Uploaded image for project: 'OpenShift Logging'
  1. OpenShift Logging
  2. LOG-3429

Inconsistencies in vector normalization of systemd logs.

    XMLWordPrintable

Details

    • False
    • None
    • False
    • NEW
    • Release Notes
    • VERIFIED
    • * Before this update, the collector did not set `level` fields correctly based on priority for systemd logs. With this update, `level` fields are set correctly.
    • Bug Fix
    • Done
    • Hide

      See description

      Show
      See description
    • Log Collection - Sprint 229, Log Collection - Sprint 230, Log Collection - Sprint 231, Log Collection - Sprint 232
    • Moderate

    Description

      Description of problem:

      1. The PRIORITY field is missing from systemd infrastructure logs.
      2. The "level" field is not set based on the systemd priority.
      3. When the level cannot be calculated, the "level" field is set to "default".
        It should be "unknown"

      Version-Release number of selected component (if applicable):

      logging 5.5.

      How reproducible:

      100%

      Steps to Reproduce:

      Examine infra node logs on a cluster. Here's an example:

       {
        "@timestamp": "2022-12-13T21:10:12.178209Z",
        "hostname": "master-0.sno-1.hqlab.lan",
        "level": "default",
        "log_type": "infrastructure",
        "message": "No valid linuxptp status.",
        "openshift": {
          "labels": {
            "cluster": "sno-1",
            "clustertype": "spoke",
            "datacenter": "WC Lab",
            "geolocation": "",
            "region": ""
          }
        },
        "systemd": {
          "t": {
            "BOOT_ID": "4a9a8ef5a673411cb4ab6d01b843fc31",
            "CAP_EFFECTIVE": "ffffffffff",
            "COMM": "logger",
            "GID": "0",
            "MACHINE_ID": "6260e1eb1fca4c88bfb36fd5366a3d3f",
            "PID": "1211325",
            "SELINUX_CONTEXT": "system_u:system_r:unconfined_service_t:s0",
            "TRANSPORT": "syslog",
            "UID": "0"
          },
          "u": {
            "SYSLOG_FACILITY": "5",
            "SYSLOG_IDENTIFIER": "ptp-chronyd"
          }
        },
        "tag": ".journal.system",
        "time": "2022-12-13T21:10:12+00:00"
      }

      Actual results:

      • No PRIORITY
      • "level": "default"

      Expected results:

      PRIORITY and level set, e.g.

      • "PRIORITY": "3"
      • "level": "error"

      Not relevant for systemd logs but for other logs that the collector can't categorize, "level": "unknown", not "default"

      Additional info:

      Attachments

        Activity

          People

            jcantril@redhat.com Jeffrey Cantrill
            rhn-engineering-aconway Alan Conway
            Ishwar Kanse Ishwar Kanse
            Votes:
            3 Vote for this issue
            Watchers:
            10 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: