Is there a way in the GCP console to see who started a Compute Engine VM that has been running for 1.5 years?

Question

Any way to do this in Console? If not Console, is there an API/SDK option?

Answer 1

You could try with Logs Explorer.
According to the official documentation, These are the logs retention periods

Log type	Default retention period	Custom retention
Admin Activity audit logs	400 days	Not configurable
System Event audit logs	400 days	Not configurable
Access Transparency logs	400 days	Not configurable
Data Access audit logs	30 days	Configurable
Policy Denied audit logs	30 days	Configurable
All other logs	30 days	Configurable

This kind of log is in the log type Admin Activity audit logs

Admin Activity audit logs contain log entries for API calls or other administrative actions that modify the configuration or metadata of resources. For example, these logs record when users create VM instances or change Identity and Access Management permissions.

And you can use the following filter on your Log Explorer:

severity=NOTICE
protoPayload.methodName="v1.compute.instances.start"
resource.type="gce_instance"
resource.labels.instance_id="<<INSTANCE_ID>>"

Note: The instance_is a numerical value

And then you could adjust the period on Select time range

Unfortunately it seems that you try to get information older than the default retention period that is 400 days, so maybe you won’t be able to get it.