Skip to content
DevOps AI ToolKit
Newsletter
OpenStack Troubleshooting Toolkit

OpenStack Troubleshooting Toolkit

Use this OpenStack troubleshooting toolkit to diagnose 504 gateway timeouts, Cinder scheduler and RabbitMQ RPC timeouts, dead Neutron agents, Keystone auth failures, and Kolla-Ansible control-plane problems.

Paste your error and get a triage plan.

Paste a log line, CLI error, stack trace, service failure, or config snippet and get a structured troubleshooting plan. Your snippet is carried straight into the AI Incident Response Assistant with OpenStack context prefilled.

Do not paste secrets, tokens, private keys, passwords, or customer data. Your snippet stays in your browser until you open the assistant.

Top 25 OpenStack Errors and Failure Modes

The production failures engineers hit most — each links to a full cause → fix → prevention guide.

OpenStack 504 Gateway Timeout

HAProxy returns a 504 because an upstream API worker took longer than the proxy timeout to respond.

Horizon 504 Gateway Timeout

The Horizon dashboard times out when backend API calls stall behind slow Keystone, Nova, or database responses.

Nova API timeout

Nova API requests hang or fail when compute services, the message bus, or the cell database become unresponsive.

Keystone authentication failure

Token issuance or validation fails, often from clock skew, stale Fernet keys, or a misconfigured identity backend.

Cinder scheduler timeout

The Cinder scheduler cannot place a volume in time because backends are slow, full, or not reporting capacity.

No valid backend was found

Cinder rejects a volume request because no storage backend passed the filters and capacity weighers.

Filtering removed all hosts

The Nova scheduler eliminated every candidate host, leaving no compute node able to satisfy the request.

Volume stuck creating

A Cinder volume never leaves the creating state, usually due to a driver, backend, or scheduler stall.

Neutron L3 agent dead

The neutron-l3-agent is reported dead, so routers stop forwarding traffic and floating IPs go unreachable.

Neutron DHCP agent down

Instances fail to lease addresses because the DHCP agent is down or its namespace is misconfigured.

RabbitMQ RPC timeout

oslo.messaging RPC calls time out when RabbitMQ is overloaded, partitioned, or dropping heartbeats.

oslo.messaging MessagingTimeout

A service waited for an RPC reply that never arrived, pointing at a stalled agent or a broken message bus.

MariaDB connection timeout

OpenStack services stall on the Galera cluster when connections exhaust, flow control kicks in, or a node desyncs.

HAProxy backend down

One or more HAProxy backends on the OpenStack control-plane VIP are marked DOWN, so requests to that service fail or return 503.

Kolla-Ansible certificate error

TLS handshakes fail after certificates expire or are rotated without a matching Kolla-Ansible reconfigure.

Placement API error

Scheduling breaks when the Placement service returns conflicts or stale resource provider allocations.

Nova compute service down

A hypervisor is marked down, so the scheduler skips it and instances on that host lose management.

VM stuck spawning

An instance never finishes building because image, network, or volume setup failed on the compute node.

VM stuck deleting

An instance hangs in the deleting task state when a volume detach, port cleanup, or RPC call never completes.

Image upload failure

Glance leaves an image stuck saving or errors on import when the store backend or conversion pipeline fails.

Glance image unavailable

An image cannot be downloaded or booted because the Glance store is unreachable or the data is corrupt.

Live migration failure

A live migration aborts due to CPU, storage, or network mismatches between the source and destination hosts.

Floating IP unreachable

A floating IP stops passing traffic when NAT rules, the L3 agent, or the router namespace are misconfigured.

Metadata service unavailable

Instances cannot fetch metadata or cloud-init data when the metadata agent or proxy path is broken.

OpenStack endpoint misconfiguration

Clients fail to reach a service when the Keystone catalog lists a wrong, internal, or unversioned endpoint URL.

Validate your config before you redeploy

Catch the structural mistakes that cause outages — 100% in your browser, nothing uploaded.

OpenStack Troubleshooting Hubs

Fix a whole class of OpenStack errors at once — each hub gathers the related guides for one failure class.

Best OpenStack Prompts

Turn symptoms, logs, and config into a structured plan with prompts tuned for OpenStack.

Keystone token latency debug

Trace slow token validation behind API 504s and timeouts

Use this prompt

RabbitMQ RPC timeout debugging

oslo.messaging RPC stalls

Use this prompt

Cinder scheduler capacity tuning

Volume scheduling timeouts

Use this prompt

Neutron networking and L3 agent recovery

Routers and agents down

Use this prompt

Octavia load balancer troubleshooting

Debug LB listeners, pools, and health monitors

Use this prompt

Kolla-Ansible config review

Config overrides and reconfigure

Use this prompt

Keystone token auth failure triage

Authentication and token errors

Use this prompt

Nova compute service down recovery

Hypervisor marked down

Use this prompt

Download the OpenStack Troubleshooting Runbook Pack

Control-plane runbooks for chasing 504s and RPC timeouts across HAProxy, Keystone, Nova, Cinder, Neutron, RabbitMQ, and MariaDB.

  • 504 top-to-bottom triage checklist
  • RabbitMQ RPC / oslo.messaging playbook
  • Cinder scheduler timeout path
  • Neutron L3 agent recovery
  • Kolla-Ansible restart decision tree
Download the OpenStack Runbook Pack

All OpenStack Troubleshooting Guides

Grouped by failure-mode type — each guide covers cause, fix, validation, and prevention.

Authentication & TLS (7)

Networking (28)

Storage (20)

Deployment & Builds (5)

Runtime (1)

Performance (1)

API errors (6)

Other (22)

Browse the full OpenStack category

OpenStack troubleshooting FAQ

Why does OpenStack return 504 Gateway Timeout?
A 504 usually comes from HAProxy fronting the control plane: an upstream API worker (Nova, Keystone, Cinder, or Horizon) took longer to respond than the HAProxy timeout allows. The root cause is typically a slow MariaDB/Galera query, a saturated RabbitMQ message bus delaying RPC replies, or an overloaded API worker pool. Start by checking HAProxy stats for the failing backend, then trace the request ID into the specific service and database logs.
How do I troubleshoot RabbitMQ RPC timeouts in OpenStack?
RPC timeouts surface as oslo.messaging MessagingTimeout errors when a service waits for a reply that never arrives. Check RabbitMQ cluster health for partitions, missed heartbeats, and memory or disk alarms, and confirm queue depth is not growing unbounded. Verify that Nova, Neutron, and Cinder agents hold healthy connections to the broker, and look for a dead or overloaded agent on the other end of the call rather than assuming the broker itself is at fault.
What causes Cinder scheduler timeouts?
The Cinder scheduler times out when it cannot place a volume before the RPC deadline. Common causes are backends that are full or over their allocation ratio, drivers that stop reporting capacity to the scheduler, or a slow storage backend. You will often see "No valid backend was found" or "filtering removed all hosts" alongside the timeout. Confirm each cinder-volume service is up, check reported free capacity, and review filter and weigher settings.
How do I check if neutron-l3-agent is down?
Run openstack network agent list and look for the L3 agent with an alive value of XXX or a stale heartbeat. When it is down, routers stop forwarding and floating IPs go unreachable. Inspect the neutron-l3-agent logs, confirm the router namespace exists on the host with ip netns, and verify the agent still has a working RabbitMQ connection, since a broker or messaging problem frequently makes an otherwise healthy agent report as dead.
How do Kolla-Ansible and HAProxy affect OpenStack troubleshooting?
In Kolla-Ansible deployments the services run in containers behind HAProxy, so most control-plane symptoms are really proxy or config-override problems. Expired or rotated TLS certificates require a reconfigure to take effect, and a backend marked down in HAProxy will cascade into 504s and API timeouts. When debugging, check HAProxy backend state first, then apply config changes through Kolla-Ansible's globals and config overrides rather than editing files inside the running containers.
When should I use the Incident Assistant for OpenStack?
Reach for the Incident Assistant when an OpenStack failure spans multiple services and you need to correlate signals fast, for example a 504 that could originate in HAProxy, Keystone, RabbitMQ RPC, or MariaDB. It helps triage cross-cutting incidents like Nova compute nodes going down, Neutron agents dying, or Cinder volumes stuck creating by suggesting where to trace request IDs and which logs to pull, so you spend less time guessing which layer broke.