[Wishlist] Define log rotation for NSG log, if path is specified

[Drew Freiberger]

In a use case where we want to externalize the network security group logging from syslog or the neutron-openvswitch-agent.log, we should configure a generic log rotation for the specified file.

For instance, if I configure neutron-openvswitch or neutron-gateway with:

juju config neutron-openvswitch security-group-log-output-base=/var/log/nsg.log

It would help ensure reliability if a file such as /etc/logrotate.d/juju-nsg-log-output-base could be created with similar rotation specifications to /etc/logrotate.d/neutron-common.

As an example:

# Configuration file maintained by Juju. Local changes may be overwritten
/var/log/nsg.log {
    daily
    missingok
    compress
    delaycompress
    notifempty
    copytruncate
    rotate 60
}

[Drew Freiberger (afreiberger)]

To clarify the point of externalizing the log, sometimes we may want a security team with unprivileged ssh access to the hypervisor to be able to read the log output, but /var/log/neutron and /var/log/syslog are not readable w/out privilege escalation.

[Drew Freiberger (afreiberger)]

Workaround is to manually create a logrotate.d file on each neutron-l3-agent unit.