Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have an odd 'issue'.

And I feel a little dumb asking.

Just after Christmas, 2013, I added a cronjob on one of my EC2 instances to snapshot all of my EBS volumes that had a tag where backup=true, set to delete after 30 days.

I did this using the aws-missing-tool script like so

ec2-automate-backup.sh -s tag -t "backup=true" -k 31

The snapshots are still being made: so far so good. But I need to make a change to that script.

And I can't find the host they're running on ...

I did shell into the one that I think should be running it: it's not there, nor is it in the crontab.

I've spot-checked other likely ec2 instances in that VPC: no dice.

Now, I can shell into (or make ansible do it for me) a job to find that backup script. But ...

  1. Is there a 'way' for EC2 to tell me which host the request for a snapshot is coming from?

  2. Is it possible that ec2 is just now making the snapshots for me? I don't think so but it's late and man, when you're this tired anything seems possible.

Thanks.

share|improve this question

1 Answer 1

up vote 2 down vote accepted

Is there a 'way' for EC2 to tell me which host the request for a snapshot is coming from?

There sure is. You'll be leveraging a relatively new AWS product that was just released at re:Invent in November 2013.

Enable CloudTrail for the region you're operating in. CloudTrail is essentially an audit log of each and every API call made against your account, so this will include the snapshot calls.

After doing this, you'll need to wait a day or so for logging to start showing up. Once it does, gzipped json blobs will start showing up in the S3 bucket you chose when enabling CloudTrail. Inside each json blob is a Records:sourceIPAddress value that contains the IP address that the API call came from.

If you're not making many API calls to AWS, it shouldn't be difficult for you to find the snapshot call. If you are making a lot of calls, though, you'll want to come up with some automated way to search through the json to find the call you're interested in.

Is it possible that ec2 is just now making the snapshots for me?

Nope.

If, after trying the above, you still can't locate the script, you can revoke the credentials the script is using and start over with new credentials. You are using an IAM user for this, right? Not your AWS root account credentials? OK good, I thought so. Only a fool would use their root account credentials for anything.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.