Bug 2216795

Summary: [OSP 16] default logrotate-crond templates could lead to premature logs purge
Product: Red Hat OpenStack Reporter: Flavio Piccioni <fpiccion>
Component: openstack-tripleo-heat-templatesAssignee: OSP Team <rhos-maint>
Status: NEW --- QA Contact: Joe H. Rahme <jhakimra>
Severity: medium Docs Contact:
Priority: unspecified    
Version: 16.2 (Train)CC: bshephar, mburns, shtiwari, tkajinam
Target Milestone: ---Keywords: Documentation, Triaged
Target Release: ---Flags: tkajinam: needinfo? (shtiwari)
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Flavio Piccioni 2023-06-22 15:27:57 UTC 
Description of problem:

default logrotate-crond-container-puppet.yaml template...:

parameter_defaults
  LogrotateRotate: '14'
  LogrotatePurgeAfterDays: '14'
  LogrotateMaxsize: '10M'

...is going to configure logrotate using:

  daily
  rotate 14
  maxage 14
  minsize 1
  maxsize 10M
  missingok
  notifempty
  copytruncate
  delaycompress
  compress


According to our docs:
The following example (about default templates) forces the logrotate task to create a new log file when it reaches 10 megabytes and retains the log file for 14 days.

So basically customers are expecting 14 days of log retention to be honored.
This is not going to happen in case of heavy-logging services (control plane nova's units, for example), with rotate that is being caused by the maxsize.

So basically we'll have just 14 rotated logs covering 14 hours that will be purged within 1 day.

Version-Release number of selected component (if applicable):
openstack-tripleo-heat-templates

How reproducible:
just let logrotate-crond with default settings to handle heavy-logging services logs


Actual results:
heavy-logging services logs to be rotate 14 times within 14 hours, then purged.

Expected results:
14 days retention (LogrotatePurgeAfterDays) to be honored regardless maxsize or slightly update docs in order to give customers explanation about how default template's parameters are going to interact (interfere?) each other in case of heavy-logging services
 
Additional info:
Not sure if, for example, adopting something like LogrotateRotate: (LogrotatePurgeAfterDays*24) could be a good strategy.

Using rotate 336 (maxage*24h, where maxage is the LogrotatePurgeAfterDays logrotate config value) will ensure customers to have the 14 days worth of logs.