Bug 1504583 - Fluent failed to gather docker event logs
Summary: Fluent failed to gather docker event logs
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Logging
Version: 3.7.0
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: ---
: 3.7.0
Assignee: Josef Karasek
QA Contact: Anping Li
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-10-20 09:28 UTC by Anping Li
Modified: 2017-11-28 22:18 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
This was an internal only bug found by our QE. It was never released to any customer. Fluentd plugin that reads the audit.log file enriched log lines with a value sourced from the environment. This value was inherently immutable, which caused a conversion problem during further processing.
Clone Of:
Environment:
Last Closed: 2017-11-28 22:18:08 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)
The fluent logs (6.49 KB, application/x-gzip)
2017-10-20 09:28 UTC, Anping Li
no flags Details


Links
System ID Private Priority Status Summary Last Updated
Github openshift origin-aggregated-logging pull 727 0 None closed Docker audit 2020-09-21 22:58:24 UTC
Red Hat Product Errata RHSA-2017:3188 0 normal SHIPPED_LIVE Moderate: Red Hat OpenShift Container Platform 3.7 security, bug, and enhancement update 2017-11-29 02:34:54 UTC

Description Anping Li 2017-10-20 09:28:13 UTC
Created attachment 1341178 [details]
The fluent logs

Description of problem:
The flunet report error when gather docker event logs.

Version-Release number of selected component (if applicable):
A fluent images build from origin-aggregated-logging:master

How reproducible:
Always

Steps to Reproduce:
1. Enable docker event
openshift_logging_fluentd_audit_container_engine=true
openshift_logging_fluentd_audit_file=/var/log/audit/audit.log
openshift_logging_fluentd_audit_pos_file=/var/log/audit/audit.log.pos

2. check the fluned logs after deployed

Actual results:
  2017-10-20 05:09:59 -0400 [warn]: suppressed same stacktrace
2017-10-20 05:10:01 -0400 [warn]: emit transaction failed: error_class=RuntimeError error="can't modify frozen String" tag="audit.log"
  2017-10-20 05:10:01 -0400 [warn]: suppressed same stacktrace
2017-10-20 05:10:01 -0400 [warn]: emit transaction failed: error_class=RuntimeError error="can't modify frozen String" tag="audit.log"
  2017-10-20 05:10:01 -0400 [warn]: suppressed same stacktrace
2017-10-20 05:10:06 -0400 [warn]: emit transaction failed: error_class=RuntimeError error="can't modify frozen String" tag="audit.log"
  2017-10-20 05:10:06 -0400 [warn]: suppressed same stacktrace
2017-10-20 05:10:06 -0400 [warn]: emit transaction failed: error_class=RuntimeError error="can't modify frozen String" tag="audit.log"
  2017-10-20 05:10:06 -0400 [warn]: suppressed same stacktrace
2017-10-20 05:10:09 -0400 [warn]: emit transaction failed: error_class=RuntimeError error="can't modify frozen String" tag="audit.log"
  2017-10-20 05:10:09 -0400 [warn]: suppressed same stacktrace
2017-10-20 05:10:09 -0400 [warn]: emit transaction failed: error_class=RuntimeError error="can't modify frozen String" tag="audit.log"
  2017-10-20 05:10:09 -0400 [warn]: suppressed same stacktrace
2017-10-20 05:10:11 -0400 [warn]: emit transaction failed: error_class=RuntimeError error="can't modify frozen String" tag="audit.log"
  2017-10-20 05:10:11 -0400 [warn]: suppressed same stacktrace
2017-10-20 05:10:11 -0400 [warn]: emit transaction failed: error_class=RuntimeError error="can't modify frozen String" tag="audit.log"
  2017-10-20 05:10:11 -0400 [warn]: suppressed same stacktrace


Expected results:
The docker event logs can be gathered and sent to ES.


Additional info:

Comment 2 Rich Megginson 2017-10-25 01:39:45 UTC
koji_builds:
  https://brewweb.engineering.redhat.com/brew/buildinfo?buildID=612936
repositories:
  brew-pulp-docker01.web.prod.ext.phx2.redhat.com:8888/openshift3/logging-fluentd:rhaos-3.7-rhel-7-docker-candidate-79931-20171025012405
  brew-pulp-docker01.web.prod.ext.phx2.redhat.com:8888/openshift3/logging-fluentd:latest
  brew-pulp-docker01.web.prod.ext.phx2.redhat.com:8888/openshift3/logging-fluentd:v3.7.0
  brew-pulp-docker01.web.prod.ext.phx2.redhat.com:8888/openshift3/logging-fluentd:v3.7.0-0.177.0.1
  brew-pulp-docker01.web.prod.ext.phx2.redhat.com:8888/openshift3/logging-fluentd:v3.7

Comment 3 Anping Li 2017-10-30 08:36:18 UTC
The bug have been fixed in logging-fluentd:v3.7.0-0.185.0.0

Comment 6 errata-xmlrpc 2017-11-28 22:18:08 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2017:3188


Note You need to log in before you can comment on or make changes to this bug.