Occasionally, Compute Engine fails to register PAYG Ubuntu Pro licensesautomatically. This document describes how to resolve issues you might encounterwith registering Compute Engine virtual machine (VM) instances running pay-as-you-go(PAYG) Ubuntu Pro licenses.

Check registration status

To check if your license is registered, connect to the VM and runthe following command

sudo ua status

If the registration succeeded, you see output similar to the following and nofurther action is required:

SERVICE          ENTITLED  STATUS    DESCRIPTIONcc-eal           yes       disabled  Common Criteria EAL2 Provisioning Packagescis              yes       disabled  Security compliance and audit toolsesm-apps         yes       enabled   Expanded Security Maintenance for Applicationsesm-infra        yes       enabled   Expanded Security Maintenance for Infrastructurefips             yes       disabled  NIST-certified core packagesfips-updates     yes       disabled  NIST-certified core packages with priority security updateslivepatch        yes       enabled   Canonical Livepatch service

If the registration failed and Ubuntu Pro isn't registered, you see a messagesimilar to the following:

This machine is not attached to an Ubuntu Pro subscription.

Manually register license

If Compute Engine failed to automatically register you Ubuntu pro license,you can manually register the license by running the following command:

sudo pro auto-attach

The output is similar to the following:

• Registration success:

  This machine is already attached toPROJECT_IDTo use a different subscription first run: sudo pro detach.

• Registration failure:

  Internal Server Error

Troubleshoot license registration

If you were unable to manually register a Ubuntu Pro license, resolve the issue bydoing the following:

1. Verify that the VM can reach the metadata server by running the following commandto check the number of disks attached to the VM:

   curl "http://metadata.google.internal/computeMetadata/v1/instance/disks/" -H "Metadata-Flavor: Google"

   The output is similar to the following, which shows the number of disks attachedto the VM:

   0/1/2/

   If the output doesn't show the number of disks attached to the VM, seeTroubleshooting metadata server access issues.

2. Verify the Google guest agent is running by running the following command:

   systemctl status google-guest-agent.service

   The output is similar to the following:

   ● google-guest-agent.service - Google Compute Engine Guest AgentLoaded: loaded (/lib/systemd/system/google-guest-agent.service; enabled;vendor preset: enabled)Active: active (running) since Thu 2023-04-20 16:35:11 PDT; 2h 12min agoMain PID: 4582 (google_guest_ag)Tasks: 10 (limit: 9525)

   If the guest agent is not installed or failed,install or reinstall thethe guest environment.

3. Verify that a Service account is attached to the VM, by running the followingcommand from your local workstation:

   gcloud compute instances describeVM_NAME \   --zoneZONE --format="table(serviceAccounts.email)"

   Replace the following:

   • VM_NAME: the name of the VM
   • ZONE: the zone where the VM is located

   The output is similar to the following:

   EMAIL: ['XXXXXXXX-compute@developer.gserviceaccount.com']

   Note the email of the service account.

4. Check if the service account is enabled by running the following query:

   gcloud logging read --freshness=90d "SERVICE_ACCOUNT_EMAIL protoPayload.methodName=google.iam.admin.v1.DisableServiceAccount"

   ReplaceSERVICE_ACCOUNT_EMAIL with the email addressassociated with the VM's service account.

   The output is similar to the following:

   insertId: 1ne5thkf13sxeclogName: projects/testproject/logs/cloudaudit.googleapis.com%2FactivityprotoPayload: '@type': type.googleapis.com/google.cloud.audit.AuditLogauthenticationInfo:principalEmail: principalemail@google.comprincipalSubject: user:pricipalemail@google.comauthorizationInfo: granted: truepermission: iam.serviceAccounts.disableresource: projects/-/serviceAccounts/XXXXXXXXXXXXXXresourceAttributes:  name: projects/-/serviceAccounts/XXXXXXXXXXXXXXXXmethodName: google.iam.admin.v1.DisableServiceAccountrequest:'@type': type.googleapis.com/google.iam.admin.v1.DisableServiceAccountRequestname: projects/testproject/serviceAccounts/-compute@developer.gserviceaccount.comrequestMetadata: destinationAttributes: {} requestAttributes:   auth: {}   time: '2024-01-25T21:37:55.748811275Z'resourceName: projects/-/serviceAccounts/XXXXXXXXXXresponse: '@type': type.googleapis.com/google.protobuf.Empty serviceName: iam.googleapis.com status: {}receiveTimestamp: '2024-01-25T21:37:56.409675900Z'resource:labels: email_id:-compute@developer.gserviceaccount.com project_id: testproject unique_id: 'XXXXXXXXXXXXXXXX'type: service_accountseverity: NOTICEtimestamp: '2024-01-25T21:37:55.721215307Z'

   If the service account isn't enabled,re-enable it.

After you have re-enabled the service account, try to register the licenseby following the instructions in themanually register licensesection of this document.