Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 2050218

Summary:	Syslog replacement almost logs nothing
Product:	Red Hat Enterprise Virtualization Manager	Reporter:	Jean-Louis Dupond <jean-louis>
Component:	ovirt-engine	Assignee:	Martin Perina <mperina>
Status:	CLOSED ERRATA	QA Contact:	Guilherme Santos <gdeolive>
Severity:	high	Docs Contact:
Priority:	high
Version:	4.4.10	CC:	bugs, emarcus, mperina
Target Milestone:	ovirt-4.4.10-3	Keywords:	ZStream
Target Release:	4.4.10
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	ovirt-engine-4.4.10.7	Doc Type:	Release Note
Doc Text:	SyslogHandler implementation was implemented to replace ovirt-engine-extension-logger-log4j and to allow passing RHV Manager logs to an external syslog server. Unfortunately it contained a bug, and only server.log content was passed to the external syslog server. In this release, engine.log content is also passed by default to the external syslog server.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-03-24 13:30:22 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	Infra	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Jean-Louis Dupond 2022-02-03 13:17:13 UTC

Description of problem:
The new ovirt-engine syslogging implementation seems to be broken.

How reproducible:
Always

Steps to Reproduce:
1. Create a /etc/ovirt-engine/engine.conf.d/80-syslog.conf
with the following content:
SYSLOG_HANDLER_ENABLED=true
SYSLOG_HANDLER_SERVER_HOSTNAME=remote-syslog-server
SYSLOG_HANDLER_FACILITY=LOCAL_USE_1

2. Restart ovirt-engine

Actual results:

Some logs arrive on the syslog server. Like the wildfly startup messages etc.
But all the ovirt-engine logging itself, is never syslogged. Which is quite an issue ofcouse!


Expected results:
I would expect the same messages that are logged in engine.log to be logged to syslog also.

Additional info:

Comment 3 Guilherme Santos 2022-03-15 15:13:22 UTC

Verified on:
ovirt-engine-4.4.10.8-548.g6b5767a.2.el8ev.noarch


Steps:

1. Create the 80-syslog.conf file in the /etc/ovirt-engine/engine.conf.d for remote syslog:

SYSLOG_HANDLER_ENABLED=true
SYSLOG_HANDLER_SERVER_HOSTNAME=localhost
SYSLOG_HANDLER_FACILITY=USER_LEVEL

2. Configure SELinux and firewall to allow rsyslog traffic.

# firewall-cmd --permanent --add-port=514/udp
# firewall-cmd --reload
# semanage port -a -t syslogd_port_t -p udp 514

3. Create /etc/rsyslog.d/rhvm.conf and add the following lines:

user.* /var/log/jboss.log

module(load="imudp") # needs to be done just once
input(type="imudp" port="514")

4. Restart services:
# systemctl restart rsyslog.service
# systemctl restart ovirt-engine

5. simultaneously check local /var/log/ovirt-engine/engine.log logs and remote /var/log/jboss.log one

Results:
Logs are the same

Comment 5 errata-xmlrpc 2022-03-24 13:30:22 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (RHV Manager (ovirt-engine) [ovirt-4.4.10-3]), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:1052