0

One of the vm instances on google cloud compute was shutdown, with an event log in stackdriver without ip or actor (user or service or system) which initiated the event. The instance has onHostMaintenance set to migrate and automaticRestart set to true. This particular instance has migrated on maintenance without error before. The stackdriver event log looks like

{
    actor: {
        user: ""
    },
    event_subtype: "compute.instances.stop",
    event_timestamp_us: "1531781734907624",
    event_type: "GCE_API_CALL",
    ip_address: "",
}

The user and ip_address fields are NOT redacted. They have empty values on actual log.

is this common? how does one identify the cause for shutdown in these peculiar cases ?

Ragavan Govindarajan
  • 1

2 Answers2

0

According to your event type, I dive in the doc of Activity logs,

Compute Engine API calls - GCE_API_CALL events are API calls that change the state of a resource.

It seems like someone may use API calls to shutdown your VM. Looking your settings and logs on the VM instance, it can't be a hostError or Maintenance event. As far as you turn on the onHostMaintenance set to migrate and automaticRestart set to true. Your VM will always be migrated to another hardware.

Out of curiosity, did you restart your VM? did it shutdown again? How often does it happen?

Lee
  • 728
  • 7
  • 23
  • Thanks for checking out, seems like app engine had an outage during that time, [incident](https://status.cloud.google.com/incident/appengine/18005) . – Ragavan Govindarajan Jul 18 '18 at 04:43
  • @RagavanGovindarajan Hi, thx for letting me know. But how does that incident affect your VM instance's shutdown issue? – Lee Jul 18 '18 at 07:56
  • The VM didn't get shutdown like this before and they are continuing to run without any issues after the manual restart. I am guessing the instance got shutdown during that incident where [many](https://9to5google.com/2018/07/17/google-cloud-platform-outage-spotify-snapchat/) app engine instances were affected and that's probably the reason stackdriver is not showing the user. – Ragavan Govindarajan Jul 18 '18 at 10:55
0

Seems like app engine had an outage during that time, incident .

Ragavan Govindarajan
  • 1