Determine which user deleted the OpenStack instance from nova-api logs
Problem
To find out which user did delete the VM instance from the environment
Environment
- Platform9 Managed OpenStack - v4.0 and Higher
Procedure
Check for instance uuid and delete requests in the /var/log/nova/nova-api.log file which is found on the management plane. If you are not sure about instance uuid simply search for the delete entry in the nova-api.log.
Or
if you are unsure about the instance uuid you can reach out to pf9 support team in case of multiple VM deletion entries.
Log entry will have entry something like this:
INFO nova.osapi_compute.wsgi.server [<Req-ID> <User-ID> <tenant/project-ID> - default default] 208.127.31.11,127.0.0.1 "DELETE //v2.1/<tenant/project-ID>/servers/<Instance-UUID> HTTP/1.1" status: 204 len: 381 time: 0.1670513 # grep "7ffa00c0-2as4-47be-b54c-8f11sd6e6b01d" /var/log/nova/nova-api.log* | grep DELETEnova/nova-api.log-20221222:2022-12-21 15:16:41,639.639 23454 INFO nova.osapi_compute.wsgi.server [req-db1d23ed-4c70-42d1-b4b9-f619b2ca1ce2 716af28923154e3c85dcee543d936f6f 999702806f164fbc8de45c31be6de847 - default default] 208.127.31.11,127.0.0.1 "DELETE //v2.1/999702806f164fbc8de45c31be6de847/servers/7ffa00c0-2as4-47be-b54c-8f11sd6e6b01d HTTP/1.1" status: 204 len: 381 time: 0.1670513In above example - description is given as below
Req-ID - req-db1d23ed-4c70-42d1-b4b9-f619b2ca1ce2User-ID - 716af28923154e3c85dcee543d936f6fTenant/Project Id - 999702806f164fbc8de45c31be6de847Instance-UUID - 7ffa00c0-2as4-47be-b54c-8f11sd6e6b01dNow, search for that User-ID to get the exact username using below command:
# openstack user list | grep 716af28923154e3c85dcee543d936f6f| 716af28923154e3c85dcee543d936f6f | user@company-name.com |Here, user@company-name.com is the user who deleted the VM.
Was this page helpful?