Answers: <p>Not sure if you sorted this out, but I had to do something similar to get who started the instance so I can badger them into stopping the instance if they are not using it. I put together a Logging query:</p>
  
  <p><code>resource.type = gce_instance AND (jsonPayload.event_subtype = compute.instances.start OR jsonPayload.event_subtype = compute.instances.insert ) AND jsonPayload.event_type = GCE_OPERATION_DONE AND timestamp &gt;= "2018-10-29T14:28:34-07:00" AND jsonPayload.actor.user!="" AND jsonPayload.resource.name=my-sweet-instance-name</code></p>
  
  <p>And here is the nodejs function I put together to get it:</p>
  
  <pre><code>const Logging   = require( '@google-cloud/logging' );
  const moment    = require( 'moment' );
  
  const logging   = new Logging( );
  
  
  
  
  var getStartInfo = function( instanceName, querySince, cb ) {
  
      var tstart = ( querySince ? querySince : moment( ).subtract( 48, 'hours' ).format( ) ); // 
  
      var theLogFilter = 'resource.type = gce_instance AND ' +
          '(jsonPayload.event_subtype = compute.instances.start OR jsonPayload.event_subtype = compute.instances.insert ) AND ' +
          'jsonPayload.event_type = GCE_OPERATION_DONE AND ' +
          'timestamp &gt;= "' + tstart + '" AND ' +
          'jsonPayload.actor.user!="" AND ' +
          'jsonPayload.resource.name=' + instanceName;
  
      logging.getEntries( {
          filter: theLogFilter,
          autoPaginate: false
      }, ( err, entries, nextQuery, apiResponse ) =&gt; {
  
  
          if ( err ) {
              console.log( "ERROR: " + err );
              cb( err );
              return;
          }
  
          var item, startedBy, startTime, runningTime, mostRecentStart;
  
          //console.log( 'Entries: ' + JSON.stringify( entries ) );
          // Mabye if none found, we try again with a longer querySince?
          if ( entries.length == 0 ) {
  
              console.log( "\nNo log entries found for instance '" + instanceName + "'. Filter:" );
              console.log( theLogFilter );
              cb( "No entries found" );
              return;
          }
  
  
          // Are these sorted by time?
          for ( var i = 0; i &lt; entries.length; i++ ) {
  
  
              startedBy = entries[ i ].metadata.jsonPayload.fields.actor.structValue.fields.user.stringValue;
              startTime = entries[ i ].metadata.jsonPayload.fields.event_timestamp_us.stringValue / 1000; // This is nano seconds since epoch
  
          }
  
          if ( cb )
              cb( null, { "startedBy": startedBy, "startTime": moment( startTime ).format() } );
  
      } );
  
  }
  </code></pre>
  
  <p>Hopefully that helps someone because it was a good bit of work to put together.</p>
  
Answers: CC BY-SA 4.0
Answers: 2018-10-31T21:34:12.483Z
Answers: 2018-10-31T21:34:12.483Z
Answers: nomadic_squirrel
Answers: <p>Note: I'm not a GCE user yet, the answer is based solely on documentation.</p>
  
  <p>You could be <a href="https://cloud.google.com/compute/docs/audit-logging" rel="noreferrer">Viewing Audit Logs</a> in the <code>Google Cloud Console</code>, more specifically the <a href="https://cloud.google.com/logging/docs/audit/#admin-activity" rel="noreferrer">Admin Activity logs</a>:</p>
  
  <blockquote>
    <p>Admin Activity logs contain log entries for API calls or other
    administrative actions that modify the configuration or metadata of
    resources. For example, the logs record when VM instances and App
    Engine applications are created and when permissions are changed. To
    view the logs, you must have the IAM roles <strong>Logging/Logs Viewer</strong> or
    <strong>Project/Viewer</strong>.</p>
  </blockquote>
  
  <p>You would be looking for the <a href="https://cloud.google.com/logging/docs/audit/#user_identities_in_audit_logs" rel="noreferrer">User identities in audit logs</a>:</p>
  
  <blockquote>
    <p>Audit logs record the identity of the user performing logged actions.
    The identity is held in the <code>AuthenticationInfo</code> field of <a href="https://cloud.google.com/logging/docs/audit/api/ref/rest/Shared.Types/AuditLog" rel="noreferrer">AuditLog</a>
    objects.</p>
  </blockquote>
  
  <p>Ideally you'd be looking for the GCE instance creation events, but some/all of those may be too old for the logs retention policy. Then maybe search for VM instance start or other relevant events.</p>
  
  <p>You could also check and maybe cross-reference the audit logs info with that from <a href="https://cloud.google.com/compute/docs/usage-export" rel="noreferrer">Usage Reports</a> or <a href="https://support.google.com/cloud/answer/4524336" rel="noreferrer">exported billing info</a>.</p>
  
  <p>If this is a regular, on-going activity you may want to setup an automated <a href="https://cloud.google.com/logging/docs/export/using_exported_logs" rel="noreferrer">log exporting</a> and processing pipeline.</p>
  
Answers: CC BY-SA 3.0
Answers: 2017-09-26T15:50:38.397Z
Answers: 2017-09-26T15:50:38.397Z
Answers: Dan Cornilescu
Body: <p>We have several billing enabled projects in our GCP account and each of them has several Compute Engine Instances. I want to remove non-critical instances just to reduce the unnecessary billing. But before I do that, I need to know which instance is being used for what and for that I need to know which user created it in the first place.</p>
  
  <p>How do I get to know the creator of each instance either by using <code>Google Cloud Shell</code> or <code>Google Cloud Console</code>?</p>
  
Tags: <google-cloud-platform><gcp><google-compute-engine>
Title: How to know which user created the GCE Instance
UserDisplayName: noob
ThreadText: # How to know which user created the GCE Instance
  
  (Asked by: username_0 on 2017-09-26)
  
  We have several billing enabled projects in our GCP account and each of them has several Compute Engine Instances. I want to remove non-critical instances just to reduce the unnecessary billing. But before I do that, I need to know which instance is being used for what and for that I need to know which user created it in the first place.
  
  How do I get to know the creator of each instance either by using `Google Cloud Shell` or `Google Cloud Console`?
  
  **Tags:** google-cloud-platform, gcp, google-compute-engine
  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_2 on 2017-09-26. Score: 7 | Accepted answer
  
  Note: I'm not a GCE user yet, the answer is based solely on documentation.
  
  You could be [Viewing Audit Logs](https://cloud.google.com/compute/docs/audit-logging) in the `Google Cloud Console`, more specifically the [Admin Activity logs](https://cloud.google.com/logging/docs/audit/#admin-activity):
  
  > Admin Activity logs contain log entries for API calls or other
  > administrative actions that modify the configuration or metadata of
  > resources. For example, the logs record when VM instances and App
  > Engine applications are created and when permissions are changed. To
  > view the logs, you must have the IAM roles **Logging/Logs Viewer** or
  > **Project/Viewer**.
  
  You would be looking for the [User identities in audit logs](https://cloud.google.com/logging/docs/audit/#user_identities_in_audit_logs):
  
  > Audit logs record the identity of the user performing logged actions.
  > The identity is held in the `AuthenticationInfo` field of [AuditLog](https://cloud.google.com/logging/docs/audit/api/ref/rest/Shared.Types/AuditLog)
  > objects.
  
  Ideally you'd be looking for the GCE instance creation events, but some/all of those may be too old for the logs retention policy. Then maybe search for VM instance start or other relevant events.
  
  You could also check and maybe cross-reference the audit logs info with that from [Usage Reports](https://cloud.google.com/compute/docs/usage-export) or [exported billing info](https://support.google.com/cloud/answer/4524336).
  
  If this is a regular, on-going activity you may want to setup an automated [log exporting](https://cloud.google.com/logging/docs/export/using_exported_logs) and processing pipeline.
  
  
  ---
  
  ### Answer by username_1 on 2018-10-31. Score: 2
  
  Not sure if you sorted this out, but I had to do something similar to get who started the instance so I can badger them into stopping the instance if they are not using it. I put together a Logging query:
  
  `resource.type = gce_instance AND (jsonPayload.event_subtype = compute.instances.start OR jsonPayload.event_subtype = compute.instances.insert ) AND jsonPayload.event_type = GCE_OPERATION_DONE AND timestamp >= "2018-10-29T14:28:34-07:00" AND jsonPayload.actor.user!="" AND jsonPayload.resource.name=my-sweet-instance-name`
  
  And here is the nodejs function I put together to get it:
  
  ```
  const Logging   = require( '@google-cloud/logging' );
  const moment    = require( 'moment' );
  
  const logging   = new Logging( );
  
  var getStartInfo = function( instanceName, querySince, cb ) {
  
      var tstart = ( querySince ? querySince : moment( ).subtract( 48, 'hours' ).format( ) ); // 
  
      var theLogFilter = 'resource.type = gce_instance AND ' +
          '(jsonPayload.event_subtype = compute.instances.start OR jsonPayload.event_subtype = compute.instances.insert ) AND ' +
          'jsonPayload.event_type = GCE_OPERATION_DONE AND ' +
          'timestamp >= "' + tstart + '" AND ' +
          'jsonPayload.actor.user!="" AND ' +
          'jsonPayload.resource.name=' + instanceName;
  
      logging.getEntries( {
          filter: theLogFilter,
          autoPaginate: false
      }, ( err, entries, nextQuery, apiResponse ) => {
  
          if ( err ) {
              console.log( "ERROR: " + err );
              cb( err );
              return;
          }
  
          var item, startedBy, startTime, runningTime, mostRecentStart;
  
          //console.log( 'Entries: ' + JSON.stringify( entries ) );
          // Mabye if none found, we try again with a longer querySince?
          if ( entries.length == 0 ) {
  
              console.log( "\nNo log entries found for instance '" + instanceName + "'. Filter:" );
              console.log( theLogFilter );
              cb( "No entries found" );
              return;
          }
  
          // Are these sorted by time?
          for ( var i = 0; i < entries.length; i++ ) {
  
              startedBy = entries[ i ].metadata.jsonPayload.fields.actor.structValue.fields.user.stringValue;
              startTime = entries[ i ].metadata.jsonPayload.fields.event_timestamp_us.stringValue / 1000; // This is nano seconds since epoch
  
          }
  
          if ( cb )
              cb( null, { "startedBy": startedBy, "startTime": moment( startTime ).format() } );
  
      } );
  
  }
  
  ```
  
  Hopefully that helps someone because it was a good bit of work to put together.
  
  
  ---
  
  