From bb07407485ed1626221a1190cc2fb2789f95ed22 Mon Sep 17 00:00:00 2001 From: elijah Date: Wed, 15 Apr 2015 16:12:11 -0700 Subject: clean up logging mess: add 'logfile' define, mv openvpn and stunnel logs to their own files, fix mx logwatch path. --- puppet/modules/leap/manifests/init.pp | 3 +++ puppet/modules/leap/manifests/logfile.pp | 26 ++++++++++++++++++++++ puppet/modules/leap_mx/manifests/init.pp | 3 ++- puppet/modules/leap_mx/manifests/syslog.pp | 17 -------------- .../site_check_mk/files/agent/logwatch/leap_mx.cfg | 2 +- .../site_check_mk/files/agent/logwatch/openvpn.cfg | 14 ++++++++++++ .../site_check_mk/files/agent/logwatch/stunnel.cfg | 10 +++++++++ .../files/agent/logwatch/syslog/openvpn.cfg | 13 ----------- .../files/agent/logwatch/syslog/stunnel.cfg | 9 -------- puppet/modules/site_check_mk/manifests/agent/mx.pp | 2 +- .../site_check_mk/manifests/agent/openvpn.pp | 2 +- .../site_check_mk/manifests/agent/stunnel.pp | 2 +- puppet/modules/site_openvpn/manifests/init.pp | 1 + puppet/modules/site_stunnel/manifests/init.pp | 1 + puppet/modules/site_webapp/manifests/init.pp | 3 ++- puppet/modules/site_webapp/manifests/logging.pp | 16 ------------- puppet/modules/tapicero/manifests/init.pp | 14 +----------- 17 files changed, 64 insertions(+), 74 deletions(-) create mode 100644 puppet/modules/leap/manifests/init.pp create mode 100644 puppet/modules/leap/manifests/logfile.pp delete mode 100644 puppet/modules/leap_mx/manifests/syslog.pp create mode 100644 puppet/modules/site_check_mk/files/agent/logwatch/openvpn.cfg create mode 100644 puppet/modules/site_check_mk/files/agent/logwatch/stunnel.cfg delete mode 100644 puppet/modules/site_check_mk/files/agent/logwatch/syslog/openvpn.cfg delete mode 100644 puppet/modules/site_check_mk/files/agent/logwatch/syslog/stunnel.cfg delete mode 100644 puppet/modules/site_webapp/manifests/logging.pp (limited to 'puppet') diff --git a/puppet/modules/leap/manifests/init.pp b/puppet/modules/leap/manifests/init.pp new file mode 100644 index 00000000..bbae3781 --- /dev/null +++ b/puppet/modules/leap/manifests/init.pp @@ -0,0 +1,3 @@ +class leap { + +} \ No newline at end of file diff --git a/puppet/modules/leap/manifests/logfile.pp b/puppet/modules/leap/manifests/logfile.pp new file mode 100644 index 00000000..42a82943 --- /dev/null +++ b/puppet/modules/leap/manifests/logfile.pp @@ -0,0 +1,26 @@ +# +# make syslog log to a particular file for a particular process. +# + +define leap::logfile($process=$title) { + $logfile = "/var/log/leap/${title}.log" + + rsyslog::snippet { "50-${name}": + content => "if \$programname startswith '${process}' then ${logfile} +&~" + } + + augeas { + "logrotate_${name}": + context => "/files/etc/logrotate.d/${name}/rule", + changes => [ + "set file ${logfile}", + 'set rotate 7', + 'set schedule daily', + 'set compress compress', + 'set missingok missingok', + 'set ifempty notifempty', + 'set copytruncate copytruncate' + ] + } +} diff --git a/puppet/modules/leap_mx/manifests/init.pp b/puppet/modules/leap_mx/manifests/init.pp index 78065f56..a0590ee1 100644 --- a/puppet/modules/leap_mx/manifests/init.pp +++ b/puppet/modules/leap_mx/manifests/init.pp @@ -11,7 +11,8 @@ class leap_mx { include soledad::common include site_apt::preferences::twisted - include leap_mx::syslog + + leap::logfile { 'mx': process => 'leap-mx'} # # USER AND GROUP diff --git a/puppet/modules/leap_mx/manifests/syslog.pp b/puppet/modules/leap_mx/manifests/syslog.pp deleted file mode 100644 index 0247a392..00000000 --- a/puppet/modules/leap_mx/manifests/syslog.pp +++ /dev/null @@ -1,17 +0,0 @@ -class leap_mx::syslog { - - rsyslog::snippet { '99-leap-mx': - content => 'if $programname startswith \'leap-mx\' then /var/log/leap/mx.log -&~' - } - - augeas { - 'logrotate_leap-mx': - context => '/files/etc/logrotate.d/leap-mx/rule', - changes => [ 'set file /var/log/leap/mx*.log', 'set rotate 7', - 'set schedule daily', 'set compress compress', - 'set missingok missingok', 'set ifempty notifempty', - 'set copytruncate copytruncate' ] - } - -} diff --git a/puppet/modules/site_check_mk/files/agent/logwatch/leap_mx.cfg b/puppet/modules/site_check_mk/files/agent/logwatch/leap_mx.cfg index c71c5392..166d0230 100644 --- a/puppet/modules/site_check_mk/files/agent/logwatch/leap_mx.cfg +++ b/puppet/modules/site_check_mk/files/agent/logwatch/leap_mx.cfg @@ -1,4 +1,4 @@ -/var/log/leap_mx.log +/var/log/leap/mx.log W Don't know how to deliver mail W No public key, stopping the processing chain diff --git a/puppet/modules/site_check_mk/files/agent/logwatch/openvpn.cfg b/puppet/modules/site_check_mk/files/agent/logwatch/openvpn.cfg new file mode 100644 index 00000000..ed50f420 --- /dev/null +++ b/puppet/modules/site_check_mk/files/agent/logwatch/openvpn.cfg @@ -0,0 +1,14 @@ +/var/log/leap/openvpn.log +# ignore openvpn TLS initialization errors when clients +# suddenly hangup before properly establishing +# a tls connection + I ovpn-.*TLS Error: Unroutable control packet received from + I ovpn-.*TLS Error: TLS key negotiation failed to occur within 60 seconds \(check your network connectivity\) + I ovpn-.*TLS Error: TLS handshake failed + I ovpn-.*TLS Error: TLS object -> incoming plaintext read error + I ovpn-.*Fatal TLS error \(check_tls_errors_co\), restarting + I ovpn-.*TLS_ERROR: BIO read tls_read_plaintext error: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate + + I ovpn-.*SIGUSR1\[soft,tls-error\] received, client-instance restarting + I ovpn-.*VERIFY ERROR: depth=0, error=certificate has expired + diff --git a/puppet/modules/site_check_mk/files/agent/logwatch/stunnel.cfg b/puppet/modules/site_check_mk/files/agent/logwatch/stunnel.cfg new file mode 100644 index 00000000..b1e6cf2f --- /dev/null +++ b/puppet/modules/site_check_mk/files/agent/logwatch/stunnel.cfg @@ -0,0 +1,10 @@ +/var/log/leap/stunnel.log +# check for stunnel failures +# +# these are temporary failures and happen very often, so we +# ignore them until we tuned stunnel timeouts/logging, +# see https://leap.se/code/issues/5218 + I stunnel:.*Connection reset by peer + I stunnel:.*Peer suddenly disconnected + I stunnel:.*Connection refused + diff --git a/puppet/modules/site_check_mk/files/agent/logwatch/syslog/openvpn.cfg b/puppet/modules/site_check_mk/files/agent/logwatch/syslog/openvpn.cfg deleted file mode 100644 index ac17c0ca..00000000 --- a/puppet/modules/site_check_mk/files/agent/logwatch/syslog/openvpn.cfg +++ /dev/null @@ -1,13 +0,0 @@ -# ignore openvpn TLS initialization errors when clients -# suddenly hangup before properly establishing -# a tls connection - I ovpn-.*TLS Error: Unroutable control packet received from - I ovpn-.*TLS Error: TLS key negotiation failed to occur within 60 seconds \(check your network connectivity\) - I ovpn-.*TLS Error: TLS handshake failed - I ovpn-.*TLS Error: TLS object -> incoming plaintext read error - I ovpn-.*Fatal TLS error \(check_tls_errors_co\), restarting - I ovpn-.*TLS_ERROR: BIO read tls_read_plaintext error: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate - - I ovpn-.*SIGUSR1\[soft,tls-error\] received, client-instance restarting - I ovpn-.*VERIFY ERROR: depth=0, error=certificate has expired - diff --git a/puppet/modules/site_check_mk/files/agent/logwatch/syslog/stunnel.cfg b/puppet/modules/site_check_mk/files/agent/logwatch/syslog/stunnel.cfg deleted file mode 100644 index eb3131f2..00000000 --- a/puppet/modules/site_check_mk/files/agent/logwatch/syslog/stunnel.cfg +++ /dev/null @@ -1,9 +0,0 @@ -# check for stunnel failures -# -# these are temporary failures and happen very often, so we -# ignore them until we tuned stunnel timeouts/logging, -# see https://leap.se/code/issues/5218 - I stunnel:.*Connection reset by peer - I stunnel:.*Peer suddenly disconnected - I stunnel:.*Connection refused - diff --git a/puppet/modules/site_check_mk/manifests/agent/mx.pp b/puppet/modules/site_check_mk/manifests/agent/mx.pp index da66c549..98757b59 100644 --- a/puppet/modules/site_check_mk/manifests/agent/mx.pp +++ b/puppet/modules/site_check_mk/manifests/agent/mx.pp @@ -12,7 +12,7 @@ class site_check_mk::agent::mx { lens => 'Spacevars.lns', changes => [ 'rm /files/etc/check_mk/mrpe.cfg/Leap_MX_Procs', - 'set Leap_MX_Procs \'/usr/lib/nagios/plugins/check_procs -w 1:1 -c 1:1 -a "/usr/bin/python /usr/bin/twistd --pidfile=/var/run/leap_mx.pid --rundir=/var/lib/leap_mx/ --python=/usr/share/app/leap_mx.tac --logfile=/var/log/leap_mx.log"\'' ], + 'set Leap_MX_Procs \'/usr/lib/nagios/plugins/check_procs -w 1:1 -c 1:1 -a "/usr/bin/python /usr/bin/twistd --pidfile=/var/run/leap_mx.pid --rundir=/var/lib/leap_mx/ --python=/usr/share/app/leap_mx.tac --logfile=/var/log/leap/mx.log"\'' ], require => File['/etc/check_mk/mrpe.cfg']; } diff --git a/puppet/modules/site_check_mk/manifests/agent/openvpn.pp b/puppet/modules/site_check_mk/manifests/agent/openvpn.pp index 919a408d..0596a497 100644 --- a/puppet/modules/site_check_mk/manifests/agent/openvpn.pp +++ b/puppet/modules/site_check_mk/manifests/agent/openvpn.pp @@ -2,7 +2,7 @@ class site_check_mk::agent::openvpn { # check syslog concat::fragment { 'syslog_openpvn': - source => 'puppet:///modules/site_check_mk/agent/logwatch/syslog/openvpn.cfg', + source => 'puppet:///modules/site_check_mk/agent/logwatch/openvpn.cfg', target => '/etc/check_mk/logwatch.d/syslog.cfg', order => '02'; } diff --git a/puppet/modules/site_check_mk/manifests/agent/stunnel.pp b/puppet/modules/site_check_mk/manifests/agent/stunnel.pp index 64022824..7f765771 100644 --- a/puppet/modules/site_check_mk/manifests/agent/stunnel.pp +++ b/puppet/modules/site_check_mk/manifests/agent/stunnel.pp @@ -1,7 +1,7 @@ class site_check_mk::agent::stunnel { concat::fragment { 'syslog_stunnel': - source => 'puppet:///modules/site_check_mk/agent/logwatch/syslog/stunnel.cfg', + source => 'puppet:///modules/site_check_mk/agent/logwatch/stunnel.cfg', target => '/etc/check_mk/logwatch.d/syslog.cfg', order => '02'; } diff --git a/puppet/modules/site_openvpn/manifests/init.pp b/puppet/modules/site_openvpn/manifests/init.pp index d6f9150b..e2a3124e 100644 --- a/puppet/modules/site_openvpn/manifests/init.pp +++ b/puppet/modules/site_openvpn/manifests/init.pp @@ -228,6 +228,7 @@ class site_openvpn { order => 10; } + leap::logfile { 'openvpn': } include site_check_mk::agent::openvpn } diff --git a/puppet/modules/site_stunnel/manifests/init.pp b/puppet/modules/site_stunnel/manifests/init.pp index 2e0cf5b8..176b8618 100644 --- a/puppet/modules/site_stunnel/manifests/init.pp +++ b/puppet/modules/site_stunnel/manifests/init.pp @@ -29,6 +29,7 @@ class site_stunnel { $client_sections = keys($clients) site_stunnel::clients { $client_sections: } + leap::logfile { "stunnel": process => "stunnel4" } include site_stunnel::override_service } diff --git a/puppet/modules/site_webapp/manifests/init.pp b/puppet/modules/site_webapp/manifests/init.pp index ea64048b..f10ef00d 100644 --- a/puppet/modules/site_webapp/manifests/init.pp +++ b/puppet/modules/site_webapp/manifests/init.pp @@ -18,7 +18,6 @@ class site_webapp { include site_config::ruby::dev include site_webapp::apache include site_webapp::couchdb - include site_webapp::logging include site_haproxy include site_webapp::cron include site_config::x509::cert @@ -173,6 +172,8 @@ class site_webapp { ensure => latest, } + leap::logfile { 'webapp': } + include site_shorewall::webapp include site_check_mk::agent::webapp } diff --git a/puppet/modules/site_webapp/manifests/logging.pp b/puppet/modules/site_webapp/manifests/logging.pp deleted file mode 100644 index b414b82c..00000000 --- a/puppet/modules/site_webapp/manifests/logging.pp +++ /dev/null @@ -1,16 +0,0 @@ -class site_webapp::logging { - - rsyslog::snippet { '01-webapp': - content => 'if $programname == "webapp" then /var/log/leap/webapp.log -&~' - } - - augeas { - 'logrotate_webapp': - context => '/files/etc/logrotate.d/webapp/rule', - changes => [ 'set file /var/log/leap/webapp.log', 'set rotate 7', - 'set schedule daily', 'set compress compress', - 'set missingok missingok', 'set ifempty notifempty', - 'set copytruncate copytruncate' ] - } -} diff --git a/puppet/modules/tapicero/manifests/init.pp b/puppet/modules/tapicero/manifests/init.pp index d4ff1acb..ca8488c8 100644 --- a/puppet/modules/tapicero/manifests/init.pp +++ b/puppet/modules/tapicero/manifests/init.pp @@ -133,17 +133,5 @@ class tapicero { Couchdb::Add_user[$::site_couchdb::couchdb_tapicero_user] ]; } - rsyslog::snippet { '99-tapicero': - content => 'if $programname startswith \'tapicero\' then /var/log/leap/tapicero.log -&~' - } - - augeas { - 'logrotate_tapicero': - context => '/files/etc/logrotate.d/tapicero/rule', - changes => [ 'set file /var/log/leap/tapicero*.log', 'set rotate 7', - 'set schedule daily', 'set compress compress', - 'set missingok missingok', 'set ifempty notifempty', - 'set copytruncate copytruncate' ] - } + leap::logfile { 'tapicero': } } -- cgit v1.2.3