my-sweet-instance-name</code></p>

<p>And here is the nodejs function I put together to get it:</p>

<pre><code>const Logging   = require( '@google-cloud/logging' );
const moment    = require( 'moment' );

const logging   = new Logging( );




var getStartInfo = function( instanceName, querySince, cb ) {

    var tstart = ( querySince ? querySince : moment( ).subtract( 48, 'hours' ).format( ) ); // 

    var theLogFilter = 'resource.type = gce_instance AND ' +
        '(jsonPayload.event_subtype = compute.instances.start OR jsonPayload.event_subtype = compute.instances.insert ) AND ' +
        'jsonPayload.event_type = GCE_OPERATION_DONE AND ' +
        'timestamp &gt;= "' + tstart + '" AND ' +
        'jsonPayload.actor.user!="" AND ' +
        'jsonPayload.resource.name=' + instanceName;

    logging.getEntries( {
        filter: theLogFilter,
        autoPaginate: false
    }, ( err, entries, nextQuery, apiResponse ) =&gt; {


        if ( err ) {
            console.log( "ERROR: " + err );
            cb( err );
            return;
        }

        var item, startedBy, startTime, runningTime, mostRecentStart;

        //console.log( 'Entries: ' + JSON.stringify( entries ) );
        // Mabye if none found, we try again with a longer querySince?
        if ( entries.length == 0 ) {

            console.log( "\nNo log entries found for instance '" + instanceName + "'. Filter:" );
            console.log( theLogFilter );
            cb( "No entries found" );
            return;
        }


        // Are these sorted by time?
        for ( var i = 0; i &lt; entries.length; i++ ) {


            startedBy = entries[ i ].metadata.jsonPayload.fields.actor.structValue.fields.user.stringValue;
            startTime = entries[ i ].metadata.jsonPayload.fields.event_timestamp_us.stringValue / 1000; // This is nano seconds since epoch

        }

        if ( cb )
            cb( null, { "startedBy": startedBy, "startTime": moment( startTime ).format() } );

    } );

}
</code></pre>

<p>Hopefully that helps someone because it was a good bit of work to put together.</p>

CC BY-SA 4.0
2018-10-31T21:34:12.483Z
2018-10-31T21:34:12.483Z
nomadic_squirrel
<p>Note: I'm not a GCE user yet, the answer is based solely on documentation.</p>

<p>You could be <a href="https://cloud.google.com/compute/docs/audit-logging" rel="noreferrer">Viewing Audit Logs</a> in the <code>Google Cloud Console</code>, more specifically the <a href="https://cloud.google.com/logging/docs/audit/#admin-activity" rel="noreferrer">Admin Activity logs</a>:</p>

<blockquote>
  <p>Admin Activity logs contain log entries for API calls or other
  administrative actions that modify the configuration or metadata of
  resources. For example, the logs record when VM instances and App
  Engine applications are created and when permissions are changed. To
  view the logs, you must have the IAM roles <strong>Logging/Logs Viewer</strong> or
  <strong>Project/Viewer</strong>.</p>
</blockquote>

<p>You would be looking for the <a href="https://cloud.google.com/logging/docs/audit/#user_identities_in_audit_logs" rel="noreferrer">User identities in audit logs</a>:</p>

<blockquote>
  <p>Audit logs record the identity of the user performing logged actions.
  The identity is held in the <code>AuthenticationInfo</code> field of <a href="https://cloud.google.com/logging/docs/audit/api/ref/rest/Shared.Types/AuditLog" rel="noreferrer">AuditLog</a>
  objects.</p>
</blockquote>

<p>Ideally you'd be looking for the GCE instance creation events, but some/all of those may be too old for the logs retention policy. Then maybe search for VM instance start or other relevant events.</p>

<p>You could also check and maybe cross-reference the audit logs info with that from <a href="https://cloud.google.com/compute/docs/usage-export" rel="noreferrer">Usage Reports</a> or <a href="https://support.google.com/cloud/answer/4524336" rel="noreferrer">exported billing info</a>.</p>

<p>If this is a regular, on-going activity you may want to setup an automated <a href="https://cloud.google.com/logging/docs/export/using_exported_logs" rel="noreferrer">log exporting</a> and processing pipeline.</p>

CC BY-SA 3.0
2017-09-26T15:50:38.397Z
2017-09-26T15:50:38.397Z
Dan Cornilescu
<p>We have several billing enabled projects in our GCP account and each of them has several Compute Engine Instances. I want to remove non-critical instances just to reduce the unnecessary billing. But before I do that, I need to know which instance is being used for what and for that I need to know which user created it in the first place.</p>

<p>How do I get to know the creator of each instance either by using <code>Google Cloud Shell</code> or <code>Google Cloud Console</code>?</p>

<google-cloud-platform><gcp><google-compute-engine>
How to know which user created the GCE Instance
noob
# How to know which user created the GCE Instance

(Asked by: username_0 on 2017-09-26)

We have several billing enabled projects in our GCP account and each of them has several Compute Engine Instances. I want to remove non-critical instances just to reduce the unnecessary billing. But before I do that, I need to know which instance is being used for what and for that I need to know which user created it in the first place.

How do I get to know the creator of each instance either by using `Google Cloud Shell` or `Google Cloud Console`?

**Tags:** google-cloud-platform, gcp, google-compute-engine


---

## 2 answers

### Answer by username_2 on 2017-09-26. Score: 7 | Accepted answer

Note: I'm not a GCE user yet, the answer is based solely on documentation.

You could be [Viewing Audit Logs](https://cloud.google.com/compute/docs/audit-logging) in the `Google Cloud Console`, more specifically the [Admin Activity logs](https://cloud.google.com/logging/docs/audit/#admin-activity):

> Admin Activity logs contain log entries for API calls or other
> administrative actions that modify the configuration or metadata of
> resources. For example, the logs record when VM instances and App
> Engine applications are created and when permissions are changed. To
> view the logs, you must have the IAM roles **Logging/Logs Viewer** or
> **Project/Viewer**.

You would be looking for the [User identities in audit logs](https://cloud.google.com/logging/docs/audit/#user_identities_in_audit_logs):

> Audit logs record the identity of the user performing logged actions.
> The identity is held in the `AuthenticationInfo` field of [AuditLog](https://cloud.google.com/logging/docs/audit/api/ref/rest/Shared.Types/AuditLog)
> objects.

Ideally you'd be looking for the GCE instance creation events, but some/all of those may be too old for the logs retention policy. Then maybe search for VM instance start or other relevant events.

You could also check and maybe cross-reference the audit logs info with that from [Usage Reports](https://cloud.google.com/compute/docs/usage-export) or [exported billing info](https://support.google.com/cloud/answer/4524336).

If this is a regular, on-going activity you may want to setup an automated [log exporting](https://cloud.google.com/logging/docs/export/using_exported_logs) and processing pipeline.


---

### Answer by username_1 on 2018-10-31. Score: 2

Not sure if you sorted this out, but I had to do something similar to get who started the instance so I can badger them into stopping the instance if they are not using it. I put together a Logging query:
resource.type = gce_instance AND (jsonPayload.event_subtype = compute.instances.start OR jsonPayload.event_subtype = compute.instances.insert ) AND jsonPayload.event_type = GCE_OPERATION_DONE AND timestamp >= "2018-10-29T14:28:34-07:00" AND jsonPayload.actor.user!="" AND jsonPayload.resource.name=my-sweet-instance-name
And here is the nodejs function I put together to get it:
const Logging   = require( '@google-cloud/logging' );
const moment    = require( 'moment' );

const logging   = new Logging( );




var getStartInfo = function( instanceName, querySince, cb ) {

    var tstart = ( querySince ? querySince : moment( ).subtract( 48, 'hours' ).format( ) ); // 

    var theLogFilter = 'resource.type = gce_instance AND ' +
        '(jsonPayload.event_subtype = compute.instances.start OR jsonPayload.event_subtype = compute.instances.insert ) AND ' +
        'jsonPayload.event_type = GCE_OPERATION_DONE AND ' +
        'timestamp >= "' + tstart + '" AND ' +
        'jsonPayload.actor.user!="" AND ' +
        'jsonPayload.resource.name=' + instanceName;

    logging.getEntries( {
        filter: theLogFilter,
        autoPaginate: false
    }, ( err, entries, nextQuery, apiResponse ) => {


        if ( err ) {
            console.log( "ERROR: " + err );
            cb( err );
            return;
        }

        var item, startedBy, startTime, runningTime, mostRecentStart;

        //console.log( 'Entries: ' + JSON.stringify( entries ) );
        // Mabye if none found, we try again with a longer querySince?
        if ( entries.length == 0 ) {

            console.log( "\nNo log entries found for instance '" + instanceName + "'. Filter:" );
            console.log( theLogFilter );
            cb( "No entries found" );
            return;
        }


        // Are these sorted by time?
        for ( var i = 0; i < entries.length; i++ ) {


            startedBy = entries[ i ].metadata.jsonPayload.fields.actor.structValue.fields.user.stringValue;
            startTime = entries[ i ].metadata.jsonPayload.fields.event_timestamp_us.stringValue / 1000; // This is nano seconds since epoch

        }

        if ( cb )
            cb( null, { "startedBy": startedBy, "startTime": moment( startTime ).format() } );

    } );

}

Hopefully that helps someone because it was a good bit of work to put together.


---

