From f6c09fcac4fa1983fd5ac24ec34870f942535bcf Mon Sep 17 00:00:00 2001
From: Cyril de Bourgues <cyril.debourgues@infomaniak.com>
Date: Tue, 1 Jun 2021 13:45:45 +0200
Subject: [PATCH] legacy kern log format to keep  drive-audit parsing working

---
 puppet/files/rsyslog/10-kern-legacy.conf | 11 ++++++++++
 puppet/manifests/swiftproxy.pp           | 26 ++++++++++++++++++++++++
 puppet/manifests/swiftstore.pp           | 26 ++++++++++++++++++++++++
 3 files changed, 63 insertions(+)
 create mode 100644 puppet/files/rsyslog/10-kern-legacy.conf

diff --git a/puppet/files/rsyslog/10-kern-legacy.conf b/puppet/files/rsyslog/10-kern-legacy.conf
new file mode 100644
index 00000000..2c725424
--- /dev/null
+++ b/puppet/files/rsyslog/10-kern-legacy.conf
@@ -0,0 +1,11 @@
+$template kernLogs,"%timegenerated% %HOSTNAME% %syslogtag%%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n"
+
+if $syslogfacility == 0 then {
+  action(
+    type="omfile"
+    FileCreateMode="0640"
+    fileGroup="adm"
+    file="/var/log/kern-legacy.log"
+    template="kernLogs"
+  )
+}
diff --git a/puppet/manifests/swiftproxy.pp b/puppet/manifests/swiftproxy.pp
index 5e294ebd..0abd3712 100644
--- a/puppet/manifests/swiftproxy.pp
+++ b/puppet/manifests/swiftproxy.pp
@@ -777,6 +777,32 @@ OnFailure=
       ensure => present,
     }
 
+    file { '/etc/rsyslog.d/10-kern-legacy.conf':
+      ensure => present,
+      source => 'puppet:///modules/oci/rsyslog/10-kern-legacy.conf',
+      path => '/etc/rsyslog.d/10-kern-legacy.conf',
+      group => 'root',
+      owner => 'root',
+      mode => '0644',
+      require => [Package['rsyslog']],
+      notify  => Service['rsyslog'],
+    }
+
+    logrotate::rule { 'kern-legacy':
+      path           => '/var/log/kern-legacy.log',
+      rotate         => '4',
+      rotate_every   => 'week',
+      missingok      => true,
+      ifempty        => false,
+      compress       => true,
+      delaycompress  => true,
+      postrotate     => '/usr/lib/rsyslog/rsyslog-rotate',
+    }
+
+    swift_drive_audit_config {
+      'drive-audit/log_file_pattern': value => '/var/log/kern-legacy.*[!.][!g][!z]';
+    }
+
     if $swift_store_account {
       $rings1 = [ 'account' ]
     }else{
diff --git a/puppet/manifests/swiftstore.pp b/puppet/manifests/swiftstore.pp
index 52048ec2..c67d8fe9 100644
--- a/puppet/manifests/swiftstore.pp
+++ b/puppet/manifests/swiftstore.pp
@@ -281,6 +281,32 @@ OnFailure=
     ensure => present,
   }
 
+  file { '/etc/rsyslog.d/10-kern-legacy.conf':
+    ensure => present,
+    source => 'puppet:///modules/oci/rsyslog/10-kern-legacy.conf',
+    path => '/etc/rsyslog.d/10-kern-legacy.conf',
+    group => 'root',
+    owner => 'root',
+    mode => '0644',
+    require => [Package['rsyslog']],
+    notify  => Service['rsyslog'],
+  }
+
+  logrotate::rule { 'kern-legacy':
+    path           => '/var/log/kern-legacy.log',
+    rotate         => '4',
+    rotate_every   => 'week',
+    missingok      => true,
+    ifempty        => false,
+    compress       => true,
+    delaycompress  => true,
+    postrotate     => '/usr/lib/rsyslog/rsyslog-rotate',
+  }
+
+  swift_drive_audit_config {
+    'drive-audit/log_file_pattern': value => '/var/log/kern-legacy.*[!.][!g][!z]';
+  }
+
   if $swift_store_account {
     $rings1 = [ 'account' ]
   }else{
-- 
GitLab