rsyslogd: use %rawmsg-after-pri% instead of %msg%

after some prolonged RFC reading and tinkering w/ rsyslogd...

cpython's SysLogHandler doesn't emit RFC3164 formatted messages
in the format you'd expect; it's missing the ISO date, hostname, etc...
along with other header values; the handler implementation relies on you
to specify a syslog-like formatter (we've replaced all of this with our
own *custom* logstash-esque formatter that effectively outputs valid JSON
- without dates and other syslog header values prepended)

because of this unanticipated format, rsyslogd chokes when trying to
parse the message's parts;  AWX is emitting:

<priority>RAWJSON

...so the usage of `%msg%` isn't going to work for us, because rsyslog
tries to parse *all* of the possible headers (and yells, because it
can't find a date to parse):

see: https://www.rsyslog.com/files/temp/doc-indent/configuration/properties.html#message-properties

this is fine, because we don't *need* any of that message parsing
anyways; in the end, we're *just* interested in forwarding the raw
JSON/text content to the third party log handler
This commit is contained in:
Ryan Petrello 2020-04-09 00:42:43 -04:00 committed by Christian Adams
parent bb5136cdae
commit e52cebc28e
2 changed files with 0 additions and 32 deletions

View File

@ -98,8 +98,6 @@ spec:
mountPath: "/var/run/supervisor"
- name: rsyslog-socket
mountPath: "/var/run/rsyslog"
- name: rsyslog-dir
mountPath: "/var/lib/awx/rsyslog/"
{% if ca_trust_dir is defined %}
- name: {{ kubernetes_deployment_name }}-ca-trust-dir
mountPath: "/etc/pki/ca-trust/source/anchors/"
@ -148,11 +146,6 @@ spec:
subPath: supervisor_task.conf
readOnly: true
- name: {{ kubernetes_deployment_name }}-rsyslog-config
mountPath: "/var/lib/awx/rsyslog/rsyslog.conf"
subPath: rsyslog.conf
readOnly: true
- name: {{ kubernetes_deployment_name }}-secret-key
mountPath: "/etc/tower/SECRET_KEY"
subPath: SECRET_KEY
@ -189,8 +182,6 @@ spec:
mountPath: "/var/run/supervisor"
- name: rsyslog-socket
mountPath: "/var/run/rsyslog"
- name: rsyslog-dir
mountPath: "/var/lib/awx/rsyslog/"
{% if ca_trust_dir is defined %}
- name: {{ kubernetes_deployment_name }}-ca-trust-dir
mountPath: "/etc/pki/ca-trust/source/anchors/"
@ -336,8 +327,6 @@ spec:
emptyDir: {}
- name: rsyslog-socket
emptyDir: {}
- name: rsyslog-dir
emptyDir: {}
{% if ca_trust_dir is defined %}
- name: {{ kubernetes_deployment_name }}-ca-trust-dir
hostPath:
@ -414,13 +403,6 @@ spec:
- key: supervisor-task-config
path: 'supervisor_task.conf'
- name: {{ kubernetes_deployment_name }}-rsyslog-config
configMap:
name: {{ kubernetes_deployment_name }}-rsyslog-config
items:
- key: rsyslog-config
path: 'rsyslog.conf'
- name: {{ kubernetes_deployment_name }}-secret-key
secret:
secretName: "{{ kubernetes_deployment_name }}-secrets"

View File

@ -1,14 +0,0 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ kubernetes_deployment_name }}-rsyslog-config
namespace: {{ kubernetes_namespace }}
data:
rsyslog-config: |
$WorkDirectory /var/lib/awx/rsyslog
$MaxMessageSize 700000
$IncludeConfig /var/lib/awx/rsyslog/conf.d/*.conf
$ModLoad imuxsock
input(type="imuxsock" Socket="/var/run/rsyslog/rsyslog.sock" unlink="on")
template(name="awx" type="string" string="%msg%")
action(type="omfile" file="/dev/null")