re-merged in trunk to correct conflict

8 files changed, 221 insertions, 79 deletions

diff --git a/nova/api/__init__.py b/nova/api/__init__.py
index 26fed847b..803470570 100644
--- a/nova/api/__init__.py
+++ b/nova/api/__init__.py
@@ -24,7 +24,6 @@ Root WSGI middleware for all API controllers.
 :ec2api_subdomain:  subdomain running the EC2 API (default: ec2)
 
 """
-import logging
 
 import routes
 import webob.dec
diff --git a/nova/api/ec2/__init__.py b/nova/api/ec2/__init__.py
index aa3bfaeb4..2fa1f636c 100644
--- a/nova/api/ec2/__init__.py
+++ b/nova/api/ec2/__init__.py
@@ -20,7 +20,7 @@ Starting point for routing EC2 requests.
 
 """
 
-import logging
+import datetime
 import routes
 import webob
 import webob.dec
@@ -29,6 +29,7 @@ import webob.exc
 from nova import context
 from nova import exception
 from nova import flags
+from nova import log as logging
 from nova import wsgi
 from nova.api.ec2 import apirequest
 from nova.api.ec2 import admin
@@ -37,6 +38,7 @@ from nova.auth import manager
 
 
 FLAGS = flags.FLAGS
+LOG = logging.getLogger("nova.api")
 flags.DEFINE_boolean('use_forwarded_for', False,
                      'Treat X-Forwarded-For as the canonical remote address. '
                      'Only enable this if you have a sanitizing proxy.')
@@ -52,10 +54,6 @@ flags.DEFINE_list('lockout_memcached_servers', None,
                   'Memcached servers or None for in process cache.')
 
 
-_log = logging.getLogger("api")
-_log.setLevel(logging.DEBUG)
-
-
 class API(wsgi.Middleware):
     """Routing for all EC2 API requests."""
 
@@ -64,6 +62,40 @@ class API(wsgi.Middleware):
         if FLAGS.use_lockout:
             self.application = Lockout(self.application)
 
+    @webob.dec.wsgify
+    def __call__(self, req):
+        rv = req.get_response(self.application)
+        self.log_request_completion(rv, req)
+        return rv
+
+    def log_request_completion(self, response, request):
+        controller = request.environ.get('ec2.controller', None)
+        if controller:
+            controller = controller.__class__.__name__
+        action = request.environ.get('ec2.action', None)
+        ctxt = request.environ.get('ec2.context', None)
+        seconds = 'X'
+        microseconds = 'X'
+        if ctxt:
+            delta = datetime.datetime.utcnow() - \
+                    ctxt.timestamp
+            seconds = delta.seconds
+            microseconds = delta.microseconds
+        LOG.info(
+            "%s.%ss %s %s %s %s:%s %s [%s] %s %s",
+            seconds,
+            microseconds,
+            request.remote_addr,
+            request.method,
+            request.path_info,
+            controller,
+            action,
+            response.status_int,
+            request.user_agent,
+            request.content_type,
+            response.content_type,
+            context=ctxt)
+
 
 class Lockout(wsgi.Middleware):
     """Lockout for x minutes on y failed auths in a z minute period.
@@ -98,7 +130,7 @@ class Lockout(wsgi.Middleware):
         failures_key = "authfailures-%s" % access_key
         failures = int(self.mc.get(failures_key) or 0)
         if failures >= FLAGS.lockout_attempts:
-            detail = "Too many failed authentications."
+            detail = _("Too many failed authentications.")
             raise webob.exc.HTTPForbidden(detail=detail)
         res = req.get_response(self.application)
         if res.status_int == 403:
@@ -107,9 +139,9 @@ class Lockout(wsgi.Middleware):
                 # NOTE(vish): To use incr, failures has to be a string.
                 self.mc.set(failures_key, '1', time=FLAGS.lockout_window * 60)
             elif failures >= FLAGS.lockout_attempts:
-                _log.warn('Access key %s has had %d failed authentications'
-                          ' and will be locked out for %d minutes.' %
-                          (access_key, failures, FLAGS.lockout_minutes))
+                LOG.warn(_('Access key %s has had %d failed authentications'
+                           ' and will be locked out for %d minutes.'),
+                         access_key, failures, FLAGS.lockout_minutes)
                 self.mc.set(failures_key, str(failures),
                             time=FLAGS.lockout_minutes * 60)
         return res
@@ -142,8 +174,9 @@ class Authenticate(wsgi.Middleware):
                     req.method,
                     req.host,
                     req.path)
-        except exception.Error, ex:
-            logging.debug(_("Authentication Failure: %s") % ex)
+        # Be explicit for what exceptions are 403, the rest bubble as 500
+        except (exception.NotFound, exception.NotAuthorized) as ex:
+            LOG.audit(_("Authentication Failure: %s"), str(ex))
             raise webob.exc.HTTPForbidden()
 
         # Authenticated!
@@ -154,6 +187,8 @@ class Authenticate(wsgi.Middleware):
                                       project=project,
                                       remote_address=remote_address)
         req.environ['ec2.context'] = ctxt
+        LOG.audit(_('Authenticated Request For %s:%s)'), user.name,
+                  project.name, context=req.environ['ec2.context'])
         return self.application
 
 
@@ -189,9 +224,9 @@ class Router(wsgi.Middleware):
         except:
             raise webob.exc.HTTPBadRequest()
 
-        _log.debug(_('action: %s') % action)
+        LOG.debug(_('action: %s'), action)
         for key, value in args.items():
-            _log.debug(_('arg: %s\t\tval: %s') % (key, value))
+            LOG.debug(_('arg: %s\t\tval: %s'), key, value)
 
         # Success!
         req.environ['ec2.controller'] = controller
@@ -263,6 +298,9 @@ class Authorizer(wsgi.Middleware):
         if self._matches_any_role(context, allowed_roles):
             return self.application
         else:
+            LOG.audit(_("Unauthorized request for controller=%s "
+                        "and action=%s"), controller_name, action,
+                      context=context)
             raise webob.exc.HTTPUnauthorized()
 
     def _matches_any_role(self, context, roles):
@@ -297,15 +335,24 @@ class Executor(wsgi.Application):
         result = None
         try:
             result = api_request.send(context, **args)
+        except exception.NotFound as ex:
+            LOG.info(_('NotFound raised: %s'), str(ex),  context=context)
+            return self._error(req, context, type(ex).__name__, str(ex))
         except exception.ApiError as ex:
-
+            LOG.exception(_('ApiError raised: %s'), str(ex), context=context)
             if ex.code:
-                return self._error(req, ex.code, ex.message)
+                return self._error(req, context, ex.code, str(ex))
             else:
-                return self._error(req, type(ex).__name__, ex.message)
-        # TODO(vish): do something more useful with unknown exceptions
+                return self._error(req, context, type(ex).__name__, str(ex))
         except Exception as ex:
-            return self._error(req, type(ex).__name__, str(ex))
+            extra = {'environment': req.environ}
+            LOG.exception(_('Unexpected error raised: %s'), str(ex),
+                          extra=extra, context=context)
+            return self._error(req,
+                               context,
+                               'UnknownError',
+                               _('An unknown error has occurred. '
+                               'Please try your request again.'))
         else:
             resp = webob.Response()
             resp.status = 200
@@ -313,15 +360,16 @@ class Executor(wsgi.Application):
             resp.body = str(result)
             return resp
 
-    def _error(self, req, code, message):
-        logging.error("%s: %s", code, message)
+    def _error(self, req, context, code, message):
+        LOG.error("%s: %s", code, message, context=context)
         resp = webob.Response()
         resp.status = 400
         resp.headers['Content-Type'] = 'text/xml'
         resp.body = str('<?xml version="1.0"?>\n'
-                     '<Response><Errors><Error><Code>%s</Code>'
-                     '<Message>%s</Message></Error></Errors>'
-                     '<RequestID>?</RequestID></Response>' % (code, message))
+                         '<Response><Errors><Error><Code>%s</Code>'
+                         '<Message>%s</Message></Error></Errors>'
+                         '<RequestID>%s</RequestID></Response>' %
+                         (code, message, context.request_id))
         return resp
 
 
diff --git a/nova/api/ec2/admin.py b/nova/api/ec2/admin.py
index fac01369e..758b612e8 100644
--- a/nova/api/ec2/admin.py
+++ b/nova/api/ec2/admin.py
@@ -24,9 +24,13 @@ import base64
 
 from nova import db
 from nova import exception
+from nova import log as logging
 from nova.auth import manager
 
 
+LOG = logging.getLogger('nova.api.ec2.admin')
+
+
 def user_dict(user, base64_file=None):
     """Convert the user object to a result dict"""
     if user:
@@ -75,17 +79,18 @@ class AdminController(object):
         return {'userSet':
                 [user_dict(u) for u in manager.AuthManager().get_users()]}
 
-    def register_user(self, _context, name, **_kwargs):
+    def register_user(self, context, name, **_kwargs):
         """Creates a new user, and returns generated credentials."""
+        LOG.audit(_("Creating new user: %s"), name, context=context)
         return user_dict(manager.AuthManager().create_user(name))
 
-    def deregister_user(self, _context, name, **_kwargs):
+    def deregister_user(self, context, name, **_kwargs):
         """Deletes a single user (NOT undoable.)
            Should throw an exception if the user has instances,
            volumes, or buckets remaining.
         """
+        LOG.audit(_("Deleting user: %s"), name, context=context)
         manager.AuthManager().delete_user(name)
-
         return True
 
     def describe_roles(self, context, project_roles=True, **kwargs):
@@ -105,15 +110,27 @@ class AdminController(object):
                          operation='add', **kwargs):
         """Add or remove a role for a user and project."""
         if operation == 'add':
+            if project:
+                LOG.audit(_("Adding role %s to user %s for project %s"), role,
+                          user, project, context=context)
+            else:
+                LOG.audit(_("Adding sitewide role %s to user %s"), role, user,
+                          context=context)
             manager.AuthManager().add_role(user, role, project)
         elif operation == 'remove':
+            if project:
+                LOG.audit(_("Removing role %s from user %s for project %s"),
+                          role, user, project, context=context)
+            else:
+                LOG.audit(_("Removing sitewide role %s from user %s"), role,
+                          user, context=context)
             manager.AuthManager().remove_role(user, role, project)
         else:
-            raise exception.ApiError('operation must be add or remove')
+            raise exception.ApiError(_('operation must be add or remove'))
 
         return True
 
-    def generate_x509_for_user(self, _context, name, project=None, **kwargs):
+    def generate_x509_for_user(self, context, name, project=None, **kwargs):
         """Generates and returns an x509 certificate for a single user.
            Is usually called from a client that will wrap this with
            access and secret key info, and return a zip file.
@@ -122,6 +139,8 @@ class AdminController(object):
             project = name
         project = manager.AuthManager().get_project(project)
         user = manager.AuthManager().get_user(name)
+        LOG.audit(_("Getting x509 for user: %s on project: %s"), name,
+                  project, context=context)
         return user_dict(user, base64.b64encode(project.get_credentials(user)))
 
     def describe_project(self, context, name, **kwargs):
@@ -137,6 +156,8 @@ class AdminController(object):
     def register_project(self, context, name, manager_user, description=None,
                          member_users=None, **kwargs):
         """Creates a new project"""
+        LOG.audit(_("Create project %s managed by %s"), name, manager_user,
+                  context=context)
         return project_dict(
             manager.AuthManager().create_project(
                 name,
@@ -146,6 +167,7 @@ class AdminController(object):
 
     def deregister_project(self, context, name):
         """Permanently deletes a project."""
+        LOG.audit(_("Delete project: %s"), name, context=context)
         manager.AuthManager().delete_project(name)
         return True
 
@@ -159,11 +181,15 @@ class AdminController(object):
                               **kwargs):
         """Add or remove a user from a project."""
         if operation == 'add':
+            LOG.audit(_("Adding user %s to project %s"), user, project,
+                      context=context)
             manager.AuthManager().add_to_project(user, project)
         elif operation == 'remove':
+            LOG.audit(_("Removing user %s from project %s"), user, project,
+                      context=context)
             manager.AuthManager().remove_from_project(user, project)
         else:
-            raise exception.ApiError('operation must be add or remove')
+            raise exception.ApiError(_('operation must be add or remove'))
         return True
 
     # FIXME(vish): these host commands don't work yet, perhaps some of the
diff --git a/nova/api/ec2/apirequest.py b/nova/api/ec2/apirequest.py
index a90fbeb0c..d0b417db1 100644
--- a/nova/api/ec2/apirequest.py
+++ b/nova/api/ec2/apirequest.py
@@ -20,13 +20,13 @@
 APIRequest class
 """
 
-import logging
 import re
 # TODO(termie): replace minidom with etree
 from xml.dom import minidom
 
-_log = logging.getLogger("api")
-_log.setLevel(logging.DEBUG)
+from nova import log as logging
+
+LOG = logging.getLogger("nova.api.request")
 
 
 _c2u = re.compile('(((?<=[a-z])[A-Z])|([A-Z](?![A-Z]|$)))')
@@ -94,7 +94,7 @@ class APIRequest(object):
         except AttributeError:
             _error = _('Unsupported API request: controller = %s,'
                        'action = %s') % (self.controller, self.action)
-            _log.warning(_error)
+            LOG.exception(_error)
             # TODO: Raise custom exception, trap in apiserver,
             #       and reraise as 400 error.
             raise Exception(_error)
@@ -142,7 +142,7 @@ class APIRequest(object):
 
         response = xml.toxml()
         xml.unlink()
-        _log.debug(response)
+        LOG.debug(response)
         return response
 
     def _render_dict(self, xml, el, data):
@@ -151,7 +151,7 @@ class APIRequest(object):
                 val = data[key]
                 el.appendChild(self._render_data(xml, key, val))
         except:
-            _log.debug(data)
+            LOG.debug(data)
             raise
 
     def _render_data(self, xml, el_name, data):
diff --git a/nova/api/ec2/cloud.py b/nova/api/ec2/cloud.py
index 0c0027287..7f1a414f3 100644
--- a/nova/api/ec2/cloud.py
+++ b/nova/api/ec2/cloud.py
@@ -24,18 +24,16 @@ datastore.
 
 import base64
 import datetime
-import logging
-import re
-import os
-
-from nova import context
 import IPy
+import os
 
 from nova import compute
+from nova import context
 from nova import crypto
 from nova import db
 from nova import exception
 from nova import flags
+from nova import log as logging
 from nova import network
 from nova import rpc
 from nova import utils
@@ -45,6 +43,8 @@ from nova.compute import instance_types
 
 FLAGS = flags.FLAGS
 
+LOG = logging.getLogger("nova.api.cloud")
+
 InvalidInputException = exception.InvalidInputException
 
 
@@ -131,15 +131,6 @@ class CloudController(object):
                     result[key] = [line]
         return result
 
-    def _trigger_refresh_security_group(self, context, security_group):
-        nodes = set([instance['host'] for instance in security_group.instances
-                       if instance['host'] is not None])
-        for node in nodes:
-            rpc.cast(context,
-                     '%s.%s' % (FLAGS.compute_topic, node),
-                     {"method": "refresh_security_group",
-                      "args": {"security_group_id": security_group.id}})
-
     def get_metadata(self, address):
         ctxt = context.get_admin_context()
         instance_ref = self.compute_api.get_all(ctxt, fixed_ip=address)
@@ -247,6 +238,7 @@ class CloudController(object):
                                                             FLAGS.cc_host,
                                                             FLAGS.cc_port,
                                                             FLAGS.ec2_suffix)}]
+        return {'regionInfo': regions}
 
     def describe_snapshots(self,
                            context,
@@ -282,6 +274,7 @@ class CloudController(object):
         return {'keypairsSet': result}
 
     def create_key_pair(self, context, key_name, **kwargs):
+        LOG.audit(_("Create key pair %s"), key_name, context=context)
         data = _gen_key(context, context.user.id, key_name)
         return {'keyName': key_name,
                 'keyFingerprint': data['fingerprint'],
@@ -289,6 +282,7 @@ class CloudController(object):
         # TODO(vish): when context is no longer an object, pass it here
 
     def delete_key_pair(self, context, key_name, **kwargs):
+        LOG.audit(_("Delete key pair %s"), key_name, context=context)
         try:
             db.key_pair_destroy(context, context.user.id, key_name)
         except exception.NotFound:
@@ -395,6 +389,8 @@ class CloudController(object):
         return False
 
     def revoke_security_group_ingress(self, context, group_name, **kwargs):
+        LOG.audit(_("Revoke security group ingress %s"), group_name,
+                  context=context)
         self.compute_api.ensure_default_security_group(context)
         security_group = db.security_group_get_by_name(context,
                                                        context.project_id,
@@ -412,7 +408,8 @@ class CloudController(object):
                     match = False
             if match:
                 db.security_group_rule_destroy(context, rule['id'])
-                self._trigger_refresh_security_group(context, security_group)
+                self.compute_api.trigger_security_group_rules_refresh(context,
+                                                          security_group['id'])
                 return True
         raise exception.ApiError(_("No rule for the specified parameters."))
 
@@ -421,6 +418,8 @@ class CloudController(object):
     #              for these operations, so support for newer API versions
     #              is sketchy.
     def authorize_security_group_ingress(self, context, group_name, **kwargs):
+        LOG.audit(_("Authorize security group ingress %s"), group_name,
+                  context=context)
         self.compute_api.ensure_default_security_group(context)
         security_group = db.security_group_get_by_name(context,
                                                        context.project_id,
@@ -435,7 +434,8 @@ class CloudController(object):
 
         security_group_rule = db.security_group_rule_create(context, values)
 
-        self._trigger_refresh_security_group(context, security_group)
+        self.compute_api.trigger_security_group_rules_refresh(context,
+                                                          security_group['id'])
 
         return True
 
@@ -457,6 +457,7 @@ class CloudController(object):
         return source_project_id
 
     def create_security_group(self, context, group_name, group_description):
+        LOG.audit(_("Create Security Group %s"), group_name, context=context)
         self.compute_api.ensure_default_security_group(context)
         if db.security_group_exists(context, context.project_id, group_name):
             raise exception.ApiError(_('group %s already exists') % group_name)
@@ -471,6 +472,7 @@ class CloudController(object):
                                                                  group_ref)]}
 
     def delete_security_group(self, context, group_name, **kwargs):
+        LOG.audit(_("Delete security group %s"), group_name, context=context)
         security_group = db.security_group_get_by_name(context,
                                                        context.project_id,
                                                        group_name)
@@ -478,6 +480,8 @@ class CloudController(object):
         return True
 
     def get_console_output(self, context, instance_id, **kwargs):
+        LOG.audit(_("Get console output for instance %s"), instance_id,
+                  context=context)
         # instance_id is passed in as a list of instances
         ec2_id = instance_id[0]
         instance_id = ec2_id_to_id(ec2_id)
@@ -536,6 +540,7 @@ class CloudController(object):
         return v
 
     def create_volume(self, context, size, **kwargs):
+        LOG.audit(_("Create volume of %s GB"), size, context=context)
         volume = self.volume_api.create(context, size,
                                         kwargs.get('display_name'),
                                         kwargs.get('display_description'))
@@ -559,6 +564,8 @@ class CloudController(object):
         return True
 
     def attach_volume(self, context, volume_id, instance_id, device, **kwargs):
+        LOG.audit(_("Attach volume %s to instacne %s at %s"), volume_id,
+                  instance_id, device, context=context)
         self.compute_api.attach_volume(context, instance_id, volume_id, device)
         volume = self.volume_api.get(context, volume_id)
         return {'attachTime': volume['attach_time'],
@@ -569,6 +576,7 @@ class CloudController(object):
                 'volumeId': volume_id}
 
     def detach_volume(self, context, volume_id, **kwargs):
+        LOG.audit(_("Detach volume %s"), volume_id, context=context)
         volume = self.volume_api.get(context, volume_id)
         instance = self.compute_api.detach_volume(context, volume_id)
         return {'attachTime': volume['attach_time'],
@@ -586,19 +594,24 @@ class CloudController(object):
         return [{label: x} for x in lst]
 
     def describe_instances(self, context, **kwargs):
-        return self._format_describe_instances(context)
+        return self._format_describe_instances(context, **kwargs)
 
-    def _format_describe_instances(self, context):
-        return {'reservationSet': self._format_instances(context)}
+    def _format_describe_instances(self, context, **kwargs):
+        return {'reservationSet': self._format_instances(context, **kwargs)}
 
     def _format_run_instances(self, context, reservation_id):
-        i = self._format_instances(context, reservation_id)
+        i = self._format_instances(context, reservation_id=reservation_id)
         assert len(i) == 1
         return i[0]
 
-    def _format_instances(self, context, **kwargs):
+    def _format_instances(self, context, instance_id=None, **kwargs):
         reservations = {}
-        instances = self.compute_api.get_all(context, **kwargs)
+        # NOTE(vish): instance_id is an optional list of ids to filter by
+        if instance_id:
+            instance_id = [ec2_id_to_id(x) for x in instance_id]
+            instances = [self.compute_api.get(context, x) for x in instance_id]
+        else:
+            instances = self.compute_api.get_all(context, **kwargs)
         for instance in instances:
             if not context.user.is_admin():
                 if instance['image_id'] == FLAGS.vpn_image_id:
@@ -670,19 +683,24 @@ class CloudController(object):
         return {'addressesSet': addresses}
 
     def allocate_address(self, context, **kwargs):
+        LOG.audit(_("Allocate address"), context=context)
         public_ip = self.network_api.allocate_floating_ip(context)
         return {'addressSet': [{'publicIp': public_ip}]}
 
     def release_address(self, context, public_ip, **kwargs):
+        LOG.audit(_("Release address %s"), public_ip, context=context)
         self.network_api.release_floating_ip(context, public_ip)
         return {'releaseResponse': ["Address released."]}
 
     def associate_address(self, context, instance_id, public_ip, **kwargs):
+        LOG.audit(_("Associate address %s to instance %s"), public_ip,
+                  instance_id, context=context)
         instance_id = ec2_id_to_id(instance_id)
         self.compute_api.associate_floating_ip(context, instance_id, public_ip)
         return {'associateResponse': ["Address associated."]}
 
     def disassociate_address(self, context, public_ip, **kwargs):
+        LOG.audit(_("Disassociate address %s"), public_ip, context=context)
         self.network_api.disassociate_floating_ip(context, public_ip)
         return {'disassociateResponse': ["Address disassociated."]}
 
@@ -709,7 +727,7 @@ class CloudController(object):
     def terminate_instances(self, context, instance_id, **kwargs):
         """Terminate each instance in instance_id, which is a list of ec2 ids.
         instance_id is a kwarg so its name cannot be modified."""
-        logging.debug("Going to start terminating instances")
+        LOG.debug(_("Going to start terminating instances"))
         for ec2_id in instance_id:
             instance_id = ec2_id_to_id(ec2_id)
             self.compute_api.delete(context, instance_id)
@@ -717,6 +735,7 @@ class CloudController(object):
 
     def reboot_instances(self, context, instance_id, **kwargs):
         """instance_id is a list of instance ids"""
+        LOG.audit(_("Reboot instance %r"), instance_id, context=context)
         for ec2_id in instance_id:
             instance_id = ec2_id_to_id(ec2_id)
             self.compute_api.reboot(context, instance_id)
@@ -753,6 +772,7 @@ class CloudController(object):
         return {'imagesSet': images}
 
     def deregister_image(self, context, image_id, **kwargs):
+        LOG.audit(_("De-registering image %s"), image_id, context=context)
         self.image_service.deregister(context, image_id)
         return {'imageId': image_id}
 
@@ -760,7 +780,8 @@ class CloudController(object):
         if image_location is None and 'name' in kwargs:
             image_location = kwargs['name']
         image_id = self.image_service.register(context, image_location)
-        logging.debug("Registered %s as %s" % (image_location, image_id))
+        LOG.audit(_("Registered image %s with id %s"), image_location,
+                  image_id, context=context)
         return {'imageId': image_id}
 
     def describe_image_attribute(self, context, image_id, attribute, **kwargs):
@@ -788,6 +809,7 @@ class CloudController(object):
             raise exception.ApiError(_('only group "all" is supported'))
         if not operation_type in ['add', 'remove']:
             raise exception.ApiError(_('operation_type must be add or remove'))
+        LOG.audit(_("Updating image %s publicity"), image_id, context=context)
         return self.image_service.modify(context, image_id, operation_type)
 
     def update_image(self, context, image_id, **kwargs):
diff --git a/nova/api/ec2/metadatarequesthandler.py b/nova/api/ec2/metadatarequesthandler.py
index a57a6698a..848f0b034 100644
--- a/nova/api/ec2/metadatarequesthandler.py
+++ b/nova/api/ec2/metadatarequesthandler.py
@@ -18,15 +18,15 @@
 
 """Metadata request handler."""
 
-import logging
-
 import webob.dec
 import webob.exc
 
+from nova import log as logging
 from nova import flags
 from nova.api.ec2 import cloud
 
 
+LOG = logging.getLogger('nova.api.ec2.metadata')
 FLAGS = flags.FLAGS
 
 
@@ -72,8 +72,7 @@ class MetadataRequestHandler(object):
             remote_address = req.headers.get('X-Forwarded-For', remote_address)
         meta_data = cc.get_metadata(remote_address)
         if meta_data is None:
-            logging.error(_('Failed to get metadata for ip: %s') %
-                          remote_address)
+            LOG.error(_('Failed to get metadata for ip: %s'), remote_address)
             raise webob.exc.HTTPNotFound()
         data = self.lookup(req.path_info, meta_data)
         if data is None:
diff --git a/nova/api/openstack/__init__.py b/nova/api/openstack/__init__.py
index 94f02398c..7b999c87b 100644
--- a/nova/api/openstack/__init__.py
+++ b/nova/api/openstack/__init__.py
@@ -20,17 +20,13 @@
 WSGI middleware for OpenStack API controllers.
 """
 
-import time
-
-import logging
 import routes
-import traceback
 import webob.dec
 import webob.exc
 import webob
 
-from nova import context
 from nova import flags
+from nova import log as logging
 from nova import utils
 from nova import wsgi
 from nova.api.openstack import faults
@@ -38,11 +34,11 @@ from nova.api.openstack import backup_schedules
 from nova.api.openstack import consoles
 from nova.api.openstack import flavors
 from nova.api.openstack import images
-from nova.api.openstack import ratelimiting
 from nova.api.openstack import servers
 from nova.api.openstack import sharedipgroups
 
 
+LOG = logging.getLogger('nova.api.openstack')
 FLAGS = flags.FLAGS
 flags.DEFINE_string('os_api_auth',
     'nova.api.openstack.auth.AuthMiddleware',
@@ -72,8 +68,7 @@ class API(wsgi.Middleware):
         try:
             return req.get_response(self.application)
         except Exception as ex:
-            logging.warn(_("Caught error: %s") % str(ex))
-            logging.error(traceback.format_exc())
+            LOG.exception(_("Caught error: %s"), str(ex))
             exc = webob.exc.HTTPInternalServerError(explanation=str(ex))
             return faults.Fault(exc)
 
@@ -89,7 +84,7 @@ class APIRouter(wsgi.Router):
 
         server_members = {'action': 'POST'}
         if FLAGS.allow_admin_api:
-            logging.debug("Including admin operations in API.")
+            LOG.debug(_("Including admin operations in API."))
             server_members['pause'] = 'POST'
             server_members['unpause'] = 'POST'
             server_members["diagnostics"] = "GET"
diff --git a/nova/api/openstack/servers.py b/nova/api/openstack/servers.py
index ce64ac7ad..3f0fdc575 100644
--- a/nova/api/openstack/servers.py
+++ b/nova/api/openstack/servers.py
@@ -15,13 +15,13 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
-import logging
 import traceback
 
 from webob import exc
 
 from nova import compute
 from nova import exception
+from nova import log as logging
 from nova import wsgi
 from nova.api.openstack import common
 from nova.api.openstack import faults
@@ -170,6 +170,50 @@ class Controller(wsgi.Controller):
             return faults.Fault(exc.HTTPUnprocessableEntity())
         return exc.HTTPAccepted()
 
+    def lock(self, req, id):
+        """
+        lock the instance with id
+        admin only operation
+
+        """
+        context = req.environ['nova.context']
+        try:
+            self.compute_api.lock(context, id)
+        except:
+            readable = traceback.format_exc()
+            LOG.exception(_("Compute.api::lock %s"), readable)
+            return faults.Fault(exc.HTTPUnprocessableEntity())
+        return exc.HTTPAccepted()
+
+    def unlock(self, req, id):
+        """
+        unlock the instance with id
+        admin only operation
+
+        """
+        context = req.environ['nova.context']
+        try:
+            self.compute_api.unlock(context, id)
+        except:
+            readable = traceback.format_exc()
+            LOG.exception(_("Compute.api::unlock %s"), readable)
+            return faults.Fault(exc.HTTPUnprocessableEntity())
+        return exc.HTTPAccepted()
+
+    def get_lock(self, req, id):
+        """
+        return the boolean state of (instance with id)'s lock
+
+        """
+        context = req.environ['nova.context']
+        try:
+            self.compute_api.get_lock(context, id)
+        except:
+            readable = traceback.format_exc()
+            LOG.exception(_("Compute.api::get_lock %s"), readable)
+            return faults.Fault(exc.HTTPUnprocessableEntity())
+        return exc.HTTPAccepted()
+
     def pause(self, req, id):
         """ Permit Admins to Pause the server. """
         ctxt = req.environ['nova.context']
@@ -177,7 +221,7 @@ class Controller(wsgi.Controller):
             self.compute_api.pause(ctxt, id)
         except:
             readable = traceback.format_exc()
-            logging.error(_("Compute.api::pause %s"), readable)
+            LOG.exception(_("Compute.api::pause %s"), readable)
             return faults.Fault(exc.HTTPUnprocessableEntity())
         return exc.HTTPAccepted()
 
@@ -188,7 +232,7 @@ class Controller(wsgi.Controller):
             self.compute_api.unpause(ctxt, id)
         except:
             readable = traceback.format_exc()
-            logging.error(_("Compute.api::unpause %s"), readable)
+            LOG.exception(_("Compute.api::unpause %s"), readable)
             return faults.Fault(exc.HTTPUnprocessableEntity())
         return exc.HTTPAccepted()
 
@@ -199,7 +243,7 @@ class Controller(wsgi.Controller):
             self.compute_api.suspend(context, id)
         except:
             readable = traceback.format_exc()
-            logging.error(_("compute.api::suspend %s"), readable)
+            LOG.exception(_("compute.api::suspend %s"), readable)
             return faults.Fault(exc.HTTPUnprocessableEntity())
         return exc.HTTPAccepted()
 
@@ -210,7 +254,7 @@ class Controller(wsgi.Controller):
             self.compute_api.resume(context, id)
         except:
             readable = traceback.format_exc()
-            logging.error(_("compute.api::resume %s"), readable)
+            LOG.exception(_("compute.api::resume %s"), readable)
             return faults.Fault(exc.HTTPUnprocessableEntity())
         return exc.HTTPAccepted()
 
@@ -222,4 +266,13 @@ class Controller(wsgi.Controller):
     def actions(self, req, id):
         """Permit Admins to retrieve server actions."""
         ctxt = req.environ["nova.context"]
-        return self.compute_api.get_actions(ctxt, id)
+        items = self.compute_api.get_actions(ctxt, id)
+        actions = []
+        # TODO(jk0): Do not do pre-serialization here once the default
+        # serializer is updated
+        for item in items:
+            actions.append(dict(
+                created_at=str(item.created_at),
+                action=item.action,
+                error=item.error))
+        return dict(actions=actions)