-
Bug
-
Resolution: Done-Errata
-
Major
-
Logging 6.1.1
-
False
-
None
-
False
-
NEW
-
NEW
-
Prior to this update the collector did not properly mount the oauth-apiserver audit log file and these audit logs were not being collected. After this update the volume mount is present and logs are collected as expected.
-
Bug Fix
-
-
-
Log Collection - Sprint 265
-
Important
Description of problem:
When checking the log files in collector pods, the files in `/var/log/oauth-apiserver/` don't match the files in the node:
% oc get node ip-10-0-30-186.us-east-2.compute.internal
NAME STATUS ROLES AGE VERSION
ip-10-0-30-186.us-east-2.compute.internal Ready control-plane,master 113m v1.31.3
% oc get pod clf-74397-xv45m -owide
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
clf-74397-xv45m 1/1 Running 0 116s 10.128.0.93 ip-10-0-30-186.us-east-2.compute.internal <none> <none>
sh-5.1# ls -l /var/log/oauth-apiserver/
/var/log/oauth-apiserver/:
total 0
-rw-r-----. 1 root root 0 Dec 20 00:40 acl-audit-log.log
-rw-r-----. 1 root root 0 Dec 20 00:40 ovsdb-server-nb.log
-rw-r-----. 1 root root 0 Dec 20 00:40 ovsdb-server-sb.log
% oc debug nodes/ip-10-0-30-186.us-east-2.compute.internal sh-5.1# chroot /host sh-5.1# ls -l /var/log/oauth-apiserver/ /var/log/ovn/
/var/log/oauth-apiserver/: total 3264 -rw-------. 1 root root 2612061 Dec 20 02:25 audit.log /var/log/ovn/: total 0 -rw-r-----. 1 root root 0 Dec 20 00:40 acl-audit-log.log -rw-r-----. 1 root root 0 Dec 20 00:40 ovsdb-server-nb.log -rw-r-----. 1 root root 0 Dec 20 00:40 ovsdb-server-sb.log
The logs under `/var/log/oauth-apiserver/` directory are not collected.
Version-Release number of selected component (if applicable):
cluster-logging-rhel9-operator/images/v6.1.1-7
How reproducible:
Always
Steps to Reproduce:
- Deploy collector pods to forward app, infra and audit logs
- Compare the files in collector pod and node
Actual results:
In collector pod:
/var/log/oauth-apiserver/:
total 0
-rw-r-----. 1 root root 0 Dec 20 00:40 acl-audit-log.log
-rw-r-----. 1 root root 0 Dec 20 00:40 ovsdb-server-nb.log
-rw-r-----. 1 root root 0 Dec 20 00:40 ovsdb-server-sb.log
In node:
/var/log/oauth-apiserver/:
total 3264
-rw-------. 1 root root 2612061 Dec 20 02:25 audit.log
Expected results:
In collector pod:
/var/log/oauth-apiserver/:
total 3264
-rw-------. 1 root root 2612061 Dec 20 02:25 audit.log
Additional info:
- is cloned by
-
-
- MODIFIED
-
-
-
- Closed
-
- links to
-
RHBA-2024:10992
Logging for Red Hat OpenShift - 6.1.1