uknown reason for google cloud compute engine VM shutdown?

Question

One of the vm instances on google cloud compute was shutdown, with an event log in stackdriver without ip or actor (user or service or system) which initiated the event. The instance has onHostMaintenance set to migrate and automaticRestart set to true. This particular instance has migrated on maintenance without error before. The stackdriver event log looks like

{
    actor: {
        user: ""
    },
    event_subtype: "compute.instances.stop",
    event_timestamp_us: "1531781734907624",
    event_type: "GCE_API_CALL",
    ip_address: "",
}

The user and ip_address fields are NOT redacted. They have empty values on actual log.

is this common? how does one identify the cause for shutdown in these peculiar cases ?

Lee Lee · Accepted Answer · 2018-07-17T09:39:12

According to your event type, I dive in the doc of Activity logs,

Compute Engine API calls - GCE_API_CALL events are API calls that change the state of a resource.

It seems like someone may use API calls to shutdown your VM. Looking your settings and logs on the VM instance, it can't be a hostError or Maintenance event. As far as you turn on the onHostMaintenance set to migrate and automaticRestart set to true. Your VM will always be migrated to another hardware.

Out of curiosity, did you restart your VM? did it shutdown again? How often does it happen?

uknown reason for google cloud compute engine VM shutdown?

2 Answers