AWS FSx disconnection

Question

Hi - i am trying to trace down a recent occurrence where a FSx setup went offline for about 15 minutes or so.  There is nothing in the health Dashboard about known outages.  Currently there is no business support on the account this occurred so i cannot open a ticket on the issue without internal approval first which has not been given. yet.

The FSx setup is in a single AZ.  During the time of the outage, i noticed even CloudWatch was not recording metrics, so this doesn't appear to be a circumstance DNS updating and resulting in resolution issues for a few minutes, but of full network disconnect.

Looking through CloudTrail, i found this entry which to me reads as though a new ENI was automatically created and attached to the FSx.  The time stamp logged matches with the occurrence of the outage.  I've removed any identifying information.

```
{
    "eventVersion": "1.09",
    "userIdentity": {
        "type": "AssumedRole",
        "principalId": "----------------:FSx",
        "arn": "------------------/FSx",
        "accountId": "------------------",
        "sessionContext": {
            "sessionIssuer": {
                "type": "Role",
                "principalId": "------------------",
                "arn": "------------------/AWSServiceRoleForAmazonFSx",
                "accountId": "------------------",
                "userName": "------------------"
            },
            "attributes": {
                "creationDate": "2024-07-25T16:41:44Z",
                "mfaAuthenticated": "false"
            }
        },
        "invokedBy": "fsx.amazonaws.com"
    },
    "eventTime": "2024-07-25T16:41:44Z",
    "eventSource": "ec2.amazonaws.com",
    "eventName": "CreateNetworkInterfacePermission",
    "awsRegion": "------------------",
    "sourceIPAddress": "fsx.amazonaws.com",
    "userAgent": "fsx.amazonaws.com",
    "requestParameters": {
        "CreateNetworkInterfacePermissionRequest": {
            "AwsAccountId": "------------------",
            "Permission": "INSTANCE-ATTACH",
            "NetworkInterfaceId": "eni-------------------"
        }
    },
    "responseElements": {
        "CreateNetworkInterfacePermissionResponse": {
            "xmlns": "http://ec2.amazonaws.com/doc/2016-11-15/",
            "requestId": "-------------------",
            "interfacePermission": {
                "networkInterfaceId": "eni-------------------",
                "permissionState": {
                    "state": "GRANTED"
                },
                "awsAccountId": "------------------",
                "networkInterfacePermissionId": "eni-perm-------------------",
                "permission": "INSTANCE-ATTACH"
            }
        }
    },
    "requestID": "-------------------",
    "eventID": "-------------------",
    "readOnly": false,
    "eventType": "AwsApiCall",
    "managementEvent": true,
    "recipientAccountId": "------------------",
    "eventCategory": "Management"
}
```

Wondering if anyone might know why FSx created and attached a new ENI automatically?  I could not find anything in CloudTrail around the time of the occurrence aside form this that would indicate someone was logged in and did something that would have caused it.

Any thoughts on if this is the right thing to be pursuing to determine what happened or if i should look for something else (again not seeing much in CloudTrail around the time it occurred other than this)

Thanks

Varunprakash Shanmugam · Answer

It seems likely that the creation and attachment of a new ENI (Elastic Network Interface) to your FSx instance could be related to the 15-minute outage you experienced. This might have been triggered by automatic maintenance, updates, or network reconfiguration. Check for any scheduled maintenance, updates, or changes in your VPC, subnet, or security groups. Although the health dashboard showed no known outages, look at the AWS Personal Health Dashboard for specific service events. Deep dive into CloudTrail for related events like ModifyFileSystem or RebootFileSystem and review CloudWatch logs before and after the outage for anomalies. Additionally, analyze VPC Flow Logs for the subnet of your FSx instance for network traffic disruptions.

Varunprakash Shanmugam

answered 2 years ago

Leo K · Answer

This is an FSx for Windows File Server file system? Assuming you didn't make changes to it, a single-AZ file system will go offline for regular patching during the maintenance window you've set for the file system, if there are patches waiting to be deployed: https://docs.aws.amazon.com/fsx/latest/WindowsGuide/update-maintenance-window.html.

EXPERT

Leo K

answered 2 years ago

AWS FSx disconnection

Add your answer

Relevant content