Bug 1460724 - SYSLOG_IDENTIFIER is different
SYSLOG_IDENTIFIER is different
Status: ASSIGNED
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: sssd (Show other bugs)
7.4
Unspecified Unspecified
unspecified Severity unspecified
: rc
: ---
Assigned To: SSSD Maintainers
Madhuri
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2017-06-12 10:00 EDT by Madhuri
Modified: 2017-08-21 06:24 EDT (History)
9 users (show)

See Also:
Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Madhuri 2017-06-12 10:00:21 EDT
Description of problem:
SYSLOG_IDENTIFIER is different

Version-Release number of selected component (if applicable):
sssd-1.15.2-43.el7.x86_64

How reproducible:
Always

Steps to Reproduce:
1. Edit the /etc/systemd/system/sssd.service.d/journal.conf.
2. Set "debug_level = 9" in all sssd section.
3. #systemctl daemon-reload.
4. Restart the sssd.
5. check SYSLOG_IDENTIFIER. 

Actual results:
SYSLOG_IDENTIFIER is sssd for all responder .

# journalctl -r --output=json | head -n1
{ "__CURSOR" : "s=ba4284a74f264f70a04df4abbad7dd66;i=4d3c;b=44fa6a20417849b38e434e437ba7081a;m=537d78c390;t=551c28926743e;x=d175c6fdfdb4f440", "__REALTIME_TIMESTAMP" : "1497270850057278", "__MONOTONIC_TIMESTAMP" : "358587351952", "_BOOT_ID" : "44fa6a20417849b38e434e437ba7081a", "_TRANSPORT" : "stdout", "PRIORITY" : "6", "SYSLOG_FACILITY" : "3", "SYSLOG_IDENTIFIER" : "sssd", "_UID" : "0", "_GID" : "0", "_COMM" : "sssd", "_EXE" : "/usr/sbin/sssd", "_CMDLINE" : "/usr/sbin/sssd -i", "_CAP_EFFECTIVE" : "1fffffffff", "_SYSTEMD_CGROUP" : "/system.slice/sssd.service", "_SYSTEMD_UNIT" : "sssd.service", "_SYSTEMD_SLICE" : "system.slice", "_SELINUX_CONTEXT" : "system_u:system_r:init_t:s0", "_MACHINE_ID" : "9b03e1ea405a5c2855cd1e9599d5c2a6", "_HOSTNAME" : "client_multiple.example.com", "_PID" : "25171", "MESSAGE" : "(Mon Jun 12 08:34:09 2017) [sssd[nss]] [client_close_fn] (0x2000): Terminated client [0x55d6410b6c70][20]" }

Expected results:
SYSLOG_IDENTIFIER for nss responder should sssd_nss or sssd_pam for pam responder.

Additional info:
Comment 3 Lukas Slebodnik 2017-06-13 04:35:32 EDT
We still kind of log to journald but log messages are not structured as before.
Because we log to stdout/err and systemd forward logs to journald. This is a reason why SYSLOG_IDENTIFIER has a wrong value and MESSAGE contain timestamp generated by sssd.

We are not able to log directly into journald with interactive mode. we might need to introduce new command line option. Or use more complicated template for loggind into journald.

[Service]
# Uncomment following lines to enable debug logging
# to go to journald instead of /var/log/sssd. You will need to
# run 'systemctl daemon-reload' and then restart the SSSD service
# for this to take effect
#ExecStart=
#ExecStart=/usr/sbin/sssd -D
#NotifyAccess=all
#PIDFile=/var/run/sssd.pid
Comment 6 Jakub Hrozek 2017-06-15 10:22:56 EDT
Upstream ticket:
https://pagure.io/SSSD/sssd/issue/3433

Note You need to log in before you can comment on or make changes to this bug.