Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1543761

Summary: openshift_logging_fluentd_remote_syslog_use_record=true is dysfunctional
Product: OpenShift Container Platform Reporter: Junqi Zhao <juzhao>
Component: LoggingAssignee: Noriko Hosoi <nhosoi>
Status: CLOSED DUPLICATE QA Contact: Anping Li <anli>
Severity: medium Docs Contact:
Priority: medium    
Version: 3.9.0CC: aos-bugs, jcantril, rmeggins, wsun
Target Milestone: ---   
Target Release: 3.9.z   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2018-03-08 01:51:26 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Junqi Zhao 2018-02-09 09:03:45 UTC 
Description of problem:
Sent logs to remote syslog server, set the following parameters

openshift_logging_fluentd_remote_syslog=true
openshift_logging_fluentd_remote_syslog_host=172.18.9.41
openshift_logging_fluentd_remote_syslog_use_record=true
openshift_logging_fluentd_remote_syslog_severity=info
openshift_logging_fluentd_remote_syslog_facility=local3

set different syslog_facility and syslog_severity with the above settings,
in this case it's local0.notice
$ logger -t newYear -p local0.notice happy_new_year

Checked the  syslog_facility and syslog_severity, it should be "local0 notice",
but it is "local3 info".

# cat /var/log/rsyslog.log | grep -i year
local3 info Feb  9 03:21:58 logging-fluentd-pzgrk output_tag: happy_new_year [[<158>Feb  9 03:21:58 logging-fluentd-pzgrk output_tag: happy_new_year]]

The output_tag is also wrong, it should be newYear in this case, which we already reported to
https://bugzilla.redhat.com/show_bug.cgi?id=1515715

Version-Release number of selected component (if applicable):
logging-elasticsearch/images/v3.9.0-0.41.0.0
logging-curator/images/v3.9.0-0.41.0.0
logging-kibana/images/v3.9.0-0.41.0.0
logging-fluentd/images/v3.9.0-0.41.0.0
logging-auth-proxy/images/v3.9.0-0.41.0.0

How reproducible:
Always

Steps to Reproduce:
1. Sent logs to remote syslog server
Configured remote syslog server via /etc/rsyslog.conf, port is opened.
$ModLoad imudp
$UDPServerRun 514
$ModLoad imtcp
$InputTCPServerRun 514
......
$template RFC3164fmt,"%syslogfacility-text% %syslogseverity-text% %TIMESTAMP% %HOSTNAME% %syslogtag%%msg% [[%rawmsg%]]\n"
*.*  /var/log/rsyslog.log;RFC3164fmt

fluentd logs will be saved to /var/log/rsyslog.log in remote syslog server

2. logger -t newYear -p local0.notice happy_new_year
3. Check /var/log/rsyslog.log

Actual results:
openshift_logging_fluentd_remote_syslog_use_record=true is dysfunctional

Expected results:
syslog_facility and syslog_severity should be as the log when openshift_logging_fluentd_remote_syslog_use_record=true

Additional info:
Comment 1 Noriko Hosoi 2018-02-09 17:08:52 UTC 
Sadly, it turned out the PR had not been merged yet, which is waiting for reviews.

https://github.com/openshift/origin-aggregated-logging/pull/909/files
bz1515715 -- remote syslog hostname

Rich, Jeff, could you review the PR?
Comment 2 Noriko Hosoi 2018-02-22 00:43:03 UTC 
(In reply to Noriko Hosoi from comment #1)
> Sadly, it turned out the PR had not been merged yet, which is waiting for
> reviews.
> 
> https://github.com/openshift/origin-aggregated-logging/pull/909/files
> bz1515715 -- remote syslog hostname
> 
> Rich, Jeff, could you review the PR?

The PR/909 was closed in favour of PR/955:
https://github.com/openshift/origin-aggregated-logging/pull/955
Comment 3 Noriko Hosoi 2018-03-08 01:51:26 UTC 

*** This bug has been marked as a duplicate of bug 1515715 ***