search

Determine which user deleted the OpenStack instance from nova-api logs

hashtag
Problem

To find out which user did delete the VM instance from the environment

hashtag
Environment

  • Platform9 Managed OpenStack - v4.0 and Higher

hashtag
Procedure

Check for instance uuid and delete requests in the /var/log/nova/nova-api.log file which is found on the management plane. If you are not sure about instance uuid simply search for the delete entry in the nova-api.log.

Or

if you are unsure about the instance uuid you can reach out to pf9 support team in case of multiple VM deletion entries.

Log entry will have entry something like this:

INFO nova.osapi_compute.wsgi.server [<Req-ID> <User-ID> <tenant/project-ID> - default default] 208.127.31.11,127.0.0.1 "DELETE //v2.1/<tenant/project-ID>/servers/<Instance-UUID> HTTP/1.1" status: 204 len: 381 time: 0.1670513
# grep "7ffa00c0-2as4-47be-b54c-8f11sd6e6b01d" /var/log/nova/nova-api.log* | grep DELETE
nova/nova-api.log-20221222:2022-12-21 15:16:41,639.639 23454 INFO nova.osapi_compute.wsgi.server [req-db1d23ed-4c70-42d1-b4b9-f619b2ca1ce2 716af28923154e3c85dcee543d936f6f 999702806f164fbc8de45c31be6de847 - default default] 208.127.31.11,127.0.0.1 "DELETE //v2.1/999702806f164fbc8de45c31be6de847/servers/7ffa00c0-2as4-47be-b54c-8f11sd6e6b01d HTTP/1.1" status: 204 len: 381 time: 0.1670513

In above example - description is given as below

Req-ID							-  req-db1d23ed-4c70-42d1-b4b9-f619b2ca1ce2
User-ID							-  716af28923154e3c85dcee543d936f6f
Tenant/Project Id		-  999702806f164fbc8de45c31be6de847
Instance-UUID				-  7ffa00c0-2as4-47be-b54c-8f11sd6e6b01d

Now, search for that User-ID to get the exact username using below command:

Here, user@company-name.com is the user who deleted the VM.

PreviousNew node fails to onboard with error "The cpu_models option is not required when cpu_mode!=custom"NextDetermine Which User Deleted VM instance

Last updated