Fix traditional and high precision timestamps for rsyslog

Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>

deployment/puppet/openstack/manifests/logging.pp

@@ -9,7 +9,14 @@
 # [rservers] array of hashes which represents remote logging servers for client role.
 # [port] port to use by server role for remote logging.
 # [proto] tcp/udp proto for remote log server role.
-# [show_timezone] if enabled, high_precision_timestamps with GMT would be used for server role. 
+# [show_timezone] if enabled, high_precision_timestamps (date-rfc3339) with GMT would be used 
+#   for local (and remote) logging. Default is false (date-rfc3164 based), in this case
+#   local logging would use date-rfc3164 traditional format, but remote logging would use 
+#   slightly modified traditional timestamps
+#   Examples:
+#     date-rfc3339: 2010-12-05T02:21:41.889482+01:00, 
+#     date-rfc3164: Dec 5 02:21:13,
+#     modified traditional timestamps: 2013-05-12T02:21:13
 # [virtual] if node is virtual, fix for udp checksums should be applied
 
 class openstack::logging (
@@ -33,6 +40,7 @@ validate_re($rotation, 'daily|weekly|monthly|yearly')
 
 if $role == 'client' {
   class { "::rsyslog::client":
+    high_precision_timestamps => $show_timezone,
     log_remote     => $log_remote,
     log_local      => $log_local,
     log_auth_local => $log_auth_local,

deployment/puppet/rsyslog/manifests/client.pp

@@ -3,6 +3,7 @@
 #
 
 class rsyslog::client (
+  $high_precision_timestamps = false,
   $log_remote     = true,
   $remote_type    = 'udp',
   $log_local      = true,

deployment/puppet/rsyslog/templates/00-server.conf.erb

@@ -39,11 +39,11 @@ $ActionQueueDequeueBatchSize 128
 $ActionResumeRetryCount -1
 $SystemLogRateLimitInterval 0   # disable rate limits for rsyslog
 
-#
-# Use traditional timestamp format.
-# To enable high precision timestamps, comment out the following line.
-#
 <% unless scope.lookupvar('rsyslog::server::high_precision_timestamps') -%>
+#
+# Use traditional timestamp format date-rfc3164 (Dec 5 02:21:13).
+# To enable high precision timestamps date-rfc3339 (2010-12-05T02:21:41.889482+01:00), comment out the following line.
+#
 $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
 <% end -%>
 

deployment/puppet/rsyslog/templates/30-server-remote-log.conf.erb

@@ -1,8 +1,15 @@
 # file is managed by puppet
 #
-# remote anaconda logs, uses predefined Fuel templates
-$template RemoteLog, "%$NOW%T%TIMESTAMP:8:$% %syslogseverity-text%: %msg%\n"
-# Would match 'kernel:'  -> 'kernel'    ;  'rsyslog[12345]:'  -> 'rsyslog' ; '<180>(nova.api.wsgi):'  ->  'nova.api.wsgi'
+# remote logs parsing based on syslogtag, uses predefined Fuel templates
+<% if scope.lookupvar('rsyslog::server::high_precision_timestamps') -%>
+# Use high precision timestamps (date-rfc3339, 2010-12-05T02:21:41.889482+01:00)
+$Template RemoteLog, "%TIMESTAMP:32::date-rfc3339% %syslogseverity-text%: %msg:drop-last-lf%\n"
+<% else -%>
+# Use modified traditional timestamps (date-rfc3164, Dec 5 02:21:13 -> 2013-05-12T02:21:13)
+$Template RemoteLog, "%$NOW%T%TIMESTAMP:8:$%Z %syslogseverity-text% %syslogtag% %msg:drop-last-lf%\n"
+<% end -%>
+
+# Would match 'kernel:' -> 'kernel'  ;  'rsyslogd[12345]:' -> 'rsyslogd'  ;  '<180>(nova.api.wsgi):'  ->  'nova.api.wsgi'
 $template RemoteLogFile, "/var/log/remote/%FROMHOST%/%syslogtag:R,ERE,1,DFLT:([A-Za-z][A-Za-z0-9_.-]*)--end%.log"
 
 :FROMHOST, regex, "^[1-9]" ?RemoteLogFile;RemoteLog

deployment/puppet/rsyslog/templates/90-local.conf.erb

@@ -1,9 +1,14 @@
 # file is managed by puppet
 #
-<% if scope.lookupvar('rsyslog::client::log_auth_local') or scope.lookupvar('rsyslog::client::log_local') -%>
-# We log locally, restore to default format
+<% unless scope.lookupvar('rsyslog::client::high_precision_timestamps') -%>
+#
+# Use traditional timestamp format date-rfc3164 (Dec 5 02:21:13).
+# To enable high precision timestamps date-rfc3339 (2010-12-05T02:21:41.889482+01:00), comment out the following line.
+#
 $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
+<% end -%>
 
+<% if scope.lookupvar('rsyslog::client::log_auth_local') or scope.lookupvar('rsyslog::client::log_local') -%>
 # Log auth messages locally
 auth,authpriv.*                 /var/log/auth.log
 <% end -%>

deployment/puppet/rsyslog/templates/99-remote.conf.erb

@@ -3,16 +3,21 @@
 <% if scope.lookupvar('rsyslog::client::log_remote') -%>
 # Log to remote syslog server using <%= scope.lookupvar('rsyslog::client::remote_type') %>
 # Templates
-$Template CustomLog, "%$NOW%T%TIMESTAMP:8:$%Z %syslogseverity-text% %syslogtag% %msg:drop-last-lf%\n"
-
+<% if scope.lookupvar('rsyslog::client::high_precision_timestamps') -%>
+# Use high precision timestamps (date-rfc3339, 2010-12-05T02:21:41.889482+01:00)
+$Template RemoteLog, "%TIMESTAMP:32::date-rfc3339% %syslogseverity-text%: %msg:drop-last-lf%\n"
+<% else -%>
+# Use modified traditional timestamps (date-rfc3164, Dec 5 02:21:13 -> 2013-05-12T02:21:13)
+$Template RemoteLog, "%$NOW%T%TIMESTAMP:8:$%Z %syslogseverity-text% %syslogtag% %msg:drop-last-lf%\n"
+<% end -%>
 <% scope.lookupvar('rsyslog::client::rservers_real').each do |rserver| -%>
 <% if ! ['localhost','127.0.0.1','::1'].include?(rserver['server']) -%>
 <% if rserver['remote_type'] == 'tcp' -%>
 # Send messages we receive to master node via tcp
-*.* @@<%= rserver['server']-%>:<%= rserver['port'] -%>;CustomLog
+*.* @@<%= rserver['server']-%>:<%= rserver['port'] -%>;RemoteLog
 <% else -%>
 # Send messages we receive to master node via udp
-*.* @<%= rserver['server'] -%>:<%= rserver['port'] -%>;CustomLog
+*.* @<%= rserver['server'] -%>:<%= rserver['port'] -%>;RemoteLog
 <% end -%>
 <% end -%>
 <% end -%>