Add functional test infrastructure -> syslog

[vparfonov]

Description

/cc /assign

/cherry-pick

Links

• Depending on PR(s):
• Bugzilla:
• Github issue:
• JIRA:
• Enhancement proposal:

[openshift-ci[bot]]

Skipping CI for Draft Pull Request. If you want CI signal for your change, please convert it to an actual PR. You can still manually trigger a test run with /test all

[vparfonov]

/test all

[vparfonov]

/test all

[openshift-ci-robot]

@vparfonov: This pull request references LOG-6236 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the bug to target the "4.8.0" version, but no target version was set.

In response to this:

Description

This PR addressed to align CLO Syslog Output with syslog specification RFC3164 and RFC5424

RFC3164

Format: <PRI> TIMESTAMP HOSTNAME TAG: MESSAGE <34>.@timestamp .hostname .tag: .message Example: <34>Oct 11 22:14:15 mymachine su[1234]: 'su root' failed for lonvick on /dev/pts/

	journal	application	infrastructure
AppName	SYSLOG_IDENTIFIER*	namespace_pod_container	.log_source
ProcId	_PID*	N/A	.auditID or "-" l
MsgId	N/A	.log_source	.log_sourcel
Payloadkey	.message	.message	.message
Severity	N/A	.level	information (6)
Facility	N/A	user (1)	security(13)

/cc /assign

/cherry-pick

Links

• Depending on PR(s):
• Bugzilla:
• Github issue:
• JIRA:
• Enhancement proposal:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[cahartma]

/hold

[vparfonov]

/retest

[openshift-ci[bot]]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: alanconway, vparfonov

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• ~~OWNERS~~ [alanconway]

Approvers can indicate their approval by writing /approve in a comment Approvers can cancel approval by writing /approve cancel in a comment

[alanconway]

/lgtm

[cahartma]

/unhold

[vparfonov]

/retest

[openshift-ci[bot]]

@vparfonov: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[openshift-cherrypick-robot]

@vparfonov: cannot checkout <!--: error checking out "<!--": exit status 1 error: pathspec '<!--' did not match any file(s) known to git

In response to this:

Description

This PR addressed to align Syslog Output with syslog specification RFC3164 and RFC5424

Default values for fields:

RFC3164

Format: <PRI>TIMESTAMP HOSTNAME TAG: MESSAGE Example:<34>Oct 11 22:14:15 mymachine su[1234]: 'su root' failed for lonvick on /dev/pts/

	journal	application	infrastructure	note
AppName	SYSLOG_IDENTIFIER*	namespacePodContainer	.log_source
ProcId	_PID*	N/A	.auditID (if available)
MsgId	N/A	N/A	N/A	will have no effect in settings
Payloadkey	.message	.message	.message
Severity	N/A	.level	information (6)
Facility	N/A	user (1)	security(13)

*If ProcId available, it will aggregate with AppName in the .tag field: appname[procid]

RFC5424

Format: <PRI> VERSION TIMESTAMP HOSTNAME APP-NAME PROCID MSGID [STRUCTURED-DATA] MESSAGE Example: <PRI>1 2024-11-08T14:35:04.123Z ip-10-0-88-196.ec2.internal app-name 1234 ID47 [exampleSDID@32473 iut="3" eventSource="Application" eventID="1011"] This is a sample message

	journal	application	infrastructure
AppName	SYSLOG_IDENTIFIER	namespace_pod_container	.log_source
ProcId	_PID	pod_id	.auditID (if available)
MsgId	.log_source	.log_source	.log_sourcel
Payloadkey	.message	.message	.message
Severity	N/A	.level	information (6)
Facility	N/A	user (1)	security(13)

Changes:

• add calculation for default value if field not configured according to the table above
• fix configuration for deployed syslog server in functional test to follow RFC3164 specification

/cc @cahartma @Clee2691 /assign @jcantrill

/cherry-pick

Links

• Depending on PR(s):
• Bugzilla:
• Github issue:
• JIRA: https://issues.redhat.com/browse/LOG-6236
• Enhancement proposal:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[vparfonov]

/cherry-pick release-6.1

[openshift-cherrypick-robot]

@vparfonov: new pull request created: #2905

In response to this:

/cherry-pick release-6.1

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[vparfonov]

/cherry-pick release-6.0

[openshift-cherrypick-robot]

@vparfonov: #2830 failed to apply on top of branch "release-6.0":

Applying: LOG-6236: Align syslog output implementation with spec RFC3164 and RFC5124
.git/rebase-apply/patch:37: space before tab in indent.
   	._internal.syslog.tag = replace(._internal.syslog.tag, r'[^a-zA-Z0-9]', "")
.git/rebase-apply/patch:92: space before tab in indent.
   	._internal.syslog.tag = join!([.kubernetes.namespace_name, .kubernetes.pod_name, .kubernetes.container_name], "")
.git/rebase-apply/patch:93: space before tab in indent.
   	._internal.syslog.severity = .level
.git/rebase-apply/patch:94: space before tab in indent.
   	._internal.syslog.facility = "user"
.git/rebase-apply/patch:95: space before tab in indent.
   	#Remove non-alphanumeric characters
warning: squelched 3 whitespace errors
warning: 8 lines add whitespace errors.
Using index info to reconstruct a base tree...
M	internal/generator/vector/output/syslog/syslog.go
M	internal/generator/vector/output/syslog/syslog_test.go
M	test/functional/outputs/syslog/forward_to_syslog_test.go
Falling back to patching base and 3-way merge...
Auto-merging test/functional/outputs/syslog/forward_to_syslog_test.go
CONFLICT (content): Merge conflict in test/functional/outputs/syslog/forward_to_syslog_test.go
Auto-merging internal/generator/vector/output/syslog/syslog_test.go
CONFLICT (content): Merge conflict in internal/generator/vector/output/syslog/syslog_test.go
Auto-merging internal/generator/vector/output/syslog/syslog.go
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config advice.mergeConflict false"
Patch failed at 0001 LOG-6236: Align syslog output implementation with spec RFC3164 and RFC5124

In response to this:

/cherry-pick release-6.0

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.