Service log level AUDIT are sent to syslog as WARNING severity

[Ilya Shakhat]

Have original logs from nova compute (node-6:/var/log/nova/nova-compute.log)
2014-12-14 07:35:50.382 30202 AUDIT nova.compute.resource_tracker [-] Total physical ram (MB): 32142, total allocated virtual ram (MB): 512
2014-12-14 07:35:50.383 30202 AUDIT nova.compute.resource_tracker [-] Free disk (GB): 90020
2014-12-14 07:35:50.383 30202 AUDIT nova.compute.resource_tracker [-] Total usable vcpus: 12, total allocated vcpus: 0
2014-12-14 07:35:50.383 30202 AUDIT nova.compute.resource_tracker [-] PCI stats: []
2014-12-14 07:35:50.383 30202 INFO nova.compute.resource_tracker [-] Compute_service record updated for node-6:node-6.domain.tld

On the Fuel master node these logs have "warning" level (/var/log/remote/node-6.domain.tld/nova-compute.log)
2014-12-14T07:35:50.383028+00:00 warning: Total physical ram (MB): 32142, total allocated virtual ram (MB): 512
2014-12-14T07:35:50.383028+00:00 warning: Free disk (GB): 90020
2014-12-14T07:35:50.383921+00:00 warning: Total usable vcpus: 12, total allocated vcpus: 0
2014-12-14T07:35:50.384177+00:00 warning: PCI stats: []
2014-12-14T07:35:50.384177+00:00 info: Compute_service record updated for node-6:node-6.domain.tld

Also Fuel looses location (e.g. nova.compute.resource_tracker)

[Ilya Shakhat (shakhat)]

VERSION:
  feature_groups:
    - mirantis
  production: "docker"
  release: "6.0"
  api: "1.0"
  build_number: "49"
  build_id: "2014-12-09_22-41-06"
  astute_sha: "16b252d93be6aaa73030b8100cf8c5ca6a970a91"
  fuellib_sha: "2c99931072d951301d395ebd5bf45c8d401301bb"
  ostf_sha: "a9afb68710d809570460c29d6c3293219d3624d4"
  nailgun_sha: "22bd43b89a17843f9199f92d61fc86cb0f8772f1"
  fuelmain_sha: "3aab16667f47dd8384904e27f70f7a87ba15f4ee"

[Bogdan Dobrelya (bogdando)]

Audit level is being deprecated https://review.openstack.org/#/c/132552/3/specs/log-guidelines.rst

[Ilya Shakhat (shakhat)]

Bogdan, it will be deprecated not earlier than Kilo release (Fuel 7.0) and only if the refered spec gets approved without changes. So in 6.1 the behavior stays the same, right?

[Bogdan Dobrelya (bogdando)]

The issue is that there is a mess with AUDIT messages and an *effective* syslog severity of the messages sent via loggers.
Severety evaluated from PRI field according to the RFC 3164/RFC5424. If it is a WARNING, that is not a syslog issue but the code sending the message with wrong level.

Could you please attach some AUDIT log records taken from /var/log/nova-all.log file from any compute node? It would have a PRI shown so we could tell which severity it will result then being sent as a syslog message.

[Bogdan Dobrelya (bogdando)]

Here are examples of log messages:
/var/log/nova/api.log:2015-01-07 11:30:41.036 31324 AUDIT nova.api.openstack.compute.extensions [-] Initializing extension manager.
/var/log/nova-all.log:<180>Jan 7 11:30:41 node-1 nova-api Initializing extension manager.

PRI=180 and severity = PRI & 0x07 = 0xB4 & 0x07 = 0x04, which is a WARNING level.

[Davanum Srinivas (DIMS) (dims-v)]

This is invalid for stable/kilo. Nova does not log at AUDIT level at all.