RMT logging

This document (000021393) is provided subject to the disclaimer at the end of this document.

Environment

SUSE Linux Enterprise Server 15 Repository Monitoring Tool (RMT)

Situation

By default, logging for the Repository Mirroring Tool (RMT) is configured to write log data to systemd journald logs and the RMT logs are not redirected to a separate file. However, with rsyslog filters RMT logs can be redirected to a separate file.

SUSE Linux Enterprise Server 15 is configured to redirect journald logs to "syslog", usually via the rsyslog daemon.

This is done with a systemd drop-in file located here:

# /usr/lib/systemd/journald.conf.d/30-rsyslog.conf
[Journal]
ForwardToSyslog=yes

Resolution

RMT log entries can be redirected from the /var/log/messages file, to /var/log/rmt/rmt-cli.log.

To do this, create a rsyslog config file:

touch /etc/rsyslog.d/rmt-cli.conf

with this content:

if     ($programname == 'rmt-cli' or $syslogtag == '[rmt-cli]:') \
then {
       -/var/log/rmt/rmt-cli.log
    stop
}

Create the log directory and file:

mkdir /var/log/rmt/ 
touch /var/log/rmt/rmt-cli.log

Restart rsyslog:

systemctl restart rsyslog

If RMT "debug" logging is required, enable the debug value in the /etc/rmt.conf file.
Under the "log_level" section, set "cli:" to "debug" or "info".

log_level:
  rails: info
  cli: debug

Check "man rmt-cli" for more details.

After creating the above rmt-cli.log be sure to add a logrotate entry by creating this file:

touch /etc/logrotate.d/rmt-cli

and adding this content:

/var/log/rmt/rmt-cli.log {
    compress
    dateext
    notifempty
    missingok
    copytruncate
    maxage 60
    rotate 9
    size 10M
}

Cause

RMT logs to systemd-journald logs and makes parsing rsyslog "messages" log file difficult.
While we cannot stop RMT logging to journald, we can redirect logs from the "messages" file to a separate log file.

Additional Information

The version of systemd on SLES15 (currently systemd-249 on SLES15-SP5) lacks the ability to redirect log data from writing to journald.
Upstream there is a change in systemd-253 that allows some filtering, but it's not ideal.
Starting in systemd-253, there is a feature "LogFilterPatterns", but the unfortunate part of that feature is it will also not forward those filtered patterns to syslog. So the systemd filtered logs are lost completely.

https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html
LogFilterPatterns=
"Filtering is based on the unit for which LogFilterPatterns= is defined, meaning log messages coming from systemd(1) about the unit are not taken into account. Filtered log messages won't be forwarded to traditional syslog daemons, the kernel log buffer (kmsg), the systemd console, or sent as wall messages to all logged-in users.
Added in version 253."

Disclaimer

This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.