You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@cloudstack.apache.org by "midhunpjos (via GitHub)" <gi...@apache.org> on 2025/05/23 07:45:50 UTC
[D] Unexpected Deletion of Valid Disks by CloudStack + XCP-ng 8.2.1 [cloudstack]
GitHub user midhunpjos created a discussion: Unexpected Deletion of Valid Disks by CloudStack + XCP-ng 8.2.1
We recently encountered an unusual issue with CloudStack, where some valid disks assigned to stopped instances were unexpectedly deleted.
Upon investigation, logs from the XCP-ng Center indicated that the delete requests for the VDIs originated from CloudStack. Interestingly, this coincided with the execution of a volume cleanup thread within CloudStack.
However, during this cleanup process, CloudStack also issued a delete command for a disk that was actually in a "Ready" state. we could not find any corresponding delete request for that valid disk in the CloudStack management server logs.
This raises concerns about a potential issue in the volume cleanup logic or logging mechanisms within CloudStack.
Has anyone else experienced a similar scenario, or is aware of what might cause such behavior?
audit logs from xen getting requests from cloudstack
`May 20 06:39:12 dhcld-az1c2-xcph01 xapi: [20250520T00:54:12.925Z|audit||178683230 HTTPS 10.140.1.13->:::80|VDI.destroy R:c81eccd0efa4|audit] ('trackid=47508e295ef7610e1fc86ae9a02090b2' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:03e5cebb-c885-4ed9-a7db-27a40bcbee6d; destroy ]' 'API' 'VDI.destroy' (('self' 'ROOT-546' 'e9253423-48eb-471d-be43-4e0f46d44593' 'OpaqueRef:03e5cebb-c885-4ed9-a7db-27a40bcbee6d')))
May 20 06:42:18 dhcld-az1c2-xcph01 xapi: [20250520T00:57:18.072Z|audit||178683230 HTTPS 10.140.1.13->:::80|VDI.destroy R:a5223d94b8f5|audit] ('trackid=47508e295ef7610e1fc86ae9a02090b2' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'OK' 'API' 'VDI.destroy' (('self' 'ROOT-12558' '4d7f2a7d-637e-446c-aa5f-57c867d7848a' 'OpaqueRef:fe55984f-df0f-4a92-ab57-2f381f67c669')))
May 20 06:42:18 dhcld-az1c2-xcph01 xapi: [20250520T00:57:18.107Z|audit||178683230 HTTPS 10.140.1.13->:::80|VDI.destroy R:70523a4fd400|audit] ('trackid=47508e295ef7610e1fc86ae9a02090b2' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:fcb01b3f-98a5-4d13-a1ac-fd5337fe2ec0; destroy ]' 'API' 'VDI.destroy' (('self' 'ROOT-12776' '6b03ea00-657b-4567-8063-5b8370e6bfda' 'OpaqueRef:fcb01b3f-98a5-4d13-a1ac-fd5337fe2ec0')))
May 20 06:42:19 dhcld-az1c2-xcph01 xapi: [20250520T00:57:19.883Z|audit||178683230 HTTPS 10.140.1.13->:::80|VDI.destroy R:ef1a9d18f7d6|audit] ('trackid=47508e295ef7610e1fc86ae9a02090b2' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:aa7e8124-a669-4edc-b8b8-1610b395b7cd; destroy ]' 'API' 'VDI.destroy' (('self' 'ROOT-13929' 'a0b4f644-bc40-4b82-9f2a-dafcaf6db0ae' 'OpaqueRef:aa7e8124-a669-4edc-b8b8-1610b395b7cd')))
May 20 11:41:28 dhcld-az1c2-xcph01 xapi: [20250520T05:56:28.476Z|audit||178964351 HTTPS 10.140.1.13->:::80|VDI.destroy R:92b87bb5e694|audit] ('trackid=47508e295ef7610e1fc86ae9a02090b2' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'OK' 'API' 'VDI.destroy' (('self' 'ROOT-14400' 'e3bad622-578e-4d29-924e-47b66a6439d6' 'OpaqueRef:e8db1761-e15d-45c3-891e-d7766a867cee')))
May 20 12:05:42 dhcld-az1c2-xcph01 xapi: [20250520T06:20:42.998Z|audit||178983321 HTTPS 10.140.1.13->:::80|VDI.destroy R:ef9634e5414d|audit] ('trackid=47508e295ef7610e1fc86ae9a02090b2' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'OK' 'API' 'VDI.destroy' (('self' 'ROOT-12820' '0f707aa3-d858-4231-b6dc-e92dfe910ba3' 'OpaqueRef:00b6bd67-21a5-43d9-ab86-2442ad13516f')`
Cleanup log reference at the time of incident:
`2025-05-20 06:39:12,873 DEBUG [c.c.a.t.Request] (StorageManager-Scavenger-1:ctx-6ed39762) (logid:69e084ff) Seq 32-4469822630165282172: Sending { Cmd , MgmtId: 108462341209969, via: 32(DHCLD-AZ1C2-XCPH04), Ver: v1, Flags: 100011, [{"org.apache.cloudstack.storage.command.DeleteCommand":{"data":{"org.apache.cloudstack.storage.to.VolumeObjectTO":{"uuid":"649ab11c-ff50-4a81-8e8b-7fe1110a8608","volumeType":"ROOT","dataStore":{"org.apache.cloudstack.storage.to.PrimaryDataStoreTO":{"uuid":"PUREC-DHCLD-AZ1C2-VOL1","name":"PUREC-DHCLD-AZ1C2-VOL1","id":"5","poolType":"PreSetup","host":"localhost","path":"/PUREC-DHCLD-AZ1C2-VOL1","port":"0","url":"PreSetup://localhost/PUREC-DHCLD-AZ1C2-VOL1/?ROLE=Primary&STOREUUID=PUREC-DHCLD-AZ1C2-VOL1","isManaged":"false"}},"name":"ROOT-546","size":"(4.89 GB) 5253365760","path":"e9253423-48eb-471d-be43-4e0f46d44593","volumeId":"2164","accountId":"74","format":"VHD","provisioningType":"THIN","poolId":"5","id":"2164","deviceId":"0","hypervisorType":"XenServer"
,"directDownload":"false","deployAsIs":"false","followRedirects":"true"}},"wait":"0","bypassHostMaintenance":"false"}}] }
2025-05-20 06:39:12,875 DEBUG [c.c.a.t.Request] (StorageManager-Scavenger-1:ctx-6ed39762) (logid:69e084ff) Seq 32-4469822630165282172: Executing: { Cmd , MgmtId: 108462341209969, via: 32(DHCLD-AZ1C2-XCPH04), Ver: v1, Flags: 100011, [{"org.apache.cloudstack.storage.command.DeleteCommand":{"data":{"org.apache.cloudstack.storage.to.VolumeObjectTO":{"uuid":"649ab11c-ff50-4a81-8e8b-7fe1110a8608","volumeType":"ROOT","dataStore":{"org.apache.cloudstack.storage.to.PrimaryDataStoreTO":{"uuid":"PUREC-DHCLD-AZ1C2-VOL1","name":"PUREC-DHCLD-AZ1C2-VOL1","id":"5","poolType":"PreSetup","host":"localhost","path":"/PUREC-DHCLD-AZ1C2-VOL1","port":"0","url":"PreSetup://localhost/PUREC-DHCLD-AZ1C2-VOL1/?ROLE=Primary&STOREUUID=PUREC-DHCLD-AZ1C2-VOL1","isManaged":"false"}},"name":"ROOT-546","size":"(4.89 GB) 5253365760","path":"e9253423-48eb-471d-be43-4e0f46d44593","volumeId":"2164","accountId":"74","format":"VHD","provisioningType":"THIN","poolId":"5","id":"2164","deviceId":"0","hypervisorType":"XenServe
r","directDownload":"false","deployAsIs":"false","followRedirects":"true"}},"wait":"0","bypassHostMaintenance":"false"}}] }`
GitHub link: https://github.com/apache/cloudstack/discussions/10911
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] Unexpected Deletion of Valid Disks by CloudStack + XCP-ng 8.2.1 [cloudstack]
Posted by "weizhouapache (via GitHub)" <gi...@apache.org>.
GitHub user weizhouapache added a comment to the discussion: Unexpected Deletion of Valid Disks by CloudStack + XCP-ng 8.2.1
@midhunpjos
it might be because vm is destroyed on xenserver when ACS stops it.
the behaviour will be changed in 4.19.3 and 4.20.1
https://github.com/apache/cloudstack/pull/9175
GitHub link: https://github.com/apache/cloudstack/discussions/10911#discussioncomment-13246349
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] Unexpected Deletion of Valid Disks by CloudStack + XCP-ng 8.2.1 [cloudstack]
Posted by "weizhouapache (via GitHub)" <gi...@apache.org>.
GitHub user weizhouapache added a comment to the discussion: Unexpected Deletion of Valid Disks by CloudStack + XCP-ng 8.2.1
> @weizhouapache ACS Version: 4.19.1.3
>
> Reading the volume cleanup id=2164 belonged to a virtual router which was in deleted state in ACS but in xen the instance was in suspended state.
>
if so, it is not an issue caused by the GC thread.
> Issue is for the volume ROOT-12558, in xen logs a call to destroy the Volume was triggered but in cloudstack logs no relevant logs to cleanup the volume was there. The Volume ROOT-12558 is still in ready state in ACS XEN logs on VDI delete:
>
> May 20 06:42:18 dhcld-az1c2-xcph01 xapi: [20250520T00:57:18.072Z|audit||178683230 HTTPS 10.140.1.13->:::80|VDI.destroy R:a5223d94b8f5|audit] ('trackid=47508e295ef7610e1fc86ae9a02090b2' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'OK' 'API' 'VDI.destroy' (('self' 'ROOT-12558' '4d7f2a7d-637e-446c-aa5f-57c867d7848a' 'OpaqueRef:fe55984f-df0f-4a92-ab57-2f381f67c669'))) May 20 06:42:18 dhcld-az1c2-xcph01 xapi: [20250520T00:57:18.107Z|audit||178683230
are there multiple volumes with same name `ROOT-12558` ?
GitHub link: https://github.com/apache/cloudstack/discussions/10911#discussioncomment-13244087
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] Unexpected Deletion of Valid Disks by CloudStack + XCP-ng 8.2.1 [cloudstack]
Posted by "midhunpjos (via GitHub)" <gi...@apache.org>.
GitHub user midhunpjos added a comment to the discussion: Unexpected Deletion of Valid Disks by CloudStack + XCP-ng 8.2.1
@weizhouapache Not sure if below give some clue:
Upon further analysis of the XCP-ng logs, it was observed that CloudStack repeatedly attempted to delete the disk ROOT-12558 while the associated instance was still running. XCP-ng appropriately blocked the deletion attempt, as the disk was actively attached to a running virtual machine. Similar deletion attempts were made for other disks, but they also failed for the same reason—each was still in use by a running instance.
Please refer below logs:
audit.log.10.gz:May 17 06:37:34 dhcld-az1c2-xcph01 xapi: [20250517T00:52:34.904Z|audit||174862304 HTTPS 10.140.1.13->:::80|VDI.destroy R:8b551d3b0c34|audit] ('trackid=47508e295ef7610e1fc86ae9a02090b2' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:03e5cebb-c885-4ed9-a7db-27a40bcbee6d; destroy ]' 'API' 'VDI.destroy' (('self' 'ROOT-546' 'e9253423-48eb-471d-be43-4e0f46d44593' 'OpaqueRef:03e5cebb-c885-4ed9-a7db-27a40bcbee6d')))
audit.log.10.gz:May 17 06:37:35 dhcld-az1c2-xcph01 xapi: [20250517T00:52:35.143Z|audit||174862304 HTTPS 10.140.1.13->:::80|VDI.destroy R:7835611b83f6|audit] ('trackid=47508e295ef7610e1fc86ae9a02090b2' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:fe55984f-df0f-4a92-ab57-2f381f67c669; destroy ]' 'API' 'VDI.destroy' (('self' 'ROOT-12558' '4d7f2a7d-637e-446c-aa5f-57c867d7848a' 'OpaqueRef:fe55984f-df0f-4a92-ab57-2f381f67c669')))
audit.log.10.gz:May 17 06:37:36 dhcld-az1c2-xcph01 xapi: [20250517T00:52:36.156Z|audit||174862304 HTTPS 10.140.1.13->:::80|VDI.destroy R:753d7c2d876f|audit] ('trackid=47508e295ef7610e1fc86ae9a02090b2' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:aa7e8124-a669-4edc-b8b8-1610b395b7cd; destroy ]' 'API' 'VDI.destroy' (('self' 'ROOT-13929' 'a0b4f644-bc40-4b82-9f2a-dafcaf6db0ae' 'OpaqueRef:aa7e8124-a669-4edc-b8b8-1610b395b7cd')))
audit.log.12.gz:May 15 03:29:28 dhcld-az1c2-xcph01 xapi: [20250514T21:44:28.903Z|audit||172404592 HTTPS 10.246.250.41->|Async.VDI.destroy R:a6860cff083d|audit] ('trackid=41c34c83ce3157aaa3aaa56179a1aed1' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:db73ba38-1df5-4ccf-8e57-0af2517bfdda; destroy ]' 'API' 'VDI.destroy' (('self' 'PRATHAM-IT-VM1-DD-500GB' '814103cb-5795-45c4-a94b-2ccaad9acadf' 'OpaqueRef:db73ba38-1df5-4ccf-8e57-0af2517bfdda')))
audit.log.12.gz:May 15 10:26:59 dhcld-az1c2-xcph01 xapi: [20250515T04:41:59.500Z|audit||172730688 HTTPS 10.140.1.13->:::80|VDI.destroy R:2c1987968524|audit] ('trackid=47508e295ef7610e1fc86ae9a02090b2' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:03e5cebb-c885-4ed9-a7db-27a40bcbee6d; destroy ]' 'API' 'VDI.destroy' (('self' 'ROOT-546' 'e9253423-48eb-471d-be43-4e0f46d44593' 'OpaqueRef:03e5cebb-c885-4ed9-a7db-27a40bcbee6d')))
audit.log.12.gz:May 15 10:26:59 dhcld-az1c2-xcph01 xapi: [20250515T04:41:59.702Z|audit||172730688 HTTPS 10.140.1.13->:::80|VDI.destroy R:c8695f749a48|audit] ('trackid=47508e295ef7610e1fc86ae9a02090b2' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:fe55984f-df0f-4a92-ab57-2f381f67c669; destroy ]' 'API' 'VDI.destroy' (('self' 'ROOT-12558' '4d7f2a7d-637e-446c-aa5f-57c867d7848a' 'OpaqueRef:fe55984f-df0f-4a92-ab57-2f381f67c669')))
audit.log.12.gz:May 15 10:27:00 dhcld-az1c2-xcph01 xapi: [20250515T04:42:00.428Z|audit||172730559 HTTPS 10.140.1.13->:::80|VDI.destroy R:0a6a23d94e8e|audit] ('trackid=47508e295ef7610e1fc86ae9a02090b2' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:aa7e8124-a669-4edc-b8b8-1610b395b7cd; destroy ]' 'API' 'VDI.destroy' (('self' 'ROOT-13929' 'a0b4f644-bc40-4b82-9f2a-dafcaf6db0ae' 'OpaqueRef:aa7e8124-a669-4edc-b8b8-1610b395b7cd')))
audit.log.13.gz:May 14 06:36:00 dhcld-az1c2-xcph01 xapi: [20250514T00:51:00.533Z|audit||171388599 HTTPS 10.140.1.13->:::80|VDI.destroy R:eab0b7a2b2c1|audit] ('trackid=47508e295ef7610e1fc86ae9a02090b2' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:03e5cebb-c885-4ed9-a7db-27a40bcbee6d; destroy ]' 'API' 'VDI.destroy' (('self' 'ROOT-546' 'e9253423-48eb-471d-be43-4e0f46d44593' 'OpaqueRef:03e5cebb-c885-4ed9-a7db-27a40bcbee6d')))
audit.log.13.gz:May 14 06:36:43 dhcld-az1c2-xcph01 xapi: [20250514T00:51:43.376Z|audit||171388599 HTTPS 10.140.1.13->:::80|VDI.destroy R:cb9d8362f0ba|audit] ('trackid=47508e295ef7610e1fc86ae9a02090b2' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:fe55984f-df0f-4a92-ab57-2f381f67c669; destroy ]' 'API' 'VDI.destroy' (('self' 'ROOT-12558' '4d7f2a7d-637e-446c-aa5f-57c867d7848a' 'OpaqueRef:fe55984f-df0f-4a92-ab57-2f381f67c669')))
audit.log.13.gz:May 14 06:36:44 dhcld-az1c2-xcph01 xapi: [20250514T00:51:44.387Z|audit||171388599 HTTPS 10.140.1.13->:::80|VDI.destroy R:f623a6341dfa|audit] ('trackid=47508e295ef7610e1fc86ae9a02090b2' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:aa7e8124-a669-4edc-b8b8-1610b395b7cd; destroy ]' 'API' 'VDI.destroy' (('self' 'ROOT-13929' 'a0b4f644-bc40-4b82-9f2a-dafcaf6db0ae' 'OpaqueRef:aa7e8124-a669-4edc-b8b8-1610b395b7cd')))
audit.log.14.gz:May 13 03:22:46 dhcld-az1c2-xcph01 xapi: [20250512T21:37:46.875Z|audit||170159341 HTTPS 10.140.1.13->:::80|VDI.destroy R:9173fae50ef7|audit] ('trackid=97987b724e2503592f9e53fa56283e70' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:03e5cebb-c885-4ed9-a7db-27a40bcbee6d; destroy ]' 'API' 'VDI.destroy' (('self' 'ROOT-546' 'e9253423-48eb-471d-be43-4e0f46d44593' 'OpaqueRef:03e5cebb-c885-4ed9-a7db-27a40bcbee6d')))
audit.log.14.gz:May 13 22:39:53 dhcld-az1c2-xcph01 xapi: [20250513T16:54:53.282Z|audit||171042508 HTTPS 10.140.1.14->:::80|PBD.unplug R:0693910639b7|audit] ('trackid=7bde073b3ba8ec4b5eaecb2ec4f0df29' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:045ef65c-21ba-4585-a77d-04d0f7c625a9 ]' 'API' 'PBD.unplug' (('self' '' '4c7f7088-e4eb-e5a8-37eb-ae036ed23ca6' 'OpaqueRef:07915105-f550-44c2-a5cd-180f35abf2df')))
audit.log.14.gz:May 13 22:41:20 dhcld-az1c2-xcph01 xapi: [20250513T16:56:20.635Z|audit||171043455 HTTPS 10.140.1.13->:::80|PBD.unplug R:56cd18d0f987|audit] ('trackid=47508e295ef7610e1fc86ae9a02090b2' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:045ef65c-21ba-4585-a77d-04d0f7c625a9 ]' 'API' 'PBD.unplug' (('self' '' '4c7f7088-e4eb-e5a8-37eb-ae036ed23ca6' 'OpaqueRef:07915105-f550-44c2-a5cd-180f35abf2df')))
audit.log.14.gz:May 13 22:41:48 dhcld-az1c2-xcph01 xapi: [20250513T16:56:48.741Z|audit||171043461 HTTPS 10.140.1.13->:::80|PBD.unplug R:8fa3f3f58169|audit] ('trackid=47508e295ef7610e1fc86ae9a02090b2' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:0712989f-0c61-40c1-ae5f-75c0ebe99442 ]' 'API' 'PBD.unplug' (('self' '' '875c0f8f-145e-95d1-82e7-206b366eac9c' 'OpaqueRef:85581d4f-f68d-439e-a617-766886a9ef0c')))
audit.log.15.gz:May 12 08:39:36 dhcld-az1c2-xcph01 xapi: [20250512T02:54:36.311Z|audit||169254230 HTTPS 10.140.1.13->:::80|VDI.destroy R:6db47171717f|audit] ('trackid=97987b724e2503592f9e53fa56283e70' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:fe55984f-df0f-4a92-ab57-2f381f67c669; destroy ]' 'API' 'VDI.destroy' (('self' 'ROOT-12558' '4d7f2a7d-637e-446c-aa5f-57c867d7848a' 'OpaqueRef:fe55984f-df0f-4a92-ab57-2f381f67c669')))
audit.log.15.gz:May 12 08:39:36 dhcld-az1c2-xcph01 xapi: [20250512T02:54:36.831Z|audit||169254230 HTTPS 10.140.1.13->:::80|VDI.destroy R:16fb7e69b311|audit] ('trackid=97987b724e2503592f9e53fa56283e70' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:aa7e8124-a669-4edc-b8b8-1610b395b7cd; destroy ]' 'API' 'VDI.destroy' (('self' 'ROOT-13929' 'a0b4f644-bc40-4b82-9f2a-dafcaf6db0ae' 'OpaqueRef:aa7e8124-a669-4edc-b8b8-1610b395b7cd')))
audit.log.16.gz:May 11 03:21:37 dhcld-az1c2-xcph01 xapi: [20250510T21:36:37.291Z|audit||167599070 HTTPS 10.140.1.13->:::80|VDI.destroy R:5bd73fe696d8|audit] ('trackid=97987b724e2503592f9e53fa56283e70' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:fe55984f-df0f-4a92-ab57-2f381f67c669; destroy ]' 'API' 'VDI.destroy' (('self' 'ROOT-12558' '4d7f2a7d-637e-446c-aa5f-57c867d7848a' 'OpaqueRef:fe55984f-df0f-4a92-ab57-2f381f67c669')))
audit.log.16.gz:May 11 03:21:38 dhcld-az1c2-xcph01 xapi: [20250510T21:36:38.131Z|audit||167598725 HTTPS 10.140.1.13->:::80|VDI.destroy R:41ce7bf97dd7|audit] ('trackid=97987b724e2503592f9e53fa56283e70' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:aa7e8124-a669-4edc-b8b8-1610b395b7cd; destroy ]' 'API' 'VDI.destroy' (('self' 'ROOT-13929' 'a0b4f644-bc40-4b82-9f2a-dafcaf6db0ae' 'OpaqueRef:aa7e8124-a669-4edc-b8b8-1610b395b7cd')))
audit.log.16.gz:May 11 08:39:09 dhcld-az1c2-xcph01 xapi: [20250511T02:54:09.969Z|audit||167911945 HTTPS 10.140.1.14->:::80|VDI.destroy R:a555ade5ba56|audit] ('trackid=7bde073b3ba8ec4b5eaecb2ec4f0df29' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:03e5cebb-c885-4ed9-a7db-27a40bcbee6d; destroy ]' 'API' 'VDI.destroy' (('self' 'ROOT-546' 'e9253423-48eb-471d-be43-4e0f46d44593' 'OpaqueRef:03e5cebb-c885-4ed9-a7db-27a40bcbee6d')))
audit.log.17.gz:May 10 03:20:48 dhcld-az1c2-xcph01 xapi: [20250509T21:35:48.262Z|audit||166288188 HTTPS 10.140.1.13->:::80|VDI.destroy R:6c28559aa485|audit] ('trackid=97987b724e2503592f9e53fa56283e70' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:03e5cebb-c885-4ed9-a7db-27a40bcbee6d; destroy ]' 'API' 'VDI.destroy' (('self' 'ROOT-546' 'e9253423-48eb-471d-be43-4e0f46d44593' 'OpaqueRef:03e5cebb-c885-4ed9-a7db-27a40bcbee6d')))
audit.log.18.gz:May 9 08:33:54 dhcld-az1c2-xcph01 xapi: [20250509T02:48:54.307Z|audit||165455598 HTTPS 10.140.1.14->:::80|VDI.destroy R:0466cfaa249a|audit] ('trackid=7bde073b3ba8ec4b5eaecb2ec4f0df29' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:fe55984f-df0f-4a92-ab57-2f381f67c669; destroy ]' 'API' 'VDI.destroy' (('self' 'ROOT-12558' '4d7f2a7d-637e-446c-aa5f-57c867d7848a' 'OpaqueRef:fe55984f-df0f-4a92-ab57-2f381f67c669')))
audit.log.18.gz:May 9 08:34:30 dhcld-az1c2-xcph01 xapi: [20250509T02:49:30.777Z|audit||165447430 HTTPS 10.140.1.13->:::80|VDI.destroy R:2c4fecfc5acb|audit] ('trackid=97987b724e2503592f9e53fa56283e70' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:aa7e8124-a669-4edc-b8b8-1610b395b7cd; destroy ]' 'API' 'VDI.destroy' (('self' 'ROOT-13929' 'a0b4f644-bc40-4b82-9f2a-dafcaf6db0ae' 'OpaqueRef:aa7e8124-a669-4edc-b8b8-1610b395b7cd')))
audit.log.19.gz:May 8 03:20:27 dhcld-az1c2-xcph01 xapi: [20250507T21:35:27.013Z|audit||164075310 HTTPS 10.140.1.13->:::80|VDI.destroy R:2fda20371400|audit] ('trackid=97987b724e2503592f9e53fa56283e70' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:fe55984f-df0f-4a92-ab57-2f381f67c669; destroy ]' 'API' 'VDI.destroy' (('self' 'ROOT-12558' '4d7f2a7d-637e-446c-aa5f-57c867d7848a' 'OpaqueRef:fe55984f-df0f-4a92-ab57-2f381f67c669')))
audit.log.19.gz:May 8 03:20:27 dhcld-az1c2-xcph01 xapi: [20250507T21:35:27.906Z|audit||164077953 HTTPS 10.140.1.13->:::80|VDI.destroy R:b508bab3c3ab|audit] ('trackid=97987b724e2503592f9e53fa56283e70' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:aa7e8124-a669-4edc-b8b8-1610b395b7cd; destroy ]' 'API' 'VDI.destroy' (('self' 'ROOT-13929' 'a0b4f644-bc40-4b82-9f2a-dafcaf6db0ae' 'OpaqueRef:aa7e8124-a669-4edc-b8b8-1610b395b7cd')))
audit.log.19.gz:May 8 08:32:39 dhcld-az1c2-xcph01 xapi: [20250508T02:47:39.424Z|audit||164326404 HTTPS 10.140.1.13->:::80|VDI.destroy R:1961b851fdeb|audit] ('trackid=97987b724e2503592f9e53fa56283e70' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:03e5cebb-c885-4ed9-a7db-27a40bcbee6d; destroy ]' 'API' 'VDI.destroy' (('self' 'ROOT-546' 'e9253423-48eb-471d-be43-4e0f46d44593' 'OpaqueRef:03e5cebb-c885-4ed9-a7db-27a40bcbee6d')))
audit.log.20.gz:May 7 03:12:44 dhcld-az1c2-xcph01 xapi: [20250506T21:27:44.656Z|audit||162859170 HTTPS 10.140.1.13->:::80|VDI.destroy R:0c46394c7ffa|audit] ('trackid=97987b724e2503592f9e53fa56283e70' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:03e5cebb-c885-4ed9-a7db-27a40bcbee6d; destroy ]' 'API' 'VDI.destroy' (('self' 'ROOT-546' 'e9253423-48eb-471d-be43-4e0f46d44593' 'OpaqueRef:03e5cebb-c885-4ed9-a7db-27a40bcbee6d')))
audit.log.21.gz:May 6 08:29:35 dhcld-az1c2-xcph01 xapi: [20250506T02:44:35.472Z|audit||161942232 HTTPS 10.140.1.13->:::80|VDI.destroy R:255cd87f0fa0|audit] ('trackid=97987b724e2503592f9e53fa56283e70' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:fe55984f-df0f-4a92-ab57-2f381f67c669; destroy ]' 'API' 'VDI.destroy' (('self' 'ROOT-12558' '4d7f2a7d-637e-446c-aa5f-57c867d7848a' 'OpaqueRef:fe55984f-df0f-4a92-ab57-2f381f67c669')))
audit.log.21.gz:May 6 08:29:37 dhcld-az1c2-xcph01 xapi: [20250506T02:44:37.013Z|audit||161942232 HTTPS 10.140.1.13->:::80|VDI.destroy R:199d8e772d88|audit] ('trackid=97987b724e2503592f9e53fa56283e70' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:aa7e8124-a669-4edc-b8b8-1610b395b7cd; destroy ]' 'API' 'VDI.destroy' (('self' 'ROOT-13929' 'a0b4f644-bc40-4b82-9f2a-dafcaf6db0ae' 'OpaqueRef:aa7e8124-a669-4edc-b8b8-1610b395b7cd')))
audit.log.22.gz:May 5 03:09:35 dhcld-az1c2-xcph01 xapi: [20250504T21:24:35.174Z|audit||160564583 HTTPS 10.140.1.13->:::80|VDI.destroy R:65fc8bb68a80|audit] ('trackid=97987b724e2503592f9e53fa56283e70' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:fe55984f-df0f-4a92-ab57-2f381f67c669; destroy ]' 'API' 'VDI.destroy' (('self' 'ROOT-12558' '4d7f2a7d-637e-446c-aa5f-57c867d7848a' 'OpaqueRef:fe55984f-df0f-4a92-ab57-2f381f67c669')))
audit.log.22.gz:May 5 03:11:03 dhcld-az1c2-xcph01 xapi: [20250504T21:26:03.933Z|audit||160563263 HTTPS 10.140.1.13->:::80|VDI.destroy R:fd0f8f53098c|audit] ('trackid=97987b724e2503592f9e53fa56283e70' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:aa7e8124-a669-4edc-b8b8-1610b395b7cd; destroy ]' 'API' 'VDI.destroy' (('self' 'ROOT-13929' 'a0b4f644-bc40-4b82-9f2a-dafcaf6db0ae' 'OpaqueRef:aa7e8124-a669-4edc-b8b8-1610b395b7cd')))
audit.log.22.gz:May 5 08:28:34 dhcld-az1c2-xcph01 xapi: [20250505T02:43:34.876Z|audit||160860444 HTTPS 10.140.1.13->:::80|VDI.destroy R:30670e4510f9|audit] ('trackid=97987b724e2503592f9e53fa56283e70' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:03e5cebb-c885-4ed9-a7db-27a40bcbee6d; destroy ]' 'API' 'VDI.destroy' (('self' 'ROOT-546' 'e9253423-48eb-471d-be43-4e0f46d44593' 'OpaqueRef:03e5cebb-c885-4ed9-a7db-27a40bcbee6d')))
audit.log.23.gz:May 4 03:06:51 dhcld-az1c2-xcph01 xapi: [20250503T21:21:51.086Z|audit||159461773 HTTPS 10.140.1.13->:::80|VDI.destroy R:8635b9746d86|audit] ('trackid=97987b724e2503592f9e53fa56283e70' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:03e5cebb-c885-4ed9-a7db-27a40bcbee6d; destroy ]' 'API' 'VDI.destroy' (('self' 'ROOT-546' 'e9253423-48eb-471d-be43-4e0f46d44593' 'OpaqueRef:03e5cebb-c885-4ed9-a7db-27a40bcbee6d')))
audit.log.24.gz:May 3 08:22:33 dhcld-az1c2-xcph01 xapi: [20250503T02:37:33.333Z|audit||158426524 HTTPS 10.140.1.13->:::80|VDI.destroy R:f9fe7325b148|audit] ('trackid=97987b724e2503592f9e53fa56283e70' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:fe55984f-df0f-4a92-ab57-2f381f67c669; destroy ]' 'API' 'VDI.destroy' (('self' 'ROOT-12558' '4d7f2a7d-637e-446c-aa5f-57c867d7848a' 'OpaqueRef:fe55984f-df0f-4a92-ab57-2f381f67c669')))
audit.log.24.gz:May 3 08:22:33 dhcld-az1c2-xcph01 xapi: [20250503T02:37:33.868Z|audit||158426524 HTTPS 10.140.1.13->:::80|VDI.destroy R:1435c2526105|audit] ('trackid=97987b724e2503592f9e53fa56283e70' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:aa7e8124-a669-4edc-b8b8-1610b395b7cd; destroy ]' 'API' 'VDI.destroy' (('self' 'ROOT-13929' 'a0b4f644-bc40-4b82-9f2a-dafcaf6db0ae' 'OpaqueRef:aa7e8124-a669-4edc-b8b8-1610b395b7cd')))
audit.log.25.gz:May 2 02:56:24 dhcld-az1c2-xcph01 xapi: [20250501T21:11:24.585Z|audit||157143860 HTTPS 10.140.1.13->:::80|VDI.destroy R:3ad28780ac17|audit] ('trackid=97987b724e2503592f9e53fa56283e70' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:fe55984f-df0f-4a92-ab57-2f381f67c669; destroy ]' 'API' 'VDI.destroy' (('self' 'ROOT-12558' '4d7f2a7d-637e-446c-aa5f-57c867d7848a' 'OpaqueRef:fe55984f-df0f-4a92-ab57-2f381f67c669')))
audit.log.25.gz:May 2 02:56:26 dhcld-az1c2-xcph01 xapi: [20250501T21:11:26.278Z|audit||157144199 HTTPS 10.140.1.13->:::80|VDI.destroy R:c5f4702db7ee|audit] ('trackid=97987b724e2503592f9e53fa56283e70' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:aa7e8124-a669-4edc-b8b8-1610b395b7cd; destroy ]' 'API' 'VDI.destroy' (('self' 'ROOT-13929' 'a0b4f644-bc40-4b82-9f2a-dafcaf6db0ae' 'OpaqueRef:aa7e8124-a669-4edc-b8b8-1610b395b7cd')))
audit.log.25.gz:May 2 08:22:08 dhcld-az1c2-xcph01 xapi: [20250502T02:37:08.761Z|audit||157419056 HTTPS 10.140.1.13->:::80|VDI.destroy R:c7263909a120|audit] ('trackid=97987b724e2503592f9e53fa56283e70' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:03e5cebb-c885-4ed9-a7db-27a40bcbee6d; destroy ]' 'API' 'VDI.destroy' (('self' 'ROOT-546' 'e9253423-48eb-471d-be43-4e0f46d44593' 'OpaqueRef:03e5cebb-c885-4ed9-a7db-27a40bcbee6d')))
audit.log.26.gz:May 1 02:55:21 dhcld-az1c2-xcph01 xapi: [20250430T21:10:21.961Z|audit||156009733 HTTPS 10.140.1.13->:::80|VDI.destroy R:9aad9c650aaa|audit] ('trackid=97987b724e2503592f9e53fa56283e70' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:03e5cebb-c885-4ed9-a7db-27a40bcbee6d; destroy ]' 'API' 'VDI.destroy' (('self' 'ROOT-546' 'e9253423-48eb-471d-be43-4e0f46d44593' 'OpaqueRef:03e5cebb-c885-4ed9-a7db-27a40bcbee6d')))
audit.log.27.gz:Apr 30 04:09:28 dhcld-az1c2-xcph01 xapi: [20250429T22:24:28.646Z|audit||155045761 HTTPS 10.140.1.13->:::80|PBD.unplug R:29240295210e|audit] ('trackid=97987b724e2503592f9e53fa56283e70' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:045ef65c-21ba-4585-a77d-04d0f7c625a9 ]' 'API' 'PBD.unplug' (('self' '' '4c7f7088-e4eb-e5a8-37eb-ae036ed23ca6' 'OpaqueRef:07915105-f550-44c2-a5cd-180f35abf2df')))
audit.log.27.gz:Apr 30 08:17:36 dhcld-az1c2-xcph01 xapi: [20250430T02:32:36.085Z|audit||155244253 HTTPS 10.140.1.13->:::80|VDI.destroy R:8993a3f4d785|audit] ('trackid=97987b724e2503592f9e53fa56283e70' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:fe55984f-df0f-4a92-ab57-2f381f67c669; destroy ]' 'API' 'VDI.destroy' (('self' 'ROOT-12558' '4d7f2a7d-637e-446c-aa5f-57c867d7848a' 'OpaqueRef:fe55984f-df0f-4a92-ab57-2f381f67c669')))
audit.log.27.gz:Apr 30 08:17:36 dhcld-az1c2-xcph01 xapi: [20250430T02:32:36.606Z|audit||155244253 HTTPS 10.140.1.13->:::80|VDI.destroy R:a2f3efc6948b|audit] ('trackid=97987b724e2503592f9e53fa56283e70' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:aa7e8124-a669-4edc-b8b8-1610b395b7cd; destroy ]' 'API' 'VDI.destroy' (('self' 'ROOT-13929' 'a0b4f644-bc40-4b82-9f2a-dafcaf6db0ae' 'OpaqueRef:aa7e8124-a669-4edc-b8b8-1610b395b7cd')))
audit.log.28.gz:Apr 29 21:21:23 dhcld-az1c2-xcph01 xapi: [20250429T15:36:23.280Z|audit||154890870 HTTPS 10.140.1.13->:::80|VDI.destroy R:c25e767d1caa|audit] ('trackid=df9ce6acc14f7f0b0676e3b76cf2190f' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:03e5cebb-c885-4ed9-a7db-27a40bcbee6d; destroy ]' 'API' 'VDI.destroy' (('self' 'ROOT-546' 'e9253423-48eb-471d-be43-4e0f46d44593' 'OpaqueRef:03e5cebb-c885-4ed9-a7db-27a40bcbee6d')))
audit.log.29.gz:Apr 28 21:21:04 dhcld-az1c2-xcph01 xapi: [20250428T15:36:04.756Z|audit||154129107 HTTPS 10.140.1.13->:::80|VDI.destroy R:0395ad56f4e7|audit] ('trackid=df9ce6acc14f7f0b0676e3b76cf2190f' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:fe55984f-df0f-4a92-ab57-2f381f67c669; destroy ]' 'API' 'VDI.destroy' (('self' 'ROOT-12558' '4d7f2a7d-637e-446c-aa5f-57c867d7848a' 'OpaqueRef:fe55984f-df0f-4a92-ab57-2f381f67c669')))
audit.log.29.gz:Apr 28 21:21:05 dhcld-az1c2-xcph01 xapi: [20250428T15:36:05.547Z|audit||154128610 HTTPS 10.140.1.13->:::80|VDI.destroy R:2e5cb6cb1403|audit] ('trackid=df9ce6acc14f7f0b0676e3b76cf2190f' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:aa7e8124-a669-4edc-b8b8-1610b395b7cd; destroy ]' 'API' 'VDI.destroy' (('self' 'ROOT-13929' 'a0b4f644-bc40-4b82-9f2a-dafcaf6db0ae' 'OpaqueRef:aa7e8124-a669-4edc-b8b8-1610b395b7cd')))
audit.log.30.gz:Apr 27 16:34:03 dhcld-az1c2-xcph01 xapi: [20250427T10:49:03.043Z|audit||152920024 HTTPS 10.140.1.13->:::80|VDI.destroy R:5c0eff189d9c|audit] ('trackid=df9ce6acc14f7f0b0676e3b76cf2190f' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:fe55984f-df0f-4a92-ab57-2f381f67c669; destroy ]' 'API' 'VDI.destroy' (('self' 'ROOT-12558' '4d7f2a7d-637e-446c-aa5f-57c867d7848a' 'OpaqueRef:fe55984f-df0f-4a92-ab57-2f381f67c669')))
audit.log.30.gz:Apr 27 16:34:03 dhcld-az1c2-xcph01 xapi: [20250427T10:49:03.716Z|audit||152920024 HTTPS 10.140.1.13->:::80|VDI.destroy R:f9291c244a70|audit] ('trackid=df9ce6acc14f7f0b0676e3b76cf2190f' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:aa7e8124-a669-4edc-b8b8-1610b395b7cd; destroy ]' 'API' 'VDI.destroy' (('self' 'ROOT-13929' 'a0b4f644-bc40-4b82-9f2a-dafcaf6db0ae' 'OpaqueRef:aa7e8124-a669-4edc-b8b8-1610b395b7cd')))
audit.log.30.gz:Apr 27 21:20:56 dhcld-az1c2-xcph01 xapi: [20250427T15:35:56.111Z|audit||153181017 HTTPS 10.140.1.13->:::80|VDI.destroy R:a62a03bc1d02|audit] ('trackid=df9ce6acc14f7f0b0676e3b76cf2190f' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:03e5cebb-c885-4ed9-a7db-27a40bcbee6d; destroy ]' 'API' 'VDI.destroy' (('self' 'ROOT-546' 'e9253423-48eb-471d-be43-4e0f46d44593' 'OpaqueRef:03e5cebb-c885-4ed9-a7db-27a40bcbee6d')))
audit.log.31.gz:Apr 26 16:33:58 dhcld-az1c2-xcph01 xapi: [20250426T10:48:58.934Z|audit||151893808 HTTPS 10.140.1.13->:::80|VDI.destroy R:652d39d543ff|audit] ('trackid=df9ce6acc14f7f0b0676e3b76cf2190f' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:03e5cebb-c885-4ed9-a7db-27a40bcbee6d; destroy ]' 'API' 'VDI.destroy' (('self' 'ROOT-546' 'e9253423-48eb-471d-be43-4e0f46d44593' 'OpaqueRef:03e5cebb-c885-4ed9-a7db-27a40bcbee6d')))
audit.log.4.gz:May 23 06:42:30 dhcld-az1c2-xcph01 xapi: [20250523T00:57:30.803Z|audit||183377960 HTTPS 10.140.1.13->:::80|VDI.destroy R:c6aa3abd9b93|audit] ('trackid=47508e295ef7610e1fc86ae9a02090b2' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:03e5cebb-c885-4ed9-a7db-27a40bcbee6d; destroy ]' 'API' 'VDI.destroy' (('self' 'ROOT-546' 'e9253423-48eb-471d-be43-4e0f46d44593' 'OpaqueRef:03e5cebb-c885-4ed9-a7db-27a40bcbee6d')))
audit.log.4.gz:May 23 06:42:31 dhcld-az1c2-xcph01 xapi: [20250523T00:57:31.016Z|audit||183377960 HTTPS 10.140.1.13->:::80|VDI.destroy R:e120d470ba85|audit] ('trackid=47508e295ef7610e1fc86ae9a02090b2' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:fcb01b3f-98a5-4d13-a1ac-fd5337fe2ec0; destroy ]' 'API' 'VDI.destroy' (('self' 'ROOT-12776' '6b03ea00-657b-4567-8063-5b8370e6bfda' 'OpaqueRef:fcb01b3f-98a5-4d13-a1ac-fd5337fe2ec0')))
audit.log.4.gz:May 23 06:42:38 dhcld-az1c2-xcph01 xapi: [20250523T00:57:38.709Z|audit||183377960 HTTPS 10.140.1.13->:::80|VDI.destroy R:69b0cf47ef38|audit] ('trackid=47508e295ef7610e1fc86ae9a02090b2' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:aa7e8124-a669-4edc-b8b8-1610b395b7cd; destroy ]' 'API' 'VDI.destroy' (('self' 'ROOT-13929' 'a0b4f644-bc40-4b82-9f2a-dafcaf6db0ae' 'OpaqueRef:aa7e8124-a669-4edc-b8b8-1610b395b7cd')))
audit.log.6.gz:May 21 10:29:39 dhcld-az1c2-xcph01 xapi: [20250521T04:44:39.189Z|audit||180497143 HTTPS 10.140.1.13->:::80|VDI.destroy R:2fb0e2bce8d0|audit] ('trackid=47508e295ef7610e1fc86ae9a02090b2' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:03e5cebb-c885-4ed9-a7db-27a40bcbee6d; destroy ]' 'API' 'VDI.destroy' (('self' 'ROOT-546' 'e9253423-48eb-471d-be43-4e0f46d44593' 'OpaqueRef:03e5cebb-c885-4ed9-a7db-27a40bcbee6d')))
audit.log.6.gz:May 21 10:29:39 dhcld-az1c2-xcph01 xapi: [20250521T04:44:39.340Z|audit||180497426 HTTPS 10.140.1.14->:::80|VDI.destroy R:9f65588044a9|audit] ('trackid=06d825aa7c866bb0a62b0e94b44b1abc' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:fcb01b3f-98a5-4d13-a1ac-fd5337fe2ec0; destroy ]' 'API' 'VDI.destroy' (('self' 'ROOT-12776' '6b03ea00-657b-4567-8063-5b8370e6bfda' 'OpaqueRef:fcb01b3f-98a5-4d13-a1ac-fd5337fe2ec0')))
audit.log.6.gz:May 21 10:29:40 dhcld-az1c2-xcph01 xapi: [20250521T04:44:40.041Z|audit||180497143 HTTPS 10.140.1.13->:::80|VDI.destroy R:0a3934d65ad7|audit] ('trackid=47508e295ef7610e1fc86ae9a02090b2' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:aa7e8124-a669-4edc-b8b8-1610b395b7cd; destroy ]' 'API' 'VDI.destroy' (('self' 'ROOT-13929' 'a0b4f644-bc40-4b82-9f2a-dafcaf6db0ae' 'OpaqueRef:aa7e8124-a669-4edc-b8b8-1610b395b7cd')))
audit.log.7.gz:May 20 06:39:12 dhcld-az1c2-xcph01 xapi: [20250520T00:54:12.925Z|audit||178683230 HTTPS 10.140.1.13->:::80|VDI.destroy R:c81eccd0efa4|audit] ('trackid=47508e295ef7610e1fc86ae9a02090b2' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:03e5cebb-c885-4ed9-a7db-27a40bcbee6d; destroy ]' 'API' 'VDI.destroy' (('self' 'ROOT-546' 'e9253423-48eb-471d-be43-4e0f46d44593' 'OpaqueRef:03e5cebb-c885-4ed9-a7db-27a40bcbee6d')))
audit.log.7.gz:May 20 06:42:18 dhcld-az1c2-xcph01 xapi: [20250520T00:57:18.107Z|audit||178683230 HTTPS 10.140.1.13->:::80|VDI.destroy R:70523a4fd400|audit] ('trackid=47508e295ef7610e1fc86ae9a02090b2' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:fcb01b3f-98a5-4d13-a1ac-fd5337fe2ec0; destroy ]' 'API' 'VDI.destroy' (('self' 'ROOT-12776' '6b03ea00-657b-4567-8063-5b8370e6bfda' 'OpaqueRef:fcb01b3f-98a5-4d13-a1ac-fd5337fe2ec0')))
audit.log.7.gz:May 20 06:42:19 dhcld-az1c2-xcph01 xapi: [20250520T00:57:19.883Z|audit||178683230 HTTPS 10.140.1.13->:::80|VDI.destroy R:ef1a9d18f7d6|audit] ('trackid=47508e295ef7610e1fc86ae9a02090b2' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:aa7e8124-a669-4edc-b8b8-1610b395b7cd; destroy ]' 'API' 'VDI.destroy' (('self' 'ROOT-13929' 'a0b4f644-bc40-4b82-9f2a-dafcaf6db0ae' 'OpaqueRef:aa7e8124-a669-4edc-b8b8-1610b395b7cd')))
audit.log.9.gz:May 18 10:27:38 dhcld-az1c2-xcph01 xapi: [20250518T04:42:38.470Z|audit||176458354 HTTPS 10.140.1.13->:::80|VDI.destroy R:77a8124b094c|audit] ('trackid=47508e295ef7610e1fc86ae9a02090b2' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:03e5cebb-c885-4ed9-a7db-27a40bcbee6d; destroy ]' 'API' 'VDI.destroy' (('self' 'ROOT-546' 'e9253423-48eb-471d-be43-4e0f46d44593' 'OpaqueRef:03e5cebb-c885-4ed9-a7db-27a40bcbee6d')))
audit.log.9.gz:May 18 10:27:38 dhcld-az1c2-xcph01 xapi: [20250518T04:42:38.640Z|audit||176458354 HTTPS 10.140.1.13->:::80|VDI.destroy R:806c3f2c35d8|audit] ('trackid=47508e295ef7610e1fc86ae9a02090b2' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:fe55984f-df0f-4a92-ab57-2f381f67c669; destroy ]' 'API' 'VDI.destroy' (('self' 'ROOT-12558' '4d7f2a7d-637e-446c-aa5f-57c867d7848a' 'OpaqueRef:fe55984f-df0f-4a92-ab57-2f381f67c669')))
audit.log.9.gz:May 18 10:27:39 dhcld-az1c2-xcph01 xapi: [20250518T04:42:39.368Z|audit||176458354 HTTPS 10.140.1.13->:::80|VDI.destroy R:48cc4107d547|audit] ('trackid=47508e295ef7610e1fc86ae9a02090b2' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:aa7e8124-a669-4edc-b8b8-1610b395b7cd; destroy ]' 'API' 'VDI.destroy' (('self' 'ROOT-13929' 'a0b4f644-bc40-4b82-9f2a-dafcaf6db0ae' 'OpaqueRef:aa7e8124-a669-4edc-b8b8-1610b395b7cd')))
GitHub link: https://github.com/apache/cloudstack/discussions/10911#discussioncomment-13281719
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] Unexpected Deletion of Valid Disks by CloudStack + XCP-ng 8.2.1 [cloudstack]
Posted by "weizhouapache (via GitHub)" <gi...@apache.org>.
GitHub user weizhouapache added a comment to the discussion: Unexpected Deletion of Valid Disks by CloudStack + XCP-ng 8.2.1
@midhunpjos
what's the ACS version ?
Can you search the volume in db by id=2164 ?
is it Destroy or Ready state ?
GitHub link: https://github.com/apache/cloudstack/discussions/10911#discussioncomment-13243586
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] Unexpected Deletion of Valid Disks by CloudStack + XCP-ng 8.2.1 [cloudstack]
Posted by "midhunpjos (via GitHub)" <gi...@apache.org>.
GitHub user midhunpjos added a comment to the discussion: Unexpected Deletion of Valid Disks by CloudStack + XCP-ng 8.2.1
:( There is no relevant info from logs pointing to ROOT-12558
Yes instance was powered off 4 hours before
GitHub link: https://github.com/apache/cloudstack/discussions/10911#discussioncomment-13245308
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] Unexpected Deletion of Valid Disks by CloudStack + XCP-ng 8.2.1 [cloudstack]
Posted by "weizhouapache (via GitHub)" <gi...@apache.org>.
GitHub user weizhouapache added a comment to the discussion: Unexpected Deletion of Valid Disks by CloudStack + XCP-ng 8.2.1
IMHO, the message of ROOT-12558 is not relevant to the deletion of ROOT-546
maybe check if there are some operations on the vm or volume, for example, vm is stopped ?
GitHub link: https://github.com/apache/cloudstack/discussions/10911#discussioncomment-13244891
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] Unexpected Deletion of Valid Disks by CloudStack + XCP-ng 8.2.1 [cloudstack]
Posted by "midhunpjos (via GitHub)" <gi...@apache.org>.
GitHub user midhunpjos closed a discussion: Unexpected Deletion of Valid Disks by CloudStack + XCP-ng 8.2.1
We recently encountered an unusual issue with CloudStack, where some valid disks assigned to stopped instances were unexpectedly deleted.
Upon investigation, logs from the XCP-ng Center indicated that the delete requests for the VDIs originated from CloudStack. Interestingly, this coincided with the execution of a volume cleanup thread within CloudStack.
However, during this cleanup process, CloudStack also issued a delete command for a disk that was actually in a "Ready" state. we could not find any corresponding delete request for that valid disk in the CloudStack management server logs.
This raises concerns about a potential issue in the volume cleanup logic or logging mechanisms within CloudStack.
Has anyone else experienced a similar scenario, or is aware of what might cause such behavior?
audit logs from xen getting requests from cloudstack
`May 20 06:39:12 dhcld-az1c2-xcph01 xapi: [20250520T00:54:12.925Z|audit||178683230 HTTPS 10.140.1.13->:::80|VDI.destroy R:c81eccd0efa4|audit] ('trackid=47508e295ef7610e1fc86ae9a02090b2' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:03e5cebb-c885-4ed9-a7db-27a40bcbee6d; destroy ]' 'API' 'VDI.destroy' (('self' 'ROOT-546' 'e9253423-48eb-471d-be43-4e0f46d44593' 'OpaqueRef:03e5cebb-c885-4ed9-a7db-27a40bcbee6d')))
May 20 06:42:18 dhcld-az1c2-xcph01 xapi: [20250520T00:57:18.072Z|audit||178683230 HTTPS 10.140.1.13->:::80|VDI.destroy R:a5223d94b8f5|audit] ('trackid=47508e295ef7610e1fc86ae9a02090b2' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'OK' 'API' 'VDI.destroy' (('self' 'ROOT-12558' '4d7f2a7d-637e-446c-aa5f-57c867d7848a' 'OpaqueRef:fe55984f-df0f-4a92-ab57-2f381f67c669')))
May 20 06:42:18 dhcld-az1c2-xcph01 xapi: [20250520T00:57:18.107Z|audit||178683230 HTTPS 10.140.1.13->:::80|VDI.destroy R:70523a4fd400|audit] ('trackid=47508e295ef7610e1fc86ae9a02090b2' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:fcb01b3f-98a5-4d13-a1ac-fd5337fe2ec0; destroy ]' 'API' 'VDI.destroy' (('self' 'ROOT-12776' '6b03ea00-657b-4567-8063-5b8370e6bfda' 'OpaqueRef:fcb01b3f-98a5-4d13-a1ac-fd5337fe2ec0')))
May 20 06:42:19 dhcld-az1c2-xcph01 xapi: [20250520T00:57:19.883Z|audit||178683230 HTTPS 10.140.1.13->:::80|VDI.destroy R:ef1a9d18f7d6|audit] ('trackid=47508e295ef7610e1fc86ae9a02090b2' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'ERROR:VDI_IN_USE: [ OpaqueRef:aa7e8124-a669-4edc-b8b8-1610b395b7cd; destroy ]' 'API' 'VDI.destroy' (('self' 'ROOT-13929' 'a0b4f644-bc40-4b82-9f2a-dafcaf6db0ae' 'OpaqueRef:aa7e8124-a669-4edc-b8b8-1610b395b7cd')))
May 20 11:41:28 dhcld-az1c2-xcph01 xapi: [20250520T05:56:28.476Z|audit||178964351 HTTPS 10.140.1.13->:::80|VDI.destroy R:92b87bb5e694|audit] ('trackid=47508e295ef7610e1fc86ae9a02090b2' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'OK' 'API' 'VDI.destroy' (('self' 'ROOT-14400' 'e3bad622-578e-4d29-924e-47b66a6439d6' 'OpaqueRef:e8db1761-e15d-45c3-891e-d7766a867cee')))
May 20 12:05:42 dhcld-az1c2-xcph01 xapi: [20250520T06:20:42.998Z|audit||178983321 HTTPS 10.140.1.13->:::80|VDI.destroy R:ef9634e5414d|audit] ('trackid=47508e295ef7610e1fc86ae9a02090b2' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'OK' 'API' 'VDI.destroy' (('self' 'ROOT-12820' '0f707aa3-d858-4231-b6dc-e92dfe910ba3' 'OpaqueRef:00b6bd67-21a5-43d9-ab86-2442ad13516f')`
Cleanup log reference at the time of incident:
`2025-05-20 06:39:12,873 DEBUG [c.c.a.t.Request] (StorageManager-Scavenger-1:ctx-6ed39762) (logid:69e084ff) Seq 32-4469822630165282172: Sending { Cmd , MgmtId: 108462341209969, via: 32(DHCLD-AZ1C2-XCPH04), Ver: v1, Flags: 100011, [{"org.apache.cloudstack.storage.command.DeleteCommand":{"data":{"org.apache.cloudstack.storage.to.VolumeObjectTO":{"uuid":"649ab11c-ff50-4a81-8e8b-7fe1110a8608","volumeType":"ROOT","dataStore":{"org.apache.cloudstack.storage.to.PrimaryDataStoreTO":{"uuid":"PUREC-DHCLD-AZ1C2-VOL1","name":"PUREC-DHCLD-AZ1C2-VOL1","id":"5","poolType":"PreSetup","host":"localhost","path":"/PUREC-DHCLD-AZ1C2-VOL1","port":"0","url":"PreSetup://localhost/PUREC-DHCLD-AZ1C2-VOL1/?ROLE=Primary&STOREUUID=PUREC-DHCLD-AZ1C2-VOL1","isManaged":"false"}},"name":"ROOT-546","size":"(4.89 GB) 5253365760","path":"e9253423-48eb-471d-be43-4e0f46d44593","volumeId":"2164","accountId":"74","format":"VHD","provisioningType":"THIN","poolId":"5","id":"2164","deviceId":"0","hypervisorType":"XenServer"
,"directDownload":"false","deployAsIs":"false","followRedirects":"true"}},"wait":"0","bypassHostMaintenance":"false"}}] }
2025-05-20 06:39:12,875 DEBUG [c.c.a.t.Request] (StorageManager-Scavenger-1:ctx-6ed39762) (logid:69e084ff) Seq 32-4469822630165282172: Executing: { Cmd , MgmtId: 108462341209969, via: 32(DHCLD-AZ1C2-XCPH04), Ver: v1, Flags: 100011, [{"org.apache.cloudstack.storage.command.DeleteCommand":{"data":{"org.apache.cloudstack.storage.to.VolumeObjectTO":{"uuid":"649ab11c-ff50-4a81-8e8b-7fe1110a8608","volumeType":"ROOT","dataStore":{"org.apache.cloudstack.storage.to.PrimaryDataStoreTO":{"uuid":"PUREC-DHCLD-AZ1C2-VOL1","name":"PUREC-DHCLD-AZ1C2-VOL1","id":"5","poolType":"PreSetup","host":"localhost","path":"/PUREC-DHCLD-AZ1C2-VOL1","port":"0","url":"PreSetup://localhost/PUREC-DHCLD-AZ1C2-VOL1/?ROLE=Primary&STOREUUID=PUREC-DHCLD-AZ1C2-VOL1","isManaged":"false"}},"name":"ROOT-546","size":"(4.89 GB) 5253365760","path":"e9253423-48eb-471d-be43-4e0f46d44593","volumeId":"2164","accountId":"74","format":"VHD","provisioningType":"THIN","poolId":"5","id":"2164","deviceId":"0","hypervisorType":"XenServe
r","directDownload":"false","deployAsIs":"false","followRedirects":"true"}},"wait":"0","bypassHostMaintenance":"false"}}] }`
GitHub link: https://github.com/apache/cloudstack/discussions/10911
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] Unexpected Deletion of Valid Disks by CloudStack + XCP-ng 8.2.1 [cloudstack]
Posted by "midhunpjos (via GitHub)" <gi...@apache.org>.
GitHub user midhunpjos added a comment to the discussion: Unexpected Deletion of Valid Disks by CloudStack + XCP-ng 8.2.1
@weizhouapache
ACS Version: 4.19.1.3
Reading the volume cleanup id=2164 belonged to a virtual router which was in deleted state in ACS but in xen the instance was in suspended state.
Issue is for the volume ROOT-12558, in xen logs a call to destroy the Volume was triggered but in cloudstack logs no relevant logs to cleanup the volume was there. The Volume ROOT-12558 is still in ready state in ACS
XEN logs on VDI delete:
May 20 06:42:18 dhcld-az1c2-xcph01 xapi: [20250520T00:57:18.072Z|audit||178683230 HTTPS 10.140.1.13->:::80|VDI.destroy R:a5223d94b8f5|audit] ('trackid=47508e295ef7610e1fc86ae9a02090b2' 'LOCAL_SUPERUSER' 'root' 'ALLOWED' 'OK' 'API' 'VDI.destroy' (('self' 'ROOT-12558' '4d7f2a7d-637e-446c-aa5f-57c867d7848a' 'OpaqueRef:fe55984f-df0f-4a92-ab57-2f381f67c669'))) May 20 06:42:18 dhcld-az1c2-xcph01 xapi: [20250520T00:57:18.107Z|audit||178683230
GitHub link: https://github.com/apache/cloudstack/discussions/10911#discussioncomment-13243821
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] Unexpected Deletion of Valid Disks by CloudStack + XCP-ng 8.2.1 [cloudstack]
Posted by "midhunpjos (via GitHub)" <gi...@apache.org>.
GitHub user midhunpjos added a comment to the discussion: Unexpected Deletion of Valid Disks by CloudStack + XCP-ng 8.2.1
are there multiple volumes with same name ROOT-12558 ?
I have reviewed the database and found only a single volume with the name ROOT-12558.
The Xen logs indicate that two or three additional VDI delete calls were triggered around the same time. These delete actions failed because the corresponding disks were attached to running VMs.
GitHub link: https://github.com/apache/cloudstack/discussions/10911#discussioncomment-13244309
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org