Una máquina virtual mía, que ejecutaba RHEL8 en Azure, estuvo inactiva durante un par de minutos. Resulta que se reinició. La telemetría y los registros no muestran ningún problema. No hubo actualizaciones de dnf ni una ventana de actualización programada.Estado del servicio de Azureno tiene nada que decir. Nada en eldocumentos oficiales de solución de problemasaplica. Entonces, ¿por qué se reinició la máquina virtual?
No estoy 100 % seguro de la secuencia de eventos, pero los únicos indicios apuntan hacia un reinicio iniciado por Azure. El registro de actividad en Azure Portal informa un "evento de salud", que es el reinicio en sí, marcado como resuelto menos de 10 segundos después.
"submissionTimestamp": "2024-01-24T05:14:50.701Z",
"properties": {
"title": "Reboot initiated from inside the machine",
"details": "The Virtual Machine is undergoing a reboot as requested by a restart action triggered by an authorized user or process from within the Virtual Machine. No other action is required at this time.",
"currentHealthStatus": "Unavailable",
"previousHealthStatus": "Unavailable",
"type": "Downtime",
"cause": "UserInitiated"
},
La máquina virtual arrancó un par de segundos después de que el evento se marcara como resuelto:
[Wed Jan 24 05:15:01 2024] Linux version 4.18.0-513.11.1.el8_9.x86_64 ([email protected]) (gcc version 8.5.0 20210514 (Red Hat 8.5.0-20) (GCC)) #1 SMP Thu Dec 7 03:06:13 EST 2023
unos 20 segundosmás tarde, los registros muestran OMI/omsagent usando sudo:
Jan 24 07:15:19 <redacted> sudo[39861]: omsagent : TTY=unknown ; PWD=/opt/microsoft/omsconfig/Scripts/3.x ; USER=root ; COMMAND=/opt/microsoft/omsconfig/Scripts/OMSYumUpdates.sh
El registro de auditoría ( ausearch --format text -if /var/log/audit/audit.log) muestra una ráfaga de actividad de omsagent en el minuto anterior y posterior, con líneas como:
At 05:10:17 01/24/2024 system, acting as omsagent, successfully was-authorized omsagent using /usr/bin/sudo
At 05:10:17 01/24/2024 system, acting as omsagent, successfully ran-command /opt/microsoft/omsconfig/Scripts/OMSAuditdPlugin.sh get /var/opt/microsoft/omsagent/87230cd3-6635-446c-bfc0-00e4fd6f2a13/tmp using /usr/bin/sudo
At 05:14:25 01/24/2024 system, acting as root, successfully started-service omsagent-87230cd3-6635-446c-bfc0-00e4fd6f2a13 using /usr/lib/systemd/systemd
At 05:14:25 01/24/2024 system, acting as root, successfully stopped-service omsagent-87230cd3-6635-446c-bfc0-00e4fd6f2a13 using /usr/lib/systemd/systemd
At 05:15:13 01/24/2024 system, acting as root, successfully started-service omsagent-87230cd3-6635-446c-bfc0-00e4fd6f2a13 using /usr/lib/systemd/systemd
At 05:15:16 01/24/2024 system, acting as omsagent, successfully was-authorized omsagent using /usr/bin/sudo
At 05:15:16 01/24/2024 system, acting as omsagent, successfully ran-command /opt/microsoft/omsconfig/Scripts/OMSYumUpdates.sh using /usr/bin/sudo
At 05:10:17 01/24/2024 system, acting as omsagent, successfully was-authorized omsagent using /usr/bin/sudo
At 05:10:17 01/24/2024 system, acting as omsagent, successfully ran-command /opt/microsoft/omsconfig/Scripts/OMSAuditdPlugin.sh get /var/opt/microsoft/omsagent/87230cd3-6635-446c-bfc0-00e4fd6f2a13/tmp using /usr/bin/sudo
At 05:10:17 01/24/2024 system, acting as root, successfully changed-login-id-to root
At 05:10:17 01/24/2024 root successfully triggered-unknown-audit-rule using /usr/lib/systemd/systemd
At 05:10:17 01/24/2024 root successfully started-session ? using /usr/lib/systemd/systemd
At 05:10:17 01/24/2024 system, acting as root, successfully started-service user@0 using /usr/lib/systemd/systemd
At 05:14:24 01/24/2024 system, acting as root, successfully negotiated-crypto-key SHA256:<redacted> using /usr/sbin/sshd
At 05:14:24 01/24/2024 system, acting as root, successfully started-service libstoragemgmt using /usr/lib/systemd/systemd
At 05:14:24 01/24/2024 system, acting as root, successfully stopped-service libstoragemgmt using /usr/lib/systemd/systemd
At 05:14:24 01/24/2024 system, acting as root, successfully started-service waagent using /usr/lib/systemd/systemd
At 05:14:24 01/24/2024 system, acting as root, successfully stopped-service waagent using /usr/lib/systemd/systemd
At 05:14:24 01/24/2024 root successfully changed-auditd-configuration using signal
At 05:14:25 01/24/2024 unloaded-bpf-program 118
At 05:14:25 01/24/2024 system, acting as root, successfully started-service dracut-shutdown using /usr/lib/systemd/systemd
At 05:14:25 01/24/2024 system, acting as root, successfully stopped-service dracut-shutdown using /usr/lib/systemd/systemd
At 05:14:25 01/24/2024 unloaded-bpf-program 15
At 05:14:25 01/24/2024 system, acting as root, successfully started-service omsagent-87230cd3-6635-446c-bfc0-00e4fd6f2a13 using /usr/lib/systemd/systemd
At 05:14:25 01/24/2024 system, acting as root, successfully stopped-service omsagent-87230cd3-6635-446c-bfc0-00e4fd6f2a13 using /usr/lib/systemd/system
At 05:14:25 01/24/2024 system, acting as root, successfully started-service gcd using /usr/lib/systemd/systemd
At 05:14:25 01/24/2024 system, acting as root, successfully stopped-service gcd using /usr/lib/systemd/systemd
At 05:14:26 01/24/2024 system, acting as root, successfully started-service mdatp using /usr/lib/systemd/systemd
At 05:14:26 01/24/2024 system, acting as root, successfully stopped-service mdatp using /usr/lib/systemd/systemd