Bug 2045913

Summary: [DOC] Update RHV Manager documentation around sending logs to remote syslog
Product: Red Hat Enterprise Virtualization Manager Reporter: Martin Perina <mperina>
Component: DocumentationAssignee: Eli Marcus <emarcus>
Status: CLOSED CURRENTRELEASE QA Contact: rhev-docs <rhev-docs>
Severity: high Docs Contact:
Priority: high    
Version: 4.4.9CC: apinnick, ctomasko, emarcus, gdeolive, lleistne, lsurette, mhicks, michal.skrivanek, mkalinin, mtessun, pelauter, sbonazzo, snikolov, srevivo
Target Milestone: ovirt-4.4.10Keywords: Documentation
Target Release: 4.4.10   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Removed functionality
Doc Text:
The log manager extension ovirt-engine-extension-logger-log4j has been removed in this release. It has been replaced by the JBoss EAP SyslogHandler log manager.
Story Points: ---
Clone Of: 2044277
: 2046095 (view as bug list) Environment:
Last Closed: 2022-02-08 10:19:13 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: Infra RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2044277    
Bug Blocks: 2046095    

Comment 1 Martin Perina 2022-01-25 23:41:37 UTC
We have a special chapter about ovirt-engine-extension-logger-log4j configuration for existing RHV 4.4.z versions:

https://access.redhat.com/documentation/en-us/red_hat_virtualization/4.4/html/administration_guide/enabling_the_ovirt_engine_extension_logger_log4j

Because ovirt-engine-extension-logger-log4j has been obsoleted in RHV 4.4.10 and replaced by internal ovirt-engine implementation we need to update that chapter to below content:


24.8. Enabling SyslogHandler to pass RHV Manager log records to a remote syslog server

The implementation is using JBoss Log Manager SyslogHandler provided by EAP and allows passing log records from engine.log and server.log to an existing syslog server.

Note:
"""
  In RHV versions prior to RHV 4.4.10 there was a similar functionality provided by ovirt-engine-extension-logger-log4j, but this package was obsoleted in RHV 4.4.10 and replaced by  the new implementation using JBoss Log Manager. If you have been using ovirt-engine-extension-logger-log4j in previous RHV versions, then after successful upgrade to RHV 4.4.10 you need perform following steps:
  
  1. Manually configure sending log records to a remote syslog server using guidelines below in this chapter.
  2. Manually remove existing ovirt-engine-extension-logger-log4j configuration files (if you have followed the documentation, then you need to remove /etc/ovirt-engine/extensions.d/Log4jLogger.properties configuration file.
"""

Logger implementation requires the ovirt-engine-extension-logger-log4j package. With the implementation, Red Had Virtualization Manager delegates records into log4j. Log4j is a customizable framework that provides appenders for various technologies, including SNMP and syslog.

The SyslogHandler implementation passes the engine.log and server.log files to an existing syslog server. The configuration procedure overlaps with Setting up a Host Logging Server.

Use this procedure on the central syslog server. You can use a separate logging server, or use this procedure to pass the engine.log and server.log files from the Manager to the syslog server.


Configuring the SyslogHandler implementation


    Create the 90-syslog.conf file in the /etc/ovirt-engine/engine.conf.d directory and include the following contents.

      SYSLOG_HANDLER_ENABLED=true
      SYSLOG_HANDLER_SERVER_HOSTNAME=localhost
      SYSLOG_HANDLER_FACILITY=USER_LEVEL

    Install and configure rsyslog.

      # dnf install rsyslog

    Configure SELinux to allow rsyslog traffic.

      # semanage port -a -t syslogd_port_t -p udp 514

    Create /etc/rsyslog.d/rhvm.conf and add the following lines:

      user.* /var/log/jboss.log

      module(load="imudp") # needs to be done just once
      input(type="imudp" port="514")

    Restart the rsyslog service:

      # systemctl restart rsyslog.service

    If the firewall is enabled and active, run the following command to add the necessary rules for opening the rsyslog ports in Firewalld.

      # firewall-cmd --permanent --add-port=514/udp
      # firewall-cmd --reload

    Restart Red Hat Virtualization Manager.

      # systemctl restart ovirt-engine

The existing syslog server can now receive and store the engine.log files.

Comment 4 Martin Perina 2022-01-31 10:31:31 UTC
Looks good to me, thanks!

Comment 5 Eli Marcus 2022-02-08 10:19:13 UTC
verified by Martin P and Gui, 
merged and published