How to know the history of what happened in GCP

Question

I had a VM in my account, and out of nowhere, the VM just disappeared. Is there any way to review what was done and why?

Answer 1

Seems to be if you are using free trial You need to explicitly enable billing while during the trial, otherwise your instances will be shut down when the trial runs out. It is not possible to retrieve the instances that have been deleted once. If it has been stopped, it can be retrieved back by simply starting it again.

But During the creation of the Instance you could configure deletion rules to keep the boot disk when the instance is deleted. This can be configured in the submenu “Management, security, disks, networking, sole tenancy” in the Disks section.

Refer to this SO for more information.

Answer 2

You can review what has been done by Audit Logs on GCP. Audit logs help you answer "who did what, where, and when?" within your Google Cloud resources with the same level of transparency as in on-premises environments. This could help you determine what happened to your VM.

To view Audit Logs for Compute Engine, please refer to this doc. To read more about the Compute Engine Audit Logs, you can review this doc.