Uploaded image for project: 'OpenShift Logging'
  1. OpenShift Logging
  2. LOG-3630

[release-5.5] Inconsistencies in vector normalization of systemd logs.

XMLWordPrintable

    • False
    • None
    • False
    • NEW
    • Release Notes
    • VERIFIED
    • Before this update, the `priority` field was missing from `systemd` logs due to an error in how the collector set `level` fields. With this update, these fields are set correctly, resolving the issue.
    • Bug Fix
    • Proposed
    • Hide

      See description

      Show
      See description
    • Log Collection - Sprint 232
    • Moderate

      Description of problem:

      1. The PRIORITY field is missing from systemd infrastructure logs.
      2. The "level" field is not set based on the systemd priority.
      3. When the level cannot be calculated, the "level" field is set to "default".
        It should be "unknown"

      Version-Release number of selected component (if applicable):

      logging 5.5.

      How reproducible:

      100%

      Steps to Reproduce:

      Examine infra node logs on a cluster. Here's an example:

       {
        "@timestamp": "2022-12-13T21:10:12.178209Z",
        "hostname": "master-0.sno-1.hqlab.lan",
        "level": "default",
        "log_type": "infrastructure",
        "message": "No valid linuxptp status.",
        "openshift": {
          "labels": {
            "cluster": "sno-1",
            "clustertype": "spoke",
            "datacenter": "WC Lab",
            "geolocation": "",
            "region": ""
          }
        },
        "systemd": {
          "t": {
            "BOOT_ID": "4a9a8ef5a673411cb4ab6d01b843fc31",
            "CAP_EFFECTIVE": "ffffffffff",
            "COMM": "logger",
            "GID": "0",
            "MACHINE_ID": "6260e1eb1fca4c88bfb36fd5366a3d3f",
            "PID": "1211325",
            "SELINUX_CONTEXT": "system_u:system_r:unconfined_service_t:s0",
            "TRANSPORT": "syslog",
            "UID": "0"
          },
          "u": {
            "SYSLOG_FACILITY": "5",
            "SYSLOG_IDENTIFIER": "ptp-chronyd"
          }
        },
        "tag": ".journal.system",
        "time": "2022-12-13T21:10:12+00:00"
      }

      Actual results:

      • No PRIORITY
      • "level": "default"

      Expected results:

      PRIORITY and level set, e.g.

      • "PRIORITY": "3"
      • "level": "error"

      Not relevant for systemd logs but for other logs that the collector can't categorize, "level": "unknown", not "default"

      Additional info:

            jcantril@redhat.com Jeffrey Cantrill
            rhn-engineering-aconway Alan Conway
            Ishwar Kanse Ishwar Kanse
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated:
              Resolved: