-
Bug
-
Resolution: Done
-
Blocker
-
Logging 5.7.0
-
1
-
False
-
None
-
False
-
NEW
-
VERIFIED
-
-
-
Log Collection - Sprint 234, Log Collection - Sprint 235
Description of problem:
While forwarding logs to rsyslog using vector, logs are being shipped even with wrong proto (and correct url), ex: url: 'xyz://rsyslogserver.openshift-logging.svc:514' , also no related error message is shown on collector pods.
Version-Release number of selected component (if applicable):
Logging 5.7
Steps to Reproduce:
- Deploy rsyslog receiver
- Create CLF with wrong url:
apiVersion: logging.openshift.io/v1
kind: ClusterLogForwarder
metadata:
name: instance
namespace: openshift-logging
spec:
outputs:
- name: rsyslog-created-by-user
type: syslog
syslog:
facility: local0
rfc: RFC3164
payloadKey: message
severity: informational
url: 'xyz://rsyslogserver.openshift-logging.svc:514'
pipelines:
- name: forward-to-external-syslog
inputRefs:
- infrastructure
- application
- audit
outputRefs:
- rsyslog-created-by-user
3. Deploy CL with vector
Actual results:
No related error message in collector pods.
Collector pod logs:
2023-04-13T12:16:48.802965Z WARN source{component_kind="source" component_id=raw_journal_logs component_type=journald component_name=raw_journal_logs}: vector::sources::journald: Journalctl process stopped.
Journal file /var/log/journal/aa59dcf94385378c01ee2e4b3cf1ee92/system.journal uses an unsupported feature, ignoring file.
Use SYSTEMD_LOG_LEVEL=debug journalctl --file=/var/log/journal/aa59dcf94385378c01ee2e4b3cf1ee92/system.journal to see the details.
Data from the specified boot (+0) is not available: No such boot ID in journal
2023-04-13T12:16:49.819104Z WARN source{component_kind="source" component_id=raw_journal_logs component_type=journald component_name=raw_journal_logs}: vector::sources::journald: Journalctl process stopped.
Journal file /var/log/journal/aa59dcf94385378c01ee2e4b3cf1ee92/system.journal uses an unsupported feature, ignoring file.
Use SYSTEMD_LOG_LEVEL=debug journalctl --file=/var/log/journal/aa59dcf94385378c01ee2e4b3cf1ee92/system.journal to see the details.
Data from the specified boot (+0) is not available: No such boot ID in journal
2023-04-13T12:16:50.823495Z WARN source{component_kind="source" component_id=raw_journal_logs component_type=journald component_name=raw_journal_logs}: vector::sources::journald: Journalctl process stopped.
Journal file /var/log/journal/aa59dcf94385378c01ee2e4b3cf1ee92/system.journal uses an unsupported feature, ignoring file.
The collector is not throwing error for a wrong protocol.
$ oc rsh collector-5tv2k Defaulted container "collector" out of: collector, logfilesmetricexporter sh-4.4# vector validate /etc/vector/vector.toml Loaded with warnings ["/etc/vector/vector.toml"] ------------------------------------------------ ~ Transform "route_container_logs._unmatched" has no consumers √ Component configuration √ Health check "rsyslog_created_by_user" √ Health check "prometheus_output" -------------------------------------------------------------- Validated
Expected results:
User should see the below error in collector pods:
ConfigError error="valid options are udp,tcp but got xyz"
Additional info: Works fine with fluentd
- links to
- mentioned on
