Merge OpenStack related logs meaningfully.
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
Miguel Angel Ajo 5b9c82746b Bump version to 1.1.0 for release 2 years ago
contrib Added a new probe: netprobe 3 years ago
oslogmerger Bump version to 1.1.0 for release 2 years ago
packaging/fedora clean empty bullet at the end of the changelog section 2 years ago
.gitreview Add .gitreview file 2 years ago
CHANGELOG.rst Bump version to 1.1.0 for release 2 years ago
LICENSE Add Apache license 3 years ago
README.rst Updated netprobe, and added netprobe.log to auto alias 3 years ago
setup.cfg Fixed rst file, bumped version, fixed homepage link 3 years ago Add Gorka as author too 3 years ago






What is os-log-merger?

os-log-merger stands for OpenStack LOG merger, it's a tool designed to take a bunch of openstack logs across different projects, and merge them in a single file, ordered by time entries.

It should work as long as the logs are based on oslo logger output.

Quick presentation:


This tool is not able to properly (or meaningfully) merge logs if your servers are not time synced to a common time source.

By default os-log-merger uses a memory hogging implementation because it provides a considerable time reduction to complete the merging. This implementation loads all file contents in memory and then sorts and then proceeds to output merged result.

For operation on memory constrained systems and with log files of considerable sizes os-log-merger can operate on a memory conservative mode where log entries will be read from files one by one and sorted as they come.

This memory reduction has an impact on processing speed, and will increase the time to process the files by 25%.

How to install

pip install os-log-merger

Basic Usage

Please note that the :NS1, :NS2, :OVS1, :OVS2 are aliases and can be omitted, and in such case, the extra column used to associate a log file to a log line will use the original file path instead of the [ALIAS]

The previous example would produce something like this:

2015-08-25 09:37:15.463 [NS1] 15062 DEBUG neutron.context [req-b751a750-f5d8-4b6e-9af3-82d143ef9416 None] Arguments dropped when creating context: {u'project_name': None, u'tenant': None} __init__ /usr/lib/python2.7/site-packages/neutron/
2015-08-25 09:37:15.463 [NS1] 15062 DEBUG neutron.plugins.ml2.db [req-b751a750-f5d8-4b6e-9af3-82d143ef9416 None] get_ports_and_sgs() called for port_ids [u'4136d577-e02f-47c1-b543-f0bfd65ef85e', u'5d5ea109-4807-4df3-bef4-b5d89c3ffebc', u'6adcffbf-09d5-4a85-9339-9d6beb2bf82c', u'6b4d7b51-c87d-483e-9606-0e2a54ad8184', u'743ccaa6-7ed9-4195-aabd-3d55006338e1', u'dc662767-61a5-4807-b2ed-a7c76b541fd6', u'4decdd33-6f13-46df-b2f0-d9ff99878514', u'34b826df-9787-443c-9bef-084374827a85', u'7bbc404b-3df7-498a-b6fb-e81f9370a19f', u'c12e6e06-ff6a-44dc-b75f-78ec55dd3dd3', u'586cd86d-59d0-434b-ab27-76975ce5abc4', u'79b33879-3232-4b3a-a27c-c0a79da10379', u'ba6a28cc-9851-4cd7-acae-40034a19c761', u'05c4115a-da58-41db-b3f7-7326e1a22971'] get_ports_and_sgs /usr/lib/python2.7/site-packages/neutron/plugins/ml2/
2015-08-25 09:37:15.463 [OVS1] 12613 DEBUG neutron.agent.linux.utils [req-588c942a-6526-464f-a447-782a5e2d436a None]
                                    Command: ['sudo', 'neutron-rootwrap', '/etc/neutron/rootwrap.conf', 'ovs-vsctl', '--timeout=10', 'list-ports', 'br-int']
                                    Exit code: 0
                                    Stdout: 'ha-2cdba01d-e4\nha-44dca3a9-44\nha-499d3db7-97\nha-55a19f5e-ef\nha-b2d04f15-f2\nha-b5b271a1-d8\nha-fa58d644-81\nint-br-enp7s0\nint-br-ex\nqr-34b826df-97\nqr-5d5ea109-48\nqr-6adcffbf-09\nqr-743ccaa6-7e\nqr-79b33879-32\nqr-c12e6e06-ff\nqr-dc662767-61\n'

References to http url files instead of local files is also supported. Files will be cached locally to avoid re-downloading on next runs.

Limit memory usage

We can disabled default speed optimized operation for those case were we want to favor a small memory footprint by using option -m (--min-memory).

Common Base

In many cases we'll have a common base directory where log reside and they'll probably share the .log extension. So for the shake of brevity os-log-merger allows setting the base directory and postfix for all files with the -b and -p option (--log-base and --log-postfix long options).

Example for Cinder:


os-log-merger also supports /var/log/messages type of files with options -ml and --msg-logs options.

Since the format for those files is missing year information -MAR 24 14:11:19-the year from the last file modification will be used.

These files can also be specified with globs and they support alias definition as well.

Beware that openstack files should be listed before -ml option files.

Example for Cinder:

Timestamped logs

os-log-merger also supports timestamped -[ 0.003036]- with options -tl and --timestamp-logs options.

Since timestamp many times will not take epoc time as the source of the timestamp but the time the system started, the initial datetime will be calculated by substracting from the file modified datetime the last timestamp in the file.

These files can also be specified with globs and they support alias definition as well.

Beware that openstack files should be listed before -tl option files.

Example for Cinder:

Auto Alias

As we've seen above you can easily set you alias using :ALIAS after each log file, but since most of log files names and locations are well known, os-log-merger has an auto alias feature with different levels to adapt to your specific needs.

If an alias has been defined in the command line it will disable the auto alias on that file.

Level 0

The most basic auto alias generation level is level 0, and is the default behavior explained above, where the file path is used as an alias.

Level 1

Since default configuration will create considerable long aliases, you can use level 1 when using base directory and log postfix options to remove them from the alias.

Then the following command line:

Would use api, scheduler and volume aliases:

2016-02-01 12:11:17.573 [api] ...
2016-02-01 12:11:17.701 [scheduler] ...
2016-02-01 11:11:18.667 [volume] ...

Level 2

In some cases we may want to use globbing patterns and auto alias level 1 is no longer useful, so you want to have the filename extensions removed as well as the common paths and reduce the well know log filenames.

With level 2 os-log-merger will remove all common parts of the path as long as resulting paths can still uniquely identify the files within the prefixing path.

It will also rename well known files like cinder/scheduler.log with c-sch like in this example:

That will give you:

2016-02-01 10:23:34.680 [node1/C-API] ...
2016-02-01 10:24:34.690 [node1/C-SCH] ...
2016-02-01 10:25:34.700 [node1/C-VOL] ...
2016-02-01 10:26:34.710 [node1/N-API] ...
2016-02-01 10:27:34.680 [node2/N-CPU] ...

Level 3

Depending on the name of your non common directories in your log paths you may want to go one step further and reduce them to the minimum instead of preserving them unaltered.

Replacing Level 2 auto alias generation in the previous command with the same files:

Would result in:

2016-02-01 10:23:34.680 [1/C-API] ...
2016-02-01 10:24:34.690 [1/C-SCH] ...
2016-02-01 10:25:34.700 [1/C-VOL] ...
2016-02-01 10:26:34.710 [1/N-API] ...
2016-02-01 10:27:34.680 [2/N-CPU] ...

System probes

A set of system probes are provided as companion tools to help debugging common issues.


Under the probes directory can be found, this tool depends on tcpdump being available on the host.

This probe will inspect the system for new UP network devices periodically, and when found, a tcpdump will be started with the configured filter, logging everything on the openstack log format.

The net namespaces are not filtered by default.

The network interfaces default filter is:


The default packet filter is:

(arp or rarp) or (udp and (port 67 or port 68)) or icmp or icmp6

Usage details:

usage: netprobe [-h] [-v] [--netns-re NETNS_REGEX] [--netdev-re NETDEV_REGEX]
                [--tcpdump-filter TCPDUMP_FILTER]
                [--check-interval CHECK_INTERVAL]

This tool will track system network devices as they appear in a host,
and start tcpdump processes for each of them, while the output of all
the tcpdumps goes in a single openstack-like log.

optional arguments:
  -h, --help            show this help message and exit
  -v, --version         show program's version number and exit
  --netns-re NETNS_REGEX, -n NETNS_REGEX
  --tcpdump-filter TCPDUMP_FILTER, -t TCPDUMP_FILTER
  --check-interval CHECK_INTERVAL, -i CHECK_INTERVAL
                        The interval between interface checks
  --output-file OUTPUT_FILE, -o OUTPUT_FILE