How to determine which user deployed, updated, restarted or restaged an application in TAS/TPCF

Products

• VMware Tanzu Platform - Cloud Foundry

Issue/Introduction

This KB discuss how to determine which user is responsible for certain events such as app deployment, app update, app restart, app restage, etc...

The complete list of events are listed here.

Resolution

Use the cf events <app-name> command to list all events for a certain app. Here is a sample result, please note on the column actor (in red below) where it shows specific username made by a specific app event

time                          event                      actor   description
2018-09-04T17:03:49.00-0700   audit.app.droplet.create   admin
2018-09-04T17:03:28.00-0700   audit.app.update           admin   state: STARTED
2018-09-04T17:03:27.00-0700   audit.app.build.create     admin
2018-09-04T17:03:24.00-0700   audit.app.upload-bits      admin
2018-09-04T17:03:24.00-0700   audit.app.map-route        admin
2018-09-04T17:03:24.00-0700   audit.app.create           admin   instances: 1, state: STOPPED, environment_json: [PRIVATE DATA HIDDEN]

Alternatively you can also use capi /v3/audit_events endpoint and look for actor section, sample below

     "actor": {
        "guid": "##########",
        "type": "user",
        "name": "admin"
      }