Bug 1799024

Summary: Could not forward logs to rsyslog server
Product: OpenShift Container Platform Reporter: Anping Li <anli>
Component: LoggingAssignee: Jeff Cantrill <jcantril>
Status: CLOSED ERRATA QA Contact: Anping Li <anli>
Severity: high Docs Contact:
Priority: medium    
Version: 4.3.0CC: aos-bugs, mburke, mfuruta, ocasalsa, ohiroaki, ykawada
Target Milestone: ---   
Target Release: 4.4.0   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Cause: Introduction of LogForwarding API modified the previous manor in which fluentd was configured Consequence: The previous way to enable the feature was no longer being respected. Fix: Add a mechanism for user's to enable log forwarding in a manor that is similar to the previous enablement Result: Using forward via syslog outside of LogForwarding feature is supported.
 Story Points: ---
Clone Of:
: 1800809 1812918 (view as bug list) Environment:
Last Closed: 2020-05-13 21:56:28 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1800809, 1812918, 1824003    
Attachments:
Description Flags
configuration and Logs when use out_rsyslog
none
configuration and Logs when use out_rsyslog_bufferred none

Description Anping Li 2020-02-06 13:32:10 UTC 
Description of problem:
The fluentd couldn't forward logs to remote rsyslog server. Both in method rsyslog and rsyslog_buffered.

Logs can be sent to my rsyslog server from rsyslog client.

Version-Release number of selected component (if applicable):

image: quay.io/openshift/origin-logging-fluentd:latest
imageID: quay.io/openshift/origin-logging-fluentd@sha256:6e42d1047fb3c9cbf2e6e0723f071112ec8cc33b9835cbbc6efb65a96848e7d6



How reproducible:
Always

Steps to Reproduce:
1. Workaround to OLM
   #create catalogsource pod.
echo 'apiVersion: operators.coreos.com/v1alpha1
kind: CatalogSource
metadata:
  name: qe-app-registry
  namespace: openshift-marketplace
spec:
  sourceType: grpc
  image: docker.io/anli/csc:upstream' | oc create -f -

2. Deploy cluster-logging.
   note: subscript to qe-app-registry
3. Set clusterlogging to unmanged status
4. Create rsyslog server on same cluster.
   4.1. https://github.com/openshift-qe/v3-testfiles/blob/master/logging/rsyslogserver/01_createsa.sh
   4.2. https://github.com/openshift-qe/v3-testfiles/blob/master/logging/rsyslogserver/02_creatersyslogserver.sh

5. Conifure fluentd to send logs to rsyslog server
    5.a https://github.com/openshift-qe/v3-testfiles/blob/master/logging/rsyslogserver/03_out_buffer_rsyslog_updateds.sh
    5.b https://github.com/openshift-qe/v3-testfiles/blob/master/logging/rsyslogserver/03_out_rsyslog_updateds.sh

6. check the output on rsyslog server

Actual results:

No output in the rsyslog server

Expected results:


Additional info:
Comment 1 Anping Li 2020-02-06 13:37:51 UTC 
Created attachment 1658204 [details]
configuration and Logs when use  out_rsyslog
Comment 2 Anping Li 2020-02-06 13:38:31 UTC 
Created attachment 1658205 [details]
configuration and Logs when use  out_rsyslog_bufferred
Comment 4 Jeff Cantrill 2020-02-06 15:21:31 UTC 
This is unrelated, at least initially, to ipv6.  Logforwarding changes clobbers legacy rsyslog
Comment 5 Michael Burke 2020-02-10 20:03:02 UTC 
Anping -- The two files you attached are identical. Did you post the syslog_buffered file twice?

Michael
Comment 6 Anping Li 2020-02-11 13:46:14 UTC 
Yes, The configuration and Logs when use out_rsyslog is wrong.  Please ignore it.
Comment 9 Anping Li 2020-02-18 14:43:16 UTC 
Verified on quay.io/openshift/origin-cluster-logging-operator:latest on IPv6
Verified on openshift/ose-cluster-logging-operator:v4.4.0
Comment 10 Anping Li 2020-03-15 10:46:22 UTC 
*** Bug 1812918 has been marked as a duplicate of this bug. ***
Comment 12 errata-xmlrpc 2020-05-13 21:56:28 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:0581