Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.
Bug 1347871 - Fluentd needs specific rollover date formatting in /var/log/messages
Fluentd needs specific rollover date formatting in /var/log/messages
Status: CLOSED ERRATA
Product: OpenShift Container Platform
Classification: Red Hat
Component: Logging (Show other bugs)
3.2.0
Unspecified Unspecified
medium Severity medium
: ---
: ---
Assigned To: ewolinet
chunchen
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2016-06-17 17:58 EDT by Eric Jones
Modified: 2017-03-08 13 EST (History)
8 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Cause: When reading in rolled over log messages into Fluentd, if the rolled over file name wasn't in a specific format Fluentd would fail while processing the date for that record. This was to adjust for a gap where logs from the previous year would be interpreted as logs that take place in the future since there was not a year field on the log records. Consequence: Loss of log records Fix: In addition to container logs, Fluentd will only read in records from /var/log/messages instead /var/log/messages* Result: Fluentd will no longer read in log records from rolled over files.
Story Points: ---
Clone Of:
Environment:
Last Closed: 2016-09-27 05:38:24 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2016:1933 normal SHIPPED_LIVE Red Hat OpenShift Container Platform 3.3 Release Advisory 2016-09-27 09:24:36 EDT

  None (edit)
Description Eric Jones 2016-06-17 17:58:04 EDT
Description of problem:
In /var/log/messages, fluentD is looking for a rollover date format similar to 'messages-20160613' but if it is anything else it will create errors and will not pass the logs through the system.

Elastic Search Will appear to pass logs along but Fluentd logs will look like the following:
2016-06-17 04:13:00 -0400 [warn]: failed to expand `%Q[#{ Time.at(time) > Time.now ? (temp_time = Time.parse(Time.at(time).to_s.gsub(Time.at(time).year.to_s, (tag_parts[3].nil? ? Time.at(time).year.to_s : tag_parts[3][9,4]) )).to_datetime.to_s; Time.parse(temp_time) > Time.now ? Time.parse(temp_time.gsub(Time.parse(temp_time).year.to_s, (Time.parse(temp_time).year - 1).to_s )).to_datetime.to_s : Time.parse(temp_time).to_datetime.to_s ) : Time.at(time).to_datetime.to_s }]` error_class=TypeError error="no implicit conversion of nil into String"
  2016-06-17 04:13:00 -0400 [warn]: suppressed same stacktrace

Which looks similar to https://bugzilla.redhat.com/show_bug.cgi?id=1347368 but is different because the systems are on GMT timezone.
Comment 3 Paul Weil 2016-08-03 11:27:31 EDT
merged in https://github.com/openshift/origin-aggregated-logging/pull/202.  Moving to modified
Comment 4 Troy Dawson 2016-08-03 15:06:11 EDT
This has been merged and is in OSE v3.3.0.14 or newer.
Comment 7 Troy Dawson 2016-08-03 15:38:09 EDT
I jumped the gun on this.  It hasn't been pulled in yet.  Dropping this back down to Modified.
Comment 11 Xia Zhao 2016-08-11 05:02:31 EDT
Was blocked by https://bugzilla.redhat.com/show_bug.cgi?id=1366137
Comment 12 Xia Zhao 2016-08-18 23:32:02 EDT
blocked by https://bugzilla.redhat.com/show_bug.cgi?id=1368301
Comment 16 errata-xmlrpc 2016-09-27 05:38:24 EDT
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2016:1933

Note You need to log in before you can comment on or make changes to this bug.