Red Hat Bugzilla – Bug 1504583
Fluent failed to gather docker event logs
Last modified: 2017-11-28 17:18:08 EST
Created attachment 1341178 [details] The fluent logs Description of problem: The flunet report error when gather docker event logs. Version-Release number of selected component (if applicable): A fluent images build from origin-aggregated-logging:master How reproducible: Always Steps to Reproduce: 1. Enable docker event openshift_logging_fluentd_audit_container_engine=true openshift_logging_fluentd_audit_file=/var/log/audit/audit.log openshift_logging_fluentd_audit_pos_file=/var/log/audit/audit.log.pos 2. check the fluned logs after deployed Actual results: 2017-10-20 05:09:59 -0400 [warn]: suppressed same stacktrace 2017-10-20 05:10:01 -0400 [warn]: emit transaction failed: error_class=RuntimeError error="can't modify frozen String" tag="audit.log" 2017-10-20 05:10:01 -0400 [warn]: suppressed same stacktrace 2017-10-20 05:10:01 -0400 [warn]: emit transaction failed: error_class=RuntimeError error="can't modify frozen String" tag="audit.log" 2017-10-20 05:10:01 -0400 [warn]: suppressed same stacktrace 2017-10-20 05:10:06 -0400 [warn]: emit transaction failed: error_class=RuntimeError error="can't modify frozen String" tag="audit.log" 2017-10-20 05:10:06 -0400 [warn]: suppressed same stacktrace 2017-10-20 05:10:06 -0400 [warn]: emit transaction failed: error_class=RuntimeError error="can't modify frozen String" tag="audit.log" 2017-10-20 05:10:06 -0400 [warn]: suppressed same stacktrace 2017-10-20 05:10:09 -0400 [warn]: emit transaction failed: error_class=RuntimeError error="can't modify frozen String" tag="audit.log" 2017-10-20 05:10:09 -0400 [warn]: suppressed same stacktrace 2017-10-20 05:10:09 -0400 [warn]: emit transaction failed: error_class=RuntimeError error="can't modify frozen String" tag="audit.log" 2017-10-20 05:10:09 -0400 [warn]: suppressed same stacktrace 2017-10-20 05:10:11 -0400 [warn]: emit transaction failed: error_class=RuntimeError error="can't modify frozen String" tag="audit.log" 2017-10-20 05:10:11 -0400 [warn]: suppressed same stacktrace 2017-10-20 05:10:11 -0400 [warn]: emit transaction failed: error_class=RuntimeError error="can't modify frozen String" tag="audit.log" 2017-10-20 05:10:11 -0400 [warn]: suppressed same stacktrace Expected results: The docker event logs can be gathered and sent to ES. Additional info:
This should be fixed by https://github.com/ViaQ/fluent-plugin-viaq_docker_audit_log_parser/commit/1f5fff420dd96f76068a081d4c48f2b4d712d02d
koji_builds: https://brewweb.engineering.redhat.com/brew/buildinfo?buildID=612936 repositories: brew-pulp-docker01.web.prod.ext.phx2.redhat.com:8888/openshift3/logging-fluentd:rhaos-3.7-rhel-7-docker-candidate-79931-20171025012405 brew-pulp-docker01.web.prod.ext.phx2.redhat.com:8888/openshift3/logging-fluentd:latest brew-pulp-docker01.web.prod.ext.phx2.redhat.com:8888/openshift3/logging-fluentd:v3.7.0 brew-pulp-docker01.web.prod.ext.phx2.redhat.com:8888/openshift3/logging-fluentd:v3.7.0-0.177.0.1 brew-pulp-docker01.web.prod.ext.phx2.redhat.com:8888/openshift3/logging-fluentd:v3.7
The bug have been fixed in logging-fluentd:v3.7.0-0.185.0.0
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2017:3188