0

We run only a small handful of instances on Google Cloud Platform and we don't run them all the time. Generally we just fire one up, do what we need to do then shut it down... which is great, except when "we" forget to shut them down.

I've been able to track down the relevant REST APIs and the gcloud sdk but I don't see anything that says who started the instance. Actually it also doesn't have a timestamp on when it was started.

I did find this python app engine script that I might be able to rewrite to stop the instances after X amount of time, but I'd rather find a way to notify the user who started it and let them know the instance is still running.

Has anyone tried to do something similar or seen a way to get the "starter" of the instance in GCP?

neilH
  • 3,320
  • 1
  • 17
  • 38
nomadic_squirrel
  • 614
  • 7
  • 21

2 Answers2

4

You can look into the Audit Logs to determine who did what, where, and when. Further, you can use the Stackdriver Logging API method entries.list to retrieve audit log entries for your use case.

Also you can choose use the Activity Logs to know the details such as the authorized user who made the API request.

JL-HaiNan
  • 1,004
  • 9
  • 20
  • Sweet. With those links I was able to construct this gcloud command: `gcloud logging read "resource.type = gce_instance AND jsonPayload.event_subtype = compute.instances.start"`. Thanks! – nomadic_squirrel Mar 02 '18 at 01:12
0

With the new API you have to filter on the following:

resource.type="gce_instance"
resource.labels.instance_id="ID"
protoPayload.methodName="v1.compute.instances.start"
Anxo
  • 81
  • 1
  • 1