From bb07407485ed1626221a1190cc2fb2789f95ed22 Mon Sep 17 00:00:00 2001
From: elijah <elijah@riseup.net>
Date: Wed, 15 Apr 2015 16:12:11 -0700
Subject: clean up logging mess: add 'logfile' define, mv openvpn and stunnel
 logs to their own files, fix mx logwatch path.

---
 puppet/modules/leap/manifests/init.pp              |  3 +++
 puppet/modules/leap/manifests/logfile.pp           | 26 ++++++++++++++++++++++
 puppet/modules/leap_mx/manifests/init.pp           |  3 ++-
 puppet/modules/leap_mx/manifests/syslog.pp         | 17 --------------
 .../site_check_mk/files/agent/logwatch/leap_mx.cfg |  2 +-
 .../site_check_mk/files/agent/logwatch/openvpn.cfg | 14 ++++++++++++
 .../site_check_mk/files/agent/logwatch/stunnel.cfg | 10 +++++++++
 .../files/agent/logwatch/syslog/openvpn.cfg        | 13 -----------
 .../files/agent/logwatch/syslog/stunnel.cfg        |  9 --------
 puppet/modules/site_check_mk/manifests/agent/mx.pp |  2 +-
 .../site_check_mk/manifests/agent/openvpn.pp       |  2 +-
 .../site_check_mk/manifests/agent/stunnel.pp       |  2 +-
 puppet/modules/site_openvpn/manifests/init.pp      |  1 +
 puppet/modules/site_stunnel/manifests/init.pp      |  1 +
 puppet/modules/site_webapp/manifests/init.pp       |  3 ++-
 puppet/modules/site_webapp/manifests/logging.pp    | 16 -------------
 puppet/modules/tapicero/manifests/init.pp          | 14 +-----------
 17 files changed, 64 insertions(+), 74 deletions(-)
 create mode 100644 puppet/modules/leap/manifests/init.pp
 create mode 100644 puppet/modules/leap/manifests/logfile.pp
 delete mode 100644 puppet/modules/leap_mx/manifests/syslog.pp
 create mode 100644 puppet/modules/site_check_mk/files/agent/logwatch/openvpn.cfg
 create mode 100644 puppet/modules/site_check_mk/files/agent/logwatch/stunnel.cfg
 delete mode 100644 puppet/modules/site_check_mk/files/agent/logwatch/syslog/openvpn.cfg
 delete mode 100644 puppet/modules/site_check_mk/files/agent/logwatch/syslog/stunnel.cfg
 delete mode 100644 puppet/modules/site_webapp/manifests/logging.pp

(limited to 'puppet')

diff --git a/puppet/modules/leap/manifests/init.pp b/puppet/modules/leap/manifests/init.pp
new file mode 100644
index 00000000..bbae3781
--- /dev/null
+++ b/puppet/modules/leap/manifests/init.pp
@@ -0,0 +1,3 @@
+class leap {
+
+}
\ No newline at end of file
diff --git a/puppet/modules/leap/manifests/logfile.pp b/puppet/modules/leap/manifests/logfile.pp
new file mode 100644
index 00000000..42a82943
--- /dev/null
+++ b/puppet/modules/leap/manifests/logfile.pp
@@ -0,0 +1,26 @@
+#
+# make syslog log to a particular file for a particular process.
+#
+
+define leap::logfile($process=$title) {
+  $logfile = "/var/log/leap/${title}.log"
+
+  rsyslog::snippet { "50-${name}":
+    content => "if \$programname startswith '${process}' then ${logfile}
+&~"
+  }
+
+  augeas {
+    "logrotate_${name}":
+      context => "/files/etc/logrotate.d/${name}/rule",
+      changes => [
+        "set file ${logfile}",
+        'set rotate 7',
+        'set schedule daily',
+        'set compress compress',
+        'set missingok missingok',
+        'set ifempty notifempty',
+        'set copytruncate copytruncate'
+      ]
+  }
+}
diff --git a/puppet/modules/leap_mx/manifests/init.pp b/puppet/modules/leap_mx/manifests/init.pp
index 78065f56..a0590ee1 100644
--- a/puppet/modules/leap_mx/manifests/init.pp
+++ b/puppet/modules/leap_mx/manifests/init.pp
@@ -11,7 +11,8 @@ class leap_mx {
 
   include soledad::common
   include site_apt::preferences::twisted
-  include leap_mx::syslog
+
+  leap::logfile { 'mx': process => 'leap-mx'}
 
   #
   # USER AND GROUP
diff --git a/puppet/modules/leap_mx/manifests/syslog.pp b/puppet/modules/leap_mx/manifests/syslog.pp
deleted file mode 100644
index 0247a392..00000000
--- a/puppet/modules/leap_mx/manifests/syslog.pp
+++ /dev/null
@@ -1,17 +0,0 @@
-class leap_mx::syslog {
-
-  rsyslog::snippet { '99-leap-mx':
-    content => 'if $programname startswith \'leap-mx\' then /var/log/leap/mx.log
-&~'
-  }
-
-  augeas {
-    'logrotate_leap-mx':
-      context => '/files/etc/logrotate.d/leap-mx/rule',
-      changes => [ 'set file /var/log/leap/mx*.log', 'set rotate 7',
-                   'set schedule daily', 'set compress compress',
-                   'set missingok missingok', 'set ifempty notifempty',
-                   'set copytruncate copytruncate' ]
-  }
-
-}
diff --git a/puppet/modules/site_check_mk/files/agent/logwatch/leap_mx.cfg b/puppet/modules/site_check_mk/files/agent/logwatch/leap_mx.cfg
index c71c5392..166d0230 100644
--- a/puppet/modules/site_check_mk/files/agent/logwatch/leap_mx.cfg
+++ b/puppet/modules/site_check_mk/files/agent/logwatch/leap_mx.cfg
@@ -1,4 +1,4 @@
-/var/log/leap_mx.log
+/var/log/leap/mx.log
  W Don't know how to deliver mail
  W No public key, stopping the processing chain
 
diff --git a/puppet/modules/site_check_mk/files/agent/logwatch/openvpn.cfg b/puppet/modules/site_check_mk/files/agent/logwatch/openvpn.cfg
new file mode 100644
index 00000000..ed50f420
--- /dev/null
+++ b/puppet/modules/site_check_mk/files/agent/logwatch/openvpn.cfg
@@ -0,0 +1,14 @@
+/var/log/leap/openvpn.log
+# ignore openvpn TLS initialization errors when clients
+# suddenly hangup before properly establishing
+# a tls connection
+ I ovpn-.*TLS Error: Unroutable control packet received from
+ I ovpn-.*TLS Error: TLS key negotiation failed to occur within 60 seconds \(check your network connectivity\)
+ I ovpn-.*TLS Error: TLS handshake failed
+ I ovpn-.*TLS Error: TLS object -> incoming plaintext read error
+ I ovpn-.*Fatal TLS error \(check_tls_errors_co\), restarting
+ I ovpn-.*TLS_ERROR: BIO read tls_read_plaintext error: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate
+
+ I ovpn-.*SIGUSR1\[soft,tls-error\] received, client-instance restarting
+ I ovpn-.*VERIFY ERROR: depth=0, error=certificate has expired
+
diff --git a/puppet/modules/site_check_mk/files/agent/logwatch/stunnel.cfg b/puppet/modules/site_check_mk/files/agent/logwatch/stunnel.cfg
new file mode 100644
index 00000000..b1e6cf2f
--- /dev/null
+++ b/puppet/modules/site_check_mk/files/agent/logwatch/stunnel.cfg
@@ -0,0 +1,10 @@
+/var/log/leap/stunnel.log
+# check for stunnel failures
+#
+# these are temporary failures and happen very often, so we
+# ignore them until we tuned stunnel timeouts/logging,
+# see https://leap.se/code/issues/5218
+ I stunnel:.*Connection reset by peer
+ I stunnel:.*Peer suddenly disconnected
+ I stunnel:.*Connection refused
+
diff --git a/puppet/modules/site_check_mk/files/agent/logwatch/syslog/openvpn.cfg b/puppet/modules/site_check_mk/files/agent/logwatch/syslog/openvpn.cfg
deleted file mode 100644
index ac17c0ca..00000000
--- a/puppet/modules/site_check_mk/files/agent/logwatch/syslog/openvpn.cfg
+++ /dev/null
@@ -1,13 +0,0 @@
-# ignore openvpn TLS initialization errors when clients
-# suddenly hangup before properly establishing
-# a tls connection
- I ovpn-.*TLS Error: Unroutable control packet received from
- I ovpn-.*TLS Error: TLS key negotiation failed to occur within 60 seconds \(check your network connectivity\)
- I ovpn-.*TLS Error: TLS handshake failed
- I ovpn-.*TLS Error: TLS object -> incoming plaintext read error
- I ovpn-.*Fatal TLS error \(check_tls_errors_co\), restarting
- I ovpn-.*TLS_ERROR: BIO read tls_read_plaintext error: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate
-
- I ovpn-.*SIGUSR1\[soft,tls-error\] received, client-instance restarting
- I ovpn-.*VERIFY ERROR: depth=0, error=certificate has expired
-
diff --git a/puppet/modules/site_check_mk/files/agent/logwatch/syslog/stunnel.cfg b/puppet/modules/site_check_mk/files/agent/logwatch/syslog/stunnel.cfg
deleted file mode 100644
index eb3131f2..00000000
--- a/puppet/modules/site_check_mk/files/agent/logwatch/syslog/stunnel.cfg
+++ /dev/null
@@ -1,9 +0,0 @@
-# check for stunnel failures
-#
-# these are temporary failures and happen very often, so we
-# ignore them until we tuned stunnel timeouts/logging,
-# see https://leap.se/code/issues/5218
- I stunnel:.*Connection reset by peer
- I stunnel:.*Peer suddenly disconnected
- I stunnel:.*Connection refused
-
diff --git a/puppet/modules/site_check_mk/manifests/agent/mx.pp b/puppet/modules/site_check_mk/manifests/agent/mx.pp
index da66c549..98757b59 100644
--- a/puppet/modules/site_check_mk/manifests/agent/mx.pp
+++ b/puppet/modules/site_check_mk/manifests/agent/mx.pp
@@ -12,7 +12,7 @@ class site_check_mk::agent::mx {
       lens    => 'Spacevars.lns',
       changes => [
         'rm /files/etc/check_mk/mrpe.cfg/Leap_MX_Procs',
-        'set Leap_MX_Procs \'/usr/lib/nagios/plugins/check_procs -w 1:1 -c 1:1 -a "/usr/bin/python /usr/bin/twistd --pidfile=/var/run/leap_mx.pid --rundir=/var/lib/leap_mx/ --python=/usr/share/app/leap_mx.tac --logfile=/var/log/leap_mx.log"\'' ],
+        'set Leap_MX_Procs \'/usr/lib/nagios/plugins/check_procs -w 1:1 -c 1:1 -a "/usr/bin/python /usr/bin/twistd --pidfile=/var/run/leap_mx.pid --rundir=/var/lib/leap_mx/ --python=/usr/share/app/leap_mx.tac --logfile=/var/log/leap/mx.log"\'' ],
       require => File['/etc/check_mk/mrpe.cfg'];
   }
 
diff --git a/puppet/modules/site_check_mk/manifests/agent/openvpn.pp b/puppet/modules/site_check_mk/manifests/agent/openvpn.pp
index 919a408d..0596a497 100644
--- a/puppet/modules/site_check_mk/manifests/agent/openvpn.pp
+++ b/puppet/modules/site_check_mk/manifests/agent/openvpn.pp
@@ -2,7 +2,7 @@ class site_check_mk::agent::openvpn {
 
   # check syslog
   concat::fragment { 'syslog_openpvn':
-    source  => 'puppet:///modules/site_check_mk/agent/logwatch/syslog/openvpn.cfg',
+    source  => 'puppet:///modules/site_check_mk/agent/logwatch/openvpn.cfg',
     target  => '/etc/check_mk/logwatch.d/syslog.cfg',
     order   => '02';
   }
diff --git a/puppet/modules/site_check_mk/manifests/agent/stunnel.pp b/puppet/modules/site_check_mk/manifests/agent/stunnel.pp
index 64022824..7f765771 100644
--- a/puppet/modules/site_check_mk/manifests/agent/stunnel.pp
+++ b/puppet/modules/site_check_mk/manifests/agent/stunnel.pp
@@ -1,7 +1,7 @@
 class site_check_mk::agent::stunnel {
 
   concat::fragment { 'syslog_stunnel':
-    source  => 'puppet:///modules/site_check_mk/agent/logwatch/syslog/stunnel.cfg',
+    source  => 'puppet:///modules/site_check_mk/agent/logwatch/stunnel.cfg',
     target  => '/etc/check_mk/logwatch.d/syslog.cfg',
     order   => '02';
   }
diff --git a/puppet/modules/site_openvpn/manifests/init.pp b/puppet/modules/site_openvpn/manifests/init.pp
index d6f9150b..e2a3124e 100644
--- a/puppet/modules/site_openvpn/manifests/init.pp
+++ b/puppet/modules/site_openvpn/manifests/init.pp
@@ -228,6 +228,7 @@ class site_openvpn {
       order   => 10;
   }
 
+  leap::logfile { 'openvpn': }
   include site_check_mk::agent::openvpn
 
 }
diff --git a/puppet/modules/site_stunnel/manifests/init.pp b/puppet/modules/site_stunnel/manifests/init.pp
index 2e0cf5b8..176b8618 100644
--- a/puppet/modules/site_stunnel/manifests/init.pp
+++ b/puppet/modules/site_stunnel/manifests/init.pp
@@ -29,6 +29,7 @@ class site_stunnel {
   $client_sections = keys($clients)
   site_stunnel::clients { $client_sections: }
 
+  leap::logfile { "stunnel": process => "stunnel4" }
   include site_stunnel::override_service
 }
 
diff --git a/puppet/modules/site_webapp/manifests/init.pp b/puppet/modules/site_webapp/manifests/init.pp
index ea64048b..f10ef00d 100644
--- a/puppet/modules/site_webapp/manifests/init.pp
+++ b/puppet/modules/site_webapp/manifests/init.pp
@@ -18,7 +18,6 @@ class site_webapp {
   include site_config::ruby::dev
   include site_webapp::apache
   include site_webapp::couchdb
-  include site_webapp::logging
   include site_haproxy
   include site_webapp::cron
   include site_config::x509::cert
@@ -173,6 +172,8 @@ class site_webapp {
     ensure => latest,
   }
 
+  leap::logfile { 'webapp': }
+
   include site_shorewall::webapp
   include site_check_mk::agent::webapp
 }
diff --git a/puppet/modules/site_webapp/manifests/logging.pp b/puppet/modules/site_webapp/manifests/logging.pp
deleted file mode 100644
index b414b82c..00000000
--- a/puppet/modules/site_webapp/manifests/logging.pp
+++ /dev/null
@@ -1,16 +0,0 @@
-class site_webapp::logging {
-
-  rsyslog::snippet { '01-webapp':
-    content => 'if $programname == "webapp" then /var/log/leap/webapp.log
-&~'
-  }
-
-  augeas {
-    'logrotate_webapp':
-      context => '/files/etc/logrotate.d/webapp/rule',
-      changes => [ 'set file /var/log/leap/webapp.log', 'set rotate 7',
-                   'set schedule daily', 'set compress compress',
-                   'set missingok missingok', 'set ifempty notifempty',
-                   'set copytruncate copytruncate' ]
-  }
-}
diff --git a/puppet/modules/tapicero/manifests/init.pp b/puppet/modules/tapicero/manifests/init.pp
index d4ff1acb..ca8488c8 100644
--- a/puppet/modules/tapicero/manifests/init.pp
+++ b/puppet/modules/tapicero/manifests/init.pp
@@ -133,17 +133,5 @@ class tapicero {
                     Couchdb::Add_user[$::site_couchdb::couchdb_tapicero_user] ];
   }
 
-  rsyslog::snippet { '99-tapicero':
-    content => 'if $programname startswith \'tapicero\' then /var/log/leap/tapicero.log
-&~'
-  }
-
-  augeas {
-    'logrotate_tapicero':
-      context => '/files/etc/logrotate.d/tapicero/rule',
-      changes => [ 'set file /var/log/leap/tapicero*.log', 'set rotate 7',
-                   'set schedule daily', 'set compress compress',
-                   'set missingok missingok', 'set ifempty notifempty',
-                   'set copytruncate copytruncate' ]
-  }
+  leap::logfile { 'tapicero': }
 }
-- 
cgit v1.2.3