Glance-manage should log to a unique file

[Matt Kassawara]

The glance-manage utility (particularly the database sync operation) writes to the API log instead of a unique file such as glance-manage.log. In a typical environment, the glance-manage utility runs as root and creates the API log with root ownership. The glance-api service generally runs as the glance user and won't start because it can't write to the API log. The *-manage utility included with most other services already uses *-manage.log which prevents this issue.

Version: 2014.2 (also affects earlier versions)

[Ian Cordasco (icordasc)]

I suspect that this is because we use glance-registry and glance-api's config files (https://github.com/openstack/glance/blob/453706b4b3a3d6d9c3b154a1fde59c34fc30234b/glance/cmd/manage.py#L267..L270) to configure glance-manage even though there's apparently the ability to have a glace-manage.conf file (https://github.com/openstack/glance/blob/453706b4b3a3d6d9c3b154a1fde59c34fc30234b/etc/oslo-config-generator/glance-manage.conf). Even if a glance-manage.conf file existed, it wouldn't be used at this point. I'm going to look to see how other services manage to have separate logs for this without having their own -manage.conf files.

[Ian Cordasco (icordasc)]

So this entirely a conflagration of a couple things:

1. glance's sample glance-api.conf specifies a log_file always: https://github.com/openstack/glance/blob/master/etc/glance-api.conf#L31

2. glance-manage uses the config files for registry and api and the last one wins (e.g., if glance-registry configures log_file, and so does glance-api, the latter log_file value will be the one used by glance-manage)

3. Other projects don't specify log_file by default, so they fall back to using the name of the executable from https://github.com/openstack/keystone/blob/master/keystone/openstack/common/log.py#L206

There are a few ways to fix this:

1. If glance wants to continue specifying log_file explicitly in its sample config files, we should create a glance-common.conf to encapsulate the configuration options that registry, api, and manage share. glance-common.conf will by default not specify a log_file and then glance-manage will properly create a log file with the correct permissions and name

2. We can stop setting log_file explicitly in each log file and let oslo.log do its job

3. We can actually use the glance-manage.conf that would be generated by the oslo-config-generator in glance's etc directory and make users configure options in more than one place. (For what it's worth, I don't think this is a real option.)

Option 2 seems like the least disruption, so I'm going to submit a patchset for that, but if discussion leads us to option 1, I'll be happy to work on that too

[Ian Cordasco (icordasc)]

So looking at the example log files, the structure that glance uses is /var/log/glance/{{service}}.log. If we remove those assigments it will change it to /var/log/glance-{{service}}.log which is likely undesirable. So I'm going to work on splitting out a glance-common.conf I suspect this might require a blueprint though.

[Ian Cordasco (icordasc)]

To update others, this was supposed to be included in this week's meeting but we ran out of time so we continued the discussion in #openstack-glance. I have a log of the relevant conversation here: https://gist.github.com/sigmavirus24/68c99b716e6a87e67b81

For those who don't want to read that (and I don't blame them) the short of it is:

- We're going to add glance-manage.conf
- We're going to load three config files in glance-manage for kilo: glance-registry.conf, glance-api.conf, and glance-manage.conf
- We're also going to deprecate loading glance-registry.conf and glance-api.conf and only load glance-manage.conf

This will need to be submitted as a spec first, and then work will begin on it.

[Ian Cordasco (icordasc)]

The related spec is https://review.openstack.org/#/c/134810/ and blueprint is https://blueprints.launchpad.net/glance/+spec/create-glance-manage-conf

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.openstack.org/141917

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/141917
Committed: https://git.openstack.org/cgit/openstack/glance/commit/?id=8a02cf035c830736f3475fd282bbb7cd33b950bf
Submitter: Jenkins
Branch: master

commit 8a02cf035c830736f3475fd282bbb7cd33b950bf
Author: Ian Cordasco <email address hidden>
Date: Mon Dec 15 16:05:23 2014 -0600

    Generate glance-manage.conf

    As specified in the blueprint, we are only going to set log_file in the
    configuration file for now, and we read it last in glance.cmd.manage.
    This allows glance-manage to use the appropriate log-file and still
    retain the settings it needs in glance-api.conf and glance-registry.conf

    DocImpact

    Change-Id: I87595a29634e6ffda4e1581d42a92dfe6f84044b
    Implements: blueprint create-glance-manage-conf
    Closes-bug: #1391211