Bug 1799024 - Could not forward logs to rsyslog server
Summary: Could not forward logs to rsyslog server
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Logging
Version: 4.3.0
Hardware: Unspecified
OS: Unspecified
medium
high
Target Milestone: ---
: 4.4.0
Assignee: Jeff Cantrill
QA Contact: Anping Li
URL:
Whiteboard:
Depends On:
Blocks: 1800809 1812918 1824003
TreeView+ depends on / blocked
 
Reported: 2020-02-06 13:32 UTC by Anping Li
Modified: 2023-09-07 21:44 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Cause: Introduction of LogForwarding API modified the previous manor in which fluentd was configured Consequence: The previous way to enable the feature was no longer being respected. Fix: Add a mechanism for user's to enable log forwarding in a manor that is similar to the previous enablement Result: Using forward via syslog outside of LogForwarding feature is supported.
Clone Of:
: 1800809 1812918 (view as bug list)
Environment:
Last Closed: 2020-05-13 21:56:28 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)
configuration and Logs when use out_rsyslog (21.09 KB, text/plain)
2020-02-06 13:37 UTC, Anping Li
no flags Details
configuration and Logs when use out_rsyslog_bufferred (21.09 KB, text/plain)
2020-02-06 13:38 UTC, Anping Li
no flags Details


Links
System ID Private Priority Status Summary Last Updated
Github openshift cluster-logging-operator pull 359 0 None closed Bug 1799024: Enable legacy syslog support 2020-12-15 14:38:16 UTC
Red Hat Product Errata RHBA-2020:0581 0 None None None 2020-05-13 21:56:34 UTC

Description Anping Li 2020-02-06 13:32:10 UTC
Description of problem:
The fluentd couldn't forward logs to remote rsyslog server. Both in method rsyslog and rsyslog_buffered.

Logs can be sent to my rsyslog server from rsyslog client.

Version-Release number of selected component (if applicable):

image: quay.io/openshift/origin-logging-fluentd:latest
imageID: quay.io/openshift/origin-logging-fluentd@sha256:6e42d1047fb3c9cbf2e6e0723f071112ec8cc33b9835cbbc6efb65a96848e7d6



How reproducible:
Always

Steps to Reproduce:
1. Workaround to OLM
   #create catalogsource pod.
echo 'apiVersion: operators.coreos.com/v1alpha1
kind: CatalogSource
metadata:
  name: qe-app-registry
  namespace: openshift-marketplace
spec:
  sourceType: grpc
  image: docker.io/anli/csc:upstream' | oc create -f -

2. Deploy cluster-logging.
   note: subscript to qe-app-registry
3. Set clusterlogging to unmanged status
4. Create rsyslog server on same cluster.
   4.1. https://github.com/openshift-qe/v3-testfiles/blob/master/logging/rsyslogserver/01_createsa.sh
   4.2. https://github.com/openshift-qe/v3-testfiles/blob/master/logging/rsyslogserver/02_creatersyslogserver.sh

5. Conifure fluentd to send logs to rsyslog server
    5.a https://github.com/openshift-qe/v3-testfiles/blob/master/logging/rsyslogserver/03_out_buffer_rsyslog_updateds.sh
    5.b https://github.com/openshift-qe/v3-testfiles/blob/master/logging/rsyslogserver/03_out_rsyslog_updateds.sh

6. check the output on rsyslog server

Actual results:

No output in the rsyslog server

Expected results:


Additional info:

Comment 1 Anping Li 2020-02-06 13:37:51 UTC
Created attachment 1658204 [details]
configuration and Logs when use  out_rsyslog

Comment 2 Anping Li 2020-02-06 13:38:31 UTC
Created attachment 1658205 [details]
configuration and Logs when use  out_rsyslog_bufferred

Comment 4 Jeff Cantrill 2020-02-06 15:21:31 UTC
This is unrelated, at least initially, to ipv6.  Logforwarding changes clobbers legacy rsyslog

Comment 5 Michael Burke 2020-02-10 20:03:02 UTC
Anping -- The two files you attached are identical. Did you post the syslog_buffered file twice?

Michael

Comment 6 Anping Li 2020-02-11 13:46:14 UTC
Yes, The configuration and Logs when use out_rsyslog is wrong.  Please ignore it.

Comment 9 Anping Li 2020-02-18 14:43:16 UTC
Verified on quay.io/openshift/origin-cluster-logging-operator:latest on IPv6
Verified on openshift/ose-cluster-logging-operator:v4.4.0

Comment 10 Anping Li 2020-03-15 10:46:22 UTC
*** Bug 1812918 has been marked as a duplicate of this bug. ***

Comment 12 errata-xmlrpc 2020-05-13 21:56:28 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:0581


Note You need to log in before you can comment on or make changes to this bug.