Uploaded image for project: 'OpenShift Logging'
  1. OpenShift Logging
  2. LOG-3630

[release-5.5] Inconsistencies in vector normalization of systemd logs.

    XMLWordPrintable

Details

    • False
    • None
    • False
    • NEW
    • Release Notes
    • VERIFIED
    • Before this update, the `priority` field was missing from `systemd` logs due to an error in how the collector set `level` fields. With this update, these fields are set correctly, resolving the issue.
    • Bug Fix
    • Proposed
    • Hide

      See description

      Show
      See description
    • Log Collection - Sprint 232
    • Moderate

    Description

      Description of problem:

      1. The PRIORITY field is missing from systemd infrastructure logs.
      2. The "level" field is not set based on the systemd priority.
      3. When the level cannot be calculated, the "level" field is set to "default".
        It should be "unknown"

      Version-Release number of selected component (if applicable):

      logging 5.5.

      How reproducible:

      100%

      Steps to Reproduce:

      Examine infra node logs on a cluster. Here's an example:

       {
        "@timestamp": "2022-12-13T21:10:12.178209Z",
        "hostname": "master-0.sno-1.hqlab.lan",
        "level": "default",
        "log_type": "infrastructure",
        "message": "No valid linuxptp status.",
        "openshift": {
          "labels": {
            "cluster": "sno-1",
            "clustertype": "spoke",
            "datacenter": "WC Lab",
            "geolocation": "",
            "region": ""
          }
        },
        "systemd": {
          "t": {
            "BOOT_ID": "4a9a8ef5a673411cb4ab6d01b843fc31",
            "CAP_EFFECTIVE": "ffffffffff",
            "COMM": "logger",
            "GID": "0",
            "MACHINE_ID": "6260e1eb1fca4c88bfb36fd5366a3d3f",
            "PID": "1211325",
            "SELINUX_CONTEXT": "system_u:system_r:unconfined_service_t:s0",
            "TRANSPORT": "syslog",
            "UID": "0"
          },
          "u": {
            "SYSLOG_FACILITY": "5",
            "SYSLOG_IDENTIFIER": "ptp-chronyd"
          }
        },
        "tag": ".journal.system",
        "time": "2022-12-13T21:10:12+00:00"
      }

      Actual results:

      • No PRIORITY
      • "level": "default"

      Expected results:

      PRIORITY and level set, e.g.

      • "PRIORITY": "3"
      • "level": "error"

      Not relevant for systemd logs but for other logs that the collector can't categorize, "level": "unknown", not "default"

      Additional info:

      Attachments

        Issue Links

          Activity

            People

              jcantril@redhat.com Jeffrey Cantrill
              rhn-engineering-aconway Alan Conway
              Ishwar Kanse Ishwar Kanse
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: