0

We have a GCE (europe-west-2b) server sending logs into Papertrail that can only come from our custom binaries and has been doing so for over twelve hours. BUT it is not listed in the developer console or from an API call. It is an instance that must have been started by an autoscaling group.

It is also inaccessible from the internet (which it would not be if configured correctly).

Anybody got any ideas how to address this without paying for support?

3
  • You should be able to see any spanned GCE server in your Cloud console. They will also be listed by using “gcloud compute instances list”. It does not matter if they are being created by autoscaler. Is it possible the VM is living in another project? To be sure that Cloud SDK is configured with the right project use “gcloud config list”. – Carlos Feb 2 '18 at 21:48
  • Thanks Carlos. No definitely not there. We only run two projects. Still sending app specific logs now on 5th Feb. IP is 35.197.250.193 , only port open is 443 which is not how it would be if our application and 35.197.250.193 shows a page that is definitely not ours. We use Azure and AWS too, but whois shows it as a google cloud range. – Mike Selby Feb 5 '18 at 10:41
  • Apologies, I have figured it out. At some stage since it started up the public ip address changed. For reasons I don't understand the daemon we run for service discovery (including setting the public ip address in things like syslog formats) couldn't bind itself to a port - I guess something to do with the VM migration. So logs were not really coming from 35.197.250.193 despite papertrail thinking they were. – Mike Selby Feb 5 '18 at 11:02
1

Apologies, I have figured it out. At some stage since it started up the public ip address changed. For reasons I don't understand the daemon we run for service discovery (including setting the public ip address in things like syslog formats) couldn't bind itself to a port - I guess something to do with the VM migration. So logs were not really coming from 35.197.250.193 despite papertrail thinking they were. I will build some error checking in and terminate the rogue instance in future.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.