Alarm "Stopping vApp XXXX as it has exceeded its runtime lease" is received in Cloud Director

Products

• VMware Cloud Director

Issue/Introduction

Cloud Director reports an alarm 'Stopping vApp XXXX as it has exceeded its runtime lease' and you need to find out the User who made vApp lease changes.

Environment

VMware Cloud Director 10.6.1

Cause

There are two types of vApp lease

• Runtime Lease: How long any of the VMs in the vApp can run before the vApp is automatically powered off or suspended.
• Storage Lease: How long vApp is available before being automatically deleted or marked as expired.

This article outlines the steps to determine if any user with vAPP rights has changed the lease period

Resolution

To validate if there was any event to change the lease by running the DB command and looking for vApp name

1. Take an SSH to Cloud Director database cell and connect.

sudo -i -u postgres psql vcloud

2. select * from audit_trail where event_type like '%runtime_lease_expiry%';

sample output :-

event_type | com/vmware/vcloud/event/vapp/runtime_lease_expiry
event_time | 2025-01-23 18:45:54.985+05:30
org_member_id | ########-####-####-####-########
tenant_id  | ########-####-####-####-########
event | {"cellId": {"id": "########-####-####-####-########"}, "status": "SUCCESS", "taskId": null, "actorId": null, "eventId": {"id": "########-####-####-####-########"}, "orgUser": {"id": "9########-####-####-####-########", "name": "<vdcname>", "type": "com.vmware.vcloud.entity.user"}, "actorName": null, "entityRef": {"id": "########-####-####-####-########", "name": "<vappName>",
"type": "com.vmware.vcloud.entity.vapp"}, "eventTime": 1742735754.985000000, "eventType": "com/vmware/vcloud/event/vapp/runtime_lease_expiry", "internalId": null, "taskCellId": null, "description": "Stopping vApp '<vappName>' (########-####-####-####-########) as it has exceeded its runtime lease"

3.Inspect the lease settings for the vApp.

select name, auto_undeploy_ticks, auto_undeploy_date, auto_delete_ticks, auto_delete_date, is_auto_undeploy_notified, is_auto_delete_notified from vm_container where name '<vappName>';

sample output:

-[ RECORD 1 ]-------------+-----------------------------------------------

name                      | <vappName>
date_created              | 2025-01-23 19:58:02.471
auto_undeploy_ticks       | 36000000000
auto_undeploy_date        |
auto_delete_ticks         | 864000000000
auto_delete_date          | 2025-04-16 04:29:42.414
is_auto_undeploy_notified | t
is_auto_delete_notified   | t

4. To identify the User and IP address of the machine from which the change is made

a) Examine the main log file in the location /opt/vmware/vcloud-director/logs/vcloud-container-debug.log for references similar to:

Source object was null when constructing com/vmware/vcloud/event/vapp/modify | requestId=########-####-####-####-########,request=PUT https://cloud.example.com/api/vApp/vapp-########-####-####-####-########/leaseSettingsSection/,requestTime=1744691380903,remoteAddress=172.168.x.x:52565,
Source object was null when constructing com/vmware/vcloud/event/vapp/lease_expiration_changed | requestId=########-####-####-####-########,request=PUT https://cloud.example.com/api/vApp/vapp-########-####-####-####-########/leaseSettingsSection/,requestTime=1744691380903

b) Run the following database query: 

select * from audit_trail where event_type like '%lease_expiration_changed%';

id            | 4610
event_type    | com/vmware/vcloud/event/vapp/lease_expiration_changed
event_time    | 2025-04-15 04:29:42.589+00
org_member_id | ########-####-####-####-########/
tenant_id     | ########-####-####-####-########/
event         | {"cellId": {"id": "########-####-####-####-########/"}, "status": "SUCCESS", "taskId": {"id": "########-####-####-####-########/"}, "actorId": null, "eventId": {"id": "########-####-####-####-########/"}, "orgUser": {"id": "########-####-####-####-########/", "name": "abc-user", "type": "com.vmware.vcloud.entity.user"}, 

From the above log snippet, we can determine that

• the lease expiration was changed from remoteAddress 172.168.x.x to requestTime=1744691380903 (Epoch time).
• the user "abc-user" has made this change. 

Additional Information

Another useful DB query command related to the vApp lease 

select name, auto_undeploy_ticks, auto_undeploy_date, auto_delete_ticks, auto_delete_date, is_auto_undeploy_notified, is_auto_delete_notified from vm_container;