Bug 1981579 - [4.6] The built-in application type can not forward all the logs when sending specific namespace logs
Summary: [4.6] The built-in application type can not forward all the logs when sending...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Logging
Version: 4.6
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: ---
: 4.6.z
Assignee: Jeff Cantrill
QA Contact: Anping Li
URL:
Whiteboard: logging-core
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2021-07-12 21:22 UTC by Keiichi Kii (NEC)
Modified: 2022-05-09 12:29 UTC (History)
4 users (show)

Fixed In Version: 4.6
Doc Type: Bug Fix
Doc Text:
Before this update, <X problem> caused <Y situation> (OPTIONAL: under the following <Z conditions>). With this update, <fix> resolves the issue (OPTIONAL: and <agent> can <perform operation> successfully).
Clone Of:
Environment:
Last Closed: 2021-08-04 19:49:45 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github openshift cluster-logging-operator pull 1099 0 None open Bug 1981579: Fix built-in application to collect all of logs 2021-07-13 23:32:36 UTC
Red Hat Product Errata RHBA-2021:2889 0 None None None 2021-08-04 19:49:52 UTC

Description Keiichi Kii (NEC) 2021-07-12 21:22:18 UTC
a) Description of problem:

While sending specific namespace logs to an external aggregator as well as send logs to
internal OCP Elasticsearch(default) using the built-in application, the internal OCP ES
can not see the specific namespace logs.

b) Version-Release number of selected component (if applicable):

OpenShift 4.7 and OpenShift Logging 5.0

c) How reproducible:

Always when sending specific namespace logs

d) Steps to Reproduce:

1. Deploy OpenShift Logging(Elasticsearch operator and OpenShift Logging Operator)
2. Create a cluster logging instance
3. Configure ClusterLogForwarder with the following yaml
~~~
apiVersion: logging.openshift.io/v1
kind: ClusterLogForwarder
metadata:
  name: instance
spec:
  inputs:
    - application:
        namespaces:
         - test
      name: test-app-logs
  outputs:
   - name: rsyslog
     type: syslog
     syslog:
       facility: local0
       severity: informational
     url: 'udp://<rsyslog server>'
  pipelines:
    - name: application-default
      inputRefs:
        - application
      outputRefs:
        - default
    - name: forward-to-syslog
      inputRefs:
        - test-app-logs
      outputRefs:
        - rsyslog
~~~
4. Check the forwarded logs from the "application-default" pipeline

e) Actual results:
The forwarded logs from the built-in "application" doesn't include the specific namespace logs

f) Expected results:
All the application logs should be forwarded using the built-in application 
type while sending specific namespace logs

g) Additional info:

In OpenShift Logging 5.1 or later, this behavior is changed to send all the application
logs while sending specific namespace logs by the following commit:

https://github.com/openshift/cluster-logging-operator/pull/999

But, as for OpenShift Logging 5.1 and later, the namespace filtering feature is
changed based on label router plugin.
So we can not cherry-pick cluster-logging-operator#999 to 5.0 and 4.6 simply.

The following PR is the change for OpenShift Logging 5.0.
It depends on https://github.com/openshift/cluster-logging-operator/pull/976.

Comment 4 Anping Li 2021-07-28 09:43:40 UTC
Verified on clusterlogging.4.6.0-202107232145

Comment 6 errata-xmlrpc 2021-08-04 19:49:45 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (OpenShift Container Platform 4.6.41 extras update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2021:2889


Note You need to log in before you can comment on or make changes to this bug.