Openstack Instance Hacked, cant create snapshot

asked 2015-11-28 02:45:59 -0500

mickey gravatar image

Hi, Since some days some of our customer Instances got abused by foreign attackers. Now we want to Investigate those Instances, because they are unusable. The Problem is Openstack is unable to create a Snapshot of the attacked ones. Snapshots can be made from every other Instance except from these.

Is there any way to export that VM to another Machine?

The only message i become from Openstack "ERROR Cant create snapshot"

Ways i tried: Using the shell for creation of the snapshot: Provides the same unuseable output Error. Looking on the Nova Host itself to maybe export the whole VM, but thats just not that easy as i thought.

The only suspicious log i found: nova-api.log

    - -] [instance: a225c2b2-1128-4b75-ac10-fbab89bcb82a] Skipping quiescing instance: Quiescing is not supported in instance a225c2b2-1128-4b75-ac10-fbab89bcb82a: QEMU guest agent is not enabled
Traceback (most recent call last):

  File "/usr/lib/python2.7/dist-packages/oslo_messaging/rpc/server.py", line 142, in inner
    return func(*args, **kwargs)

  File "/usr/lib/python2.7/dist-packages/nova/exception.py", line 88, in wrapped
    payload)

  File "/usr/lib/python2.7/dist-packages/oslo_utils/excutils.py", line 85, in __exit__
    six.reraise(self.type_, self.value, self.tb)

  File "/usr/lib/python2.7/dist-packages/nova/exception.py", line 71, in wrapped
    return f(self, context, *args, **kw)

  File "/usr/lib/python2.7/dist-packages/nova/compute/manager.py", line 6572, in quiesce_instance
    self.driver.quiesce(context, instance, image_meta)

  File "/usr/lib/python2.7/dist-packages/nova/virt/libvirt/driver.py", line 1516, in quiesce
    self._set_quiesced(context, instance, image_meta, True)

  File "/usr/lib/python2.7/dist-packages/nova/virt/libvirt/driver.py", line 1495, in _set_quiesced
    instance_id=instance.uuid, reason=reason)

InstanceQuiesceNotSupported: Quiescing is not supported in instance a225c2b2-1128-4b75-ac10-fbab89bcb82a: QEMU guest agent is not enabled
.
2015-11-28 09:33:33.452 16889 ERROR nova.api.openstack [req-d8372817-e198-4a9d-a284-4e38f900563e 05e3e5396c5342fa99170e55cc5be356 6f4b82627df840bda7b937199f086f73 - - -] Caught error: Request Entity Too Large (HTTP 413) (Request-ID: req-a709eec8-d085-4daa-93bd-54334c402f8d)
2015-11-28 09:33:33.452 16889 TRACE nova.api.openstack Traceback (most recent call last):
2015-11-28 09:33:33.452 16889 TRACE nova.api.openstack   File "/usr/lib/python2.7/dist-packages/nova/api/openstack/__init__.py", line 125, in __call__
2015-11-28 09:33:33.452 16889 TRACE nova.api.openstack     return req.get_response(self.application)
2015-11-28 09:33:33.452 16889 TRACE nova.api.openstack   File "/usr/lib/python2.7/dist-packages/webob/request.py", line 1320, in send
2015-11-28 09:33:33.452 16889 TRACE nova.api.openstack     application, catch_exc_info=False)
2015-11-28 09:33:33.452 16889 TRACE nova.api.openstack   File "/usr/lib/python2.7/dist-packages/webob/request.py", line 1284, in call_application
2015-11-28 09:33:33.452 16889 TRACE nova.api.openstack     app_iter = application(self.environ, start_response)
2015-11-28 09:33:33.452 16889 TRACE nova.api.openstack   File "/usr/lib/python2.7/dist-packages/webob/dec.py", line 144, in __call__
2015-11-28 09:33:33.452 16889 TRACE nova.api.openstack     return resp(environ, start_response)
2015-11-28 09:33:33.452 16889 TRACE nova.api.openstack   File "/usr/lib/python2.7/dist-packages/keystonemiddleware/auth_token/__init__.py", line 634, in ...
(more)
edit retag flag offensive close merge delete