Uploaded image for project: 'OpenShift Logging'
  1. OpenShift Logging
  2. LOG-3429

Inconsistencies in vector normalization of systemd logs.

XMLWordPrintable

    • False
    • None
    • False
    • NEW
    • Release Notes
    • VERIFIED
    • * Before this update, the collector did not set `level` fields correctly based on priority for systemd logs. With this update, `level` fields are set correctly.
    • Bug Fix
    • Done
    • Hide

      See description

      Show
      See description
    • Log Collection - Sprint 229, Log Collection - Sprint 230, Log Collection - Sprint 231, Log Collection - Sprint 232
    • Moderate

      Description of problem:

      1. The PRIORITY field is missing from systemd infrastructure logs.
      2. The "level" field is not set based on the systemd priority.
      3. When the level cannot be calculated, the "level" field is set to "default".
        It should be "unknown"

      Version-Release number of selected component (if applicable):

      logging 5.5.

      How reproducible:

      100%

      Steps to Reproduce:

      Examine infra node logs on a cluster. Here's an example:

       {
        "@timestamp": "2022-12-13T21:10:12.178209Z",
        "hostname": "master-0.sno-1.hqlab.lan",
        "level": "default",
        "log_type": "infrastructure",
        "message": "No valid linuxptp status.",
        "openshift": {
          "labels": {
            "cluster": "sno-1",
            "clustertype": "spoke",
            "datacenter": "WC Lab",
            "geolocation": "",
            "region": ""
          }
        },
        "systemd": {
          "t": {
            "BOOT_ID": "4a9a8ef5a673411cb4ab6d01b843fc31",
            "CAP_EFFECTIVE": "ffffffffff",
            "COMM": "logger",
            "GID": "0",
            "MACHINE_ID": "6260e1eb1fca4c88bfb36fd5366a3d3f",
            "PID": "1211325",
            "SELINUX_CONTEXT": "system_u:system_r:unconfined_service_t:s0",
            "TRANSPORT": "syslog",
            "UID": "0"
          },
          "u": {
            "SYSLOG_FACILITY": "5",
            "SYSLOG_IDENTIFIER": "ptp-chronyd"
          }
        },
        "tag": ".journal.system",
        "time": "2022-12-13T21:10:12+00:00"
      }

      Actual results:

      • No PRIORITY
      • "level": "default"

      Expected results:

      PRIORITY and level set, e.g.

      • "PRIORITY": "3"
      • "level": "error"

      Not relevant for systemd logs but for other logs that the collector can't categorize, "level": "unknown", not "default"

      Additional info:

              jcantril@redhat.com Jeffrey Cantrill
              rhn-engineering-aconway Alan Conway
              Ishwar Kanse Ishwar Kanse
              Votes:
              3 Vote for this issue
              Watchers:
              10 Start watching this issue

                Created:
                Updated:
                Resolved: