Description of problem: with 4.6 Openshift master has split apart oauth resources from openshift-apiserver into a new oauth-apiserver and audit logs for those API groups go to /var/log/oauth-apiserver and not /var/log/openshift-apiserver anymore. Currently when oc adm must-gather is run does not see any logs related to oauth-apiserver collected. Version-Release number of selected component (if applicable): 4.6.0-0.nightly-2020-08-07-202945 How reproducible: Always Steps to Reproduce: 1.Install latest 4.6 cluster 2.Run oc adm must-gather 3.cd to must-gather.local.5959959629377510922/quay-io-openshift-release-dev-ocp-v4-0-art-dev-sha256-4fe3dcd31bc4b628ec26bcea6ad91af05d6fac05206b46d4961e477197b8b2b1 [ramakasturinarra@dhcp35-60 audit_logs]$ ls -l total 16 drwxr-xr-x. 2 ramakasturinarra ramakasturinarra 4096 Aug 10 21:15 kube-apiserver -rw-r--r--. 1 ramakasturinarra ramakasturinarra 2634 Aug 10 21:12 kube-apiserver.audit_logs_listing drwxr-xr-x. 2 ramakasturinarra ramakasturinarra 4096 Aug 10 21:15 openshift-apiserver -rw-r--r--. 1 ramakasturinarra ramakasturinarra 158 Aug 10 21:12 openshift-apiserver.audit_logs_listing Actual results: Do not see any directory with name oauth-apiserver and audit logs for them are not collected [ramakasturinarra@dhcp35-60 audit_logs]$ ls -l total 16 drwxr-xr-x. 2 ramakasturinarra ramakasturinarra 4096 Aug 10 21:15 kube-apiserver -rw-r--r--. 1 ramakasturinarra ramakasturinarra 2634 Aug 10 21:12 kube-apiserver.audit_logs_listing drwxr-xr-x. 2 ramakasturinarra ramakasturinarra 4096 Aug 10 21:15 openshift-apiserver -rw-r--r--. 1 ramakasturinarra ramakasturinarra 158 Aug 10 21:12 openshift-apiserver.audit_logs_listing [ramakasturinarra@dhcp35-60 quay-io-openshift-release-dev-ocp-v4-0-art-dev-sha256-4fe3dcd31bc4b628ec26bcea6ad91af05d6fac05206b46d4961e477197b8b2b1]$ ls -l total 176 drwxr-xr-x. 4 ramakasturinarra ramakasturinarra 4096 Aug 10 21:13 audit_logs drwxr-xr-x. 16 ramakasturinarra ramakasturinarra 4096 Aug 10 21:13 cluster-scoped-resources drwxr-xr-x. 2 ramakasturinarra ramakasturinarra 4096 Aug 10 21:15 etcd_info -rw-r--r--. 1 ramakasturinarra ramakasturinarra 154053 Aug 10 21:12 event-filter.html drwxr-xr-x. 3 ramakasturinarra ramakasturinarra 4096 Aug 10 21:13 host_service_logs drwxr-xr-x. 51 ramakasturinarra ramakasturinarra 4096 Aug 10 21:19 namespaces -rw-r--r--. 1 ramakasturinarra ramakasturinarra 34 Aug 10 21:10 version Expected results: oauth-apiserver audit logs should be collected Additional info:
Jan can you update https://github.com/openshift/must-gather/blob/master/collection-scripts/gather_audit_logs so that it also gather oauth-apiserver
*** This bug has been marked as a duplicate of bug 1862426 ***