From 9f456b2c5cadfd2cf8033c741e4b31355969c942 Mon Sep 17 00:00:00 2001 From: Ian Bucad Date: Tue, 22 Mar 2022 13:34:02 +1100 Subject: [PATCH 1/7] Adds user-level unit filtering --- pkg/logs/config/integration_config.go | 8 +-- pkg/logs/internal/tailers/journald/tailer.go | 56 +++++++++++++++----- pkg/logs/status/builder.go | 6 ++- 3 files changed, 51 insertions(+), 19 deletions(-) diff --git a/pkg/logs/config/integration_config.go b/pkg/logs/config/integration_config.go index d4ecacedba7ab..cb4e3d9bd4725 100644 --- a/pkg/logs/config/integration_config.go +++ b/pkg/logs/config/integration_config.go @@ -44,9 +44,11 @@ type LogsConfig struct { ExcludePaths []string `mapstructure:"exclude_paths" json:"exclude_paths"` // File TailingMode string `mapstructure:"start_position" json:"start_position"` // File - IncludeUnits []string `mapstructure:"include_units" json:"include_units"` // Journald - ExcludeUnits []string `mapstructure:"exclude_units" json:"exclude_units"` // Journald - ContainerMode bool `mapstructure:"container_mode" json:"container_mode"` // Journald + IncludeSystemUnits []string `mapstructure:"include_units" json:"include_system_units" json:"include_units"` // Journald + ExcludeSystemUnits []string `mapstructure:"exclude_units" json:"exclude_system_units" json:"exclude_units"` // Journald + IncludeUserUnits []string `mapstructure:"include_user_units" json:"include_user_units"` // Journald + ExcludeUserUnits []string `mapstructure:"exclude_user_units" json:"exclude_user_units"` // Journald + ContainerMode bool `mapstructure:"container_mode" json:"container_mode"` // Journald Image string // Docker Label string // Docker diff --git a/pkg/logs/internal/tailers/journald/tailer.go b/pkg/logs/internal/tailers/journald/tailer.go index ac25d18728551..18f7e6010658b 100644 --- a/pkg/logs/internal/tailers/journald/tailer.go +++ b/pkg/logs/internal/tailers/journald/tailer.go @@ -29,12 +29,15 @@ const ( // Tailer collects logs from a journal. type Tailer struct { - source *config.LogSource - outputChan chan *message.Message - journal *sdjournal.Journal - blacklist map[string]bool - stop chan struct{} - done chan struct{} + source *config.LogSource + outputChan chan *message.Message + journal *sdjournal.Journal + excludeUnits struct { + system map[string]bool + user map[string]bool + } + stop chan struct{} + done chan struct{} } // NewTailer returns a new tailer. @@ -89,9 +92,10 @@ func (t *Tailer) setup() error { return err } - for _, unit := range config.IncludeUnits { - // add filters to collect only the logs of the units defined in the configuration, - // if no units are defined, collect all the logs of the journal by default. + // add filters to collect only the logs of the units defined in the configuration, + // if no units are defined for both System and User, collect all the logs of the journal by default. + for _, unit := range config.IncludeSystemUnits { + // add filters to collect only the logs of the system-level units defined in the configuration. match := sdjournal.SD_JOURNAL_FIELD_SYSTEMD_UNIT + "=" + unit err := t.journal.AddMatch(match) if err != nil { @@ -99,10 +103,25 @@ func (t *Tailer) setup() error { } } - t.blacklist = make(map[string]bool) - for _, unit := range config.ExcludeUnits { - // add filters to drop all the logs related to units to exclude. - t.blacklist[unit] = true + for _, unit := range config.IncludeUserUnits { + // add filters to collect only the logs of the user-level units defined in the configuration. + match := sdjournal.SD_JOURNAL_FIELD_SYSTEMD_USER_UNIT + "=" + unit + err := t.journal.AddMatch(match) + if err != nil { + return fmt.Errorf("could not add filter %s: %s", match, err) + } + } + + t.excludeUnits.system = make(map[string]bool) + for _, unit := range config.ExcludeSystemUnits { + // add filters to drop all the logs related to system units to exclude. + t.excludeUnits.system[unit] = true + } + + t.excludeUnits.user = make(map[string]bool) + for _, unit := range config.ExcludeUserUnits { + // add filters to drop all the logs related to user units to exclude. + t.excludeUnits.user[unit] = true } return nil @@ -168,7 +187,15 @@ func (t *Tailer) shouldDrop(entry *sdjournal.JournalEntry) bool { if !exists { return false } - if _, blacklisted := t.blacklist[unit]; blacklisted { + if _, excluded := t.excludeUnits.system[unit]; excluded { + // drop the entry + return true + } + unit, exists = entry.Fields[sdjournal.SD_JOURNAL_FIELD_SYSTEMD_USER_UNIT] + if !exists { + return false + } + if _, excluded := t.excludeUnits.user[unit]; excluded { // drop the entry return true } @@ -236,6 +263,7 @@ func (t *Tailer) getOrigin(entry *sdjournal.JournalEntry) *message.Origin { // applicationKeys represents all the valid attributes used to extract the value of the application name of a journal entry. var applicationKeys = []string{ sdjournal.SD_JOURNAL_FIELD_SYSLOG_IDENTIFIER, // "SYSLOG_IDENTIFIER" + sdjournal.SD_JOURNAL_FIELD_SYSTEMD_USER_UNIT, // "_SYSTEMD_USER_UNIT" sdjournal.SD_JOURNAL_FIELD_SYSTEMD_UNIT, // "_SYSTEMD_UNIT" sdjournal.SD_JOURNAL_FIELD_COMM, // "_COMM" } diff --git a/pkg/logs/status/builder.go b/pkg/logs/status/builder.go index b2ddd1e23658b..535921e459265 100644 --- a/pkg/logs/status/builder.go +++ b/pkg/logs/status/builder.go @@ -148,8 +148,10 @@ func (b *Builder) toDictionary(c *config.LogsConfig) map[string]interface{} { dictionary["Label"] = c.Label dictionary["Name"] = c.Name case config.JournaldType: - dictionary["IncludeUnits"] = strings.Join(c.IncludeUnits, ", ") - dictionary["ExcludeUnits"] = strings.Join(c.ExcludeUnits, ", ") + dictionary["IncludeSystemUnits"] = strings.Join(c.IncludeSystemUnits, ", ") + dictionary["ExcludeSystemUnits"] = strings.Join(c.ExcludeSystemUnits, ", ") + dictionary["IncludeUserUnits"] = strings.Join(c.IncludeUserUnits, ", ") + dictionary["ExcludeUserUnits"] = strings.Join(c.ExcludeUserUnits, ", ") case config.WindowsEventType: dictionary["ChannelPath"] = c.ChannelPath dictionary["Query"] = c.Query From 93133f927399c5937182feae69a9f3d95d8a1e34 Mon Sep 17 00:00:00 2001 From: Ian Bucad Date: Tue, 22 Mar 2022 21:25:20 +1100 Subject: [PATCH 2/7] address breaking change --- pkg/logs/config/integration_config.go | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/pkg/logs/config/integration_config.go b/pkg/logs/config/integration_config.go index cb4e3d9bd4725..2444c3a2b1567 100644 --- a/pkg/logs/config/integration_config.go +++ b/pkg/logs/config/integration_config.go @@ -44,11 +44,11 @@ type LogsConfig struct { ExcludePaths []string `mapstructure:"exclude_paths" json:"exclude_paths"` // File TailingMode string `mapstructure:"start_position" json:"start_position"` // File - IncludeSystemUnits []string `mapstructure:"include_units" json:"include_system_units" json:"include_units"` // Journald - ExcludeSystemUnits []string `mapstructure:"exclude_units" json:"exclude_system_units" json:"exclude_units"` // Journald - IncludeUserUnits []string `mapstructure:"include_user_units" json:"include_user_units"` // Journald - ExcludeUserUnits []string `mapstructure:"exclude_user_units" json:"exclude_user_units"` // Journald - ContainerMode bool `mapstructure:"container_mode" json:"container_mode"` // Journald + IncludeSystemUnits []string `mapstructure:"include_units" json:"include_units"` // Journald + ExcludeSystemUnits []string `mapstructure:"exclude_units" json:"exclude_units"` // Journald + IncludeUserUnits []string `mapstructure:"include_user_units" json:"include_user_units"` // Journald + ExcludeUserUnits []string `mapstructure:"exclude_user_units" json:"exclude_user_units"` // Journald + ContainerMode bool `mapstructure:"container_mode" json:"container_mode"` // Journald Image string // Docker Label string // Docker From 4d500b2b7148da8e01a7b167603309bb922db45a Mon Sep 17 00:00:00 2001 From: Ian Bucad Date: Mon, 28 Mar 2022 19:19:36 +1100 Subject: [PATCH 3/7] Allow wildcard exclusion --- pkg/logs/internal/tailers/journald/tailer.go | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/pkg/logs/internal/tailers/journald/tailer.go b/pkg/logs/internal/tailers/journald/tailer.go index 18f7e6010658b..cbd7d6e3d4486 100644 --- a/pkg/logs/internal/tailers/journald/tailer.go +++ b/pkg/logs/internal/tailers/journald/tailer.go @@ -187,7 +187,8 @@ func (t *Tailer) shouldDrop(entry *sdjournal.JournalEntry) bool { if !exists { return false } - if _, excluded := t.excludeUnits.system[unit]; excluded { + excludeAllSys := t.excludeUnits.system["*"] + if _, excluded := t.excludeUnits.system[unit]; excludeAllSys || excluded { // drop the entry return true } @@ -195,7 +196,8 @@ func (t *Tailer) shouldDrop(entry *sdjournal.JournalEntry) bool { if !exists { return false } - if _, excluded := t.excludeUnits.user[unit]; excluded { + excludeAllUsr := t.excludeUnits.user["*"] + if _, excluded := t.excludeUnits.user[unit]; excludeAllUsr || excluded { // drop the entry return true } From 92f65985289f1601a90d2eb3bd460c2abd99b595 Mon Sep 17 00:00:00 2001 From: Ian Bucad Date: Mon, 28 Mar 2022 20:27:18 +1100 Subject: [PATCH 4/7] Add tests --- .../internal/tailers/journald/tailer_test.go | 164 +++++++++++++++++- 1 file changed, 161 insertions(+), 3 deletions(-) diff --git a/pkg/logs/internal/tailers/journald/tailer_test.go b/pkg/logs/internal/tailers/journald/tailer_test.go index 80e66ed5ff3f4..515a243a195eb 100644 --- a/pkg/logs/internal/tailers/journald/tailer_test.go +++ b/pkg/logs/internal/tailers/journald/tailer_test.go @@ -36,9 +36,57 @@ func TestIdentifier(t *testing.T) { } func TestShouldDropEntry(t *testing.T) { - source := config.NewLogSource("", &config.LogsConfig{ExcludeUnits: []string{"foo", "bar"}}) - tailer := NewTailer(source, nil) - err := tailer.setup() + // System-level service units do not have SD_JOURNAL_FIELD_SYSTEMD_USER_UNIT + // User-level service units may have a common value for SD_JOURNAL_FIELD_SYSTEMD_UNIT + var tailer *Tailer + var source *config.LogSource + + // expect all but the specified System-level service units to be dropped + source = config.NewLogSource("", &config.LogsConfig{IncludeSystemUnits: []string{"foo", "bar"}}) + tailer = NewTailer(source, nil) + err = tailer.setup() + assert.Nil(t, err) + + assert.False(t, tailer.shouldDrop( + &sdjournal.JournalEntry{ + Fields: map[string]string{ + sdjournal.SD_JOURNAL_FIELD_SYSTEMD_UNIT: "foo", + }, + })) + + assert.True(t, tailer.shouldDrop( + &sdjournal.JournalEntry{ + Fields: map[string]string{ + sdjournal.SD_JOURNAL_FIELD_SYSTEMD_USER_UNIT: "bar", + sdjournal.SD_JOURNAL_FIELD_SYSTEMD_UNIT: "user@1000.service", + }, + })) + + // expect all but the specified User-level service units to be dropped + source = config.NewLogSource("", &config.LogsConfig{IncludeUserUnits: []string{"foo", "bar"}}) + tailer = NewTailer(source, nil) + err = tailer.setup() + assert.Nil(t, err) + + assert.True(t, tailer.shouldDrop( + &sdjournal.JournalEntry{ + Fields: map[string]string{ + sdjournal.SD_JOURNAL_FIELD_SYSTEMD_UNIT: "foo", + }, + })) + + assert.False(t, tailer.shouldDrop( + &sdjournal.JournalEntry{ + Fields: map[string]string{ + sdjournal.SD_JOURNAL_FIELD_SYSTEMD_USER_UNIT: "bar", + sdjournal.SD_JOURNAL_FIELD_SYSTEMD_UNIT: "user@1000.service", + }, + })) + + // expect only the specified service units to be dropped + source = config.NewLogSource("", &config.LogsConfig{ExcludeSystemUnits: []string{"foo", "bar"}, ExcludeUserUnits: []string{"baz", "qux"}}) + tailer = NewTailer(source, nil) + err = tailer.setup() assert.Nil(t, err) assert.True(t, tailer.shouldDrop( @@ -61,6 +109,102 @@ func TestShouldDropEntry(t *testing.T) { sdjournal.SD_JOURNAL_FIELD_SYSTEMD_UNIT: "boo", }, })) + + assert.False(t, tailer.shouldDrop( + &sdjournal.JournalEntry{ + Fields: map[string]string{ + sdjournal.SD_JOURNAL_FIELD_SYSTEMD_USER_UNIT: "bar", + sdjournal.SD_JOURNAL_FIELD_SYSTEMD_UNIT: "user@1000.service", + }, + })) + + assert.True(t, tailer.shouldDrop( + &sdjournal.JournalEntry{ + Fields: map[string]string{ + sdjournal.SD_JOURNAL_FIELD_SYSTEMD_USER_UNIT: "baz", + sdjournal.SD_JOURNAL_FIELD_SYSTEMD_UNIT: "user@1000.service", + }, + })) + + assert.True(t, tailer.shouldDrop( + &sdjournal.JournalEntry{ + Fields: map[string]string{ + sdjournal.SD_JOURNAL_FIELD_SYSTEMD_USER_UNIT: "qux", + sdjournal.SD_JOURNAL_FIELD_SYSTEMD_UNIT: "user@1000.service", + }, + })) + + // expect all System-level service units to be dropped + source = config.NewLogSource("", &config.LogsConfig{ExcludeSystemUnits: []string{"*"}}) + tailer = NewTailer(source, nil) + err = tailer.setup() + assert.Nil(t, err) + + assert.True(t, tailer.shouldDrop( + &sdjournal.JournalEntry{ + Fields: map[string]string{ + sdjournal.SD_JOURNAL_FIELD_SYSTEMD_UNIT: "foo", + }, + })) + + assert.True(t, tailer.shouldDrop( + &sdjournal.JournalEntry{ + Fields: map[string]string{ + sdjournal.SD_JOURNAL_FIELD_SYSTEMD_UNIT: "bar", + }, + })) + + assert.False(t, tailer.shouldDrop( + &sdjournal.JournalEntry{ + Fields: map[string]string{ + sdjournal.SD_JOURNAL_FIELD_SYSTEMD_USER_UNIT: "bar", + sdjournal.SD_JOURNAL_FIELD_SYSTEMD_UNIT: "user@1000.service", + }, + })) + + assert.False(t, tailer.shouldDrop( + &sdjournal.JournalEntry{ + Fields: map[string]string{ + sdjournal.SD_JOURNAL_FIELD_SYSTEMD_USER_UNIT: "baz", + sdjournal.SD_JOURNAL_FIELD_SYSTEMD_UNIT: "user@1000.service", + }, + })) + + // expect all User-level service units to be dropped + source = config.NewLogSource("", &config.LogsConfig{ExcludeUserUnits: []string{"*"}}) + tailer = NewTailer(source, nil) + err = tailer.setup() + assert.Nil(t, err) + + assert.False(t, tailer.shouldDrop( + &sdjournal.JournalEntry{ + Fields: map[string]string{ + sdjournal.SD_JOURNAL_FIELD_SYSTEMD_UNIT: "foo", + }, + })) + + assert.False(t, tailer.shouldDrop( + &sdjournal.JournalEntry{ + Fields: map[string]string{ + sdjournal.SD_JOURNAL_FIELD_SYSTEMD_UNIT: "bar", + }, + })) + + assert.True(t, tailer.shouldDrop( + &sdjournal.JournalEntry{ + Fields: map[string]string{ + sdjournal.SD_JOURNAL_FIELD_SYSTEMD_USER_UNIT: "bar", + sdjournal.SD_JOURNAL_FIELD_SYSTEMD_UNIT: "user@1000.service", + }, + })) + + assert.True(t, tailer.shouldDrop( + &sdjournal.JournalEntry{ + Fields: map[string]string{ + sdjournal.SD_JOURNAL_FIELD_SYSTEMD_USER_UNIT: "baz", + sdjournal.SD_JOURNAL_FIELD_SYSTEMD_UNIT: "user@1000.service", + }, + })) } func TestApplicationName(t *testing.T) { @@ -71,6 +215,16 @@ func TestApplicationName(t *testing.T) { &sdjournal.JournalEntry{ Fields: map[string]string{ sdjournal.SD_JOURNAL_FIELD_SYSLOG_IDENTIFIER: "foo", + sdjournal.SD_JOURNAL_FIELD_SYSTEMD_USER_UNIT: "foo-user.service", + sdjournal.SD_JOURNAL_FIELD_SYSTEMD_UNIT: "foo.service", + sdjournal.SD_JOURNAL_FIELD_COMM: "foo.sh", + }, + }, []string{})) + + assert.Equal(t, "foo-user.service", tailer.getApplicationName( + &sdjournal.JournalEntry{ + Fields: map[string]string{ + sdjournal.SD_JOURNAL_FIELD_SYSTEMD_USER_UNIT: "foo-user.service", sdjournal.SD_JOURNAL_FIELD_SYSTEMD_UNIT: "foo.service", sdjournal.SD_JOURNAL_FIELD_COMM: "foo.sh", }, @@ -147,6 +301,7 @@ func TestApplicationNameShouldBeDockerForContainerEntries(t *testing.T) { &sdjournal.JournalEntry{ Fields: map[string]string{ sdjournal.SD_JOURNAL_FIELD_SYSLOG_IDENTIFIER: "foo", + sdjournal.SD_JOURNAL_FIELD_SYSTEMD_USER_UNIT: "foo-user.service", sdjournal.SD_JOURNAL_FIELD_SYSTEMD_UNIT: "foo.service", sdjournal.SD_JOURNAL_FIELD_COMM: "foo.sh", containerIDKey: "bar", @@ -164,6 +319,7 @@ func TestApplicationNameShouldBeShortImageForContainerEntries(t *testing.T) { &sdjournal.JournalEntry{ Fields: map[string]string{ sdjournal.SD_JOURNAL_FIELD_SYSLOG_IDENTIFIER: "foo", + sdjournal.SD_JOURNAL_FIELD_SYSTEMD_USER_UNIT: "foo-user.service", sdjournal.SD_JOURNAL_FIELD_SYSTEMD_UNIT: "foo.service", sdjournal.SD_JOURNAL_FIELD_COMM: "foo.sh", containerIDKey: containerID, @@ -185,6 +341,7 @@ func TestApplicationNameShouldBeDockerWhenTagNotFound(t *testing.T) { &sdjournal.JournalEntry{ Fields: map[string]string{ sdjournal.SD_JOURNAL_FIELD_SYSLOG_IDENTIFIER: "foo", + sdjournal.SD_JOURNAL_FIELD_SYSTEMD_USER_UNIT: "foo-user.service", sdjournal.SD_JOURNAL_FIELD_SYSTEMD_UNIT: "foo.service", sdjournal.SD_JOURNAL_FIELD_COMM: "foo.sh", containerIDKey: containerID, @@ -209,6 +366,7 @@ func TestWrongTypeFromCache(t *testing.T) { &sdjournal.JournalEntry{ Fields: map[string]string{ sdjournal.SD_JOURNAL_FIELD_SYSLOG_IDENTIFIER: "foo", + sdjournal.SD_JOURNAL_FIELD_SYSTEMD_USER_UNIT: "foo-user.service", sdjournal.SD_JOURNAL_FIELD_SYSTEMD_UNIT: "foo.service", sdjournal.SD_JOURNAL_FIELD_COMM: "foo.sh", containerIDKey: containerID, From cc4df5402580272e31ba38bee4668e7362830b1b Mon Sep 17 00:00:00 2001 From: Ian Bucad Date: Mon, 28 Mar 2022 23:18:26 +1100 Subject: [PATCH 5/7] release note --- pkg/logs/internal/tailers/journald/tailer_test.go | 3 ++- .../Journald-User-level-unit-filtering-d0098f0a69e7caaa.yaml | 5 +++++ 2 files changed, 7 insertions(+), 1 deletion(-) create mode 100644 releasenotes/notes/Journald-User-level-unit-filtering-d0098f0a69e7caaa.yaml diff --git a/pkg/logs/internal/tailers/journald/tailer_test.go b/pkg/logs/internal/tailers/journald/tailer_test.go index 515a243a195eb..07c29bbac4527 100644 --- a/pkg/logs/internal/tailers/journald/tailer_test.go +++ b/pkg/logs/internal/tailers/journald/tailer_test.go @@ -38,8 +38,9 @@ func TestIdentifier(t *testing.T) { func TestShouldDropEntry(t *testing.T) { // System-level service units do not have SD_JOURNAL_FIELD_SYSTEMD_USER_UNIT // User-level service units may have a common value for SD_JOURNAL_FIELD_SYSTEMD_UNIT - var tailer *Tailer var source *config.LogSource + var tailer *Tailer + var err error // expect all but the specified System-level service units to be dropped source = config.NewLogSource("", &config.LogsConfig{IncludeSystemUnits: []string{"foo", "bar"}}) diff --git a/releasenotes/notes/Journald-User-level-unit-filtering-d0098f0a69e7caaa.yaml b/releasenotes/notes/Journald-User-level-unit-filtering-d0098f0a69e7caaa.yaml new file mode 100644 index 0000000000000..50e0ae9038f3e --- /dev/null +++ b/releasenotes/notes/Journald-User-level-unit-filtering-d0098f0a69e7caaa.yaml @@ -0,0 +1,5 @@ +--- +features: + - Adds User-level service unit filtering support for Journald log collection via `include_user_units` and `exclude_user_units`. + - A wildcard (`*`) can be used in either `exclude_units` or `exclude_user_units` + if only a particular type of Journald log is desired. From 8ee132d6442f8d2f2f55f7ddd36243edbf238239 Mon Sep 17 00:00:00 2001 From: Ian Bucad Date: Wed, 30 Mar 2022 00:19:33 +1100 Subject: [PATCH 6/7] fix wildcard exclude system also excludes user units --- pkg/logs/internal/tailers/journald/tailer.go | 28 +++++++------ .../internal/tailers/journald/tailer_test.go | 42 ------------------- 2 files changed, 15 insertions(+), 55 deletions(-) diff --git a/pkg/logs/internal/tailers/journald/tailer.go b/pkg/logs/internal/tailers/journald/tailer.go index cbd7d6e3d4486..89fee997e371d 100644 --- a/pkg/logs/internal/tailers/journald/tailer.go +++ b/pkg/logs/internal/tailers/journald/tailer.go @@ -183,23 +183,25 @@ func (t *Tailer) tail() { // shouldDrop returns true if the entry should be dropped, // returns false otherwise. func (t *Tailer) shouldDrop(entry *sdjournal.JournalEntry) bool { - unit, exists := entry.Fields[sdjournal.SD_JOURNAL_FIELD_SYSTEMD_UNIT] + sysUnit, exists := entry.Fields[sdjournal.SD_JOURNAL_FIELD_SYSTEMD_UNIT] if !exists { return false } - excludeAllSys := t.excludeUnits.system["*"] - if _, excluded := t.excludeUnits.system[unit]; excludeAllSys || excluded { - // drop the entry - return true - } - unit, exists = entry.Fields[sdjournal.SD_JOURNAL_FIELD_SYSTEMD_USER_UNIT] + usrUnit, exists := entry.Fields[sdjournal.SD_JOURNAL_FIELD_SYSTEMD_USER_UNIT] if !exists { - return false - } - excludeAllUsr := t.excludeUnits.user["*"] - if _, excluded := t.excludeUnits.user[unit]; excludeAllUsr || excluded { - // drop the entry - return true + // JournalEntry is a System-level unit + excludeAllSys := t.excludeUnits.system["*"] + if _, excluded := t.excludeUnits.system[sysUnit]; excludeAllSys || excluded { + // drop the entry + return true + } + } else { + // JournalEntry is a User-level unit + excludeAllUsr := t.excludeUnits.user["*"] + if _, excluded := t.excludeUnits.user[usrUnit]; excludeAllUsr || excluded { + // drop the entry + return true + } } return false } diff --git a/pkg/logs/internal/tailers/journald/tailer_test.go b/pkg/logs/internal/tailers/journald/tailer_test.go index 07c29bbac4527..ca90d6b6cbb67 100644 --- a/pkg/logs/internal/tailers/journald/tailer_test.go +++ b/pkg/logs/internal/tailers/journald/tailer_test.go @@ -42,48 +42,6 @@ func TestShouldDropEntry(t *testing.T) { var tailer *Tailer var err error - // expect all but the specified System-level service units to be dropped - source = config.NewLogSource("", &config.LogsConfig{IncludeSystemUnits: []string{"foo", "bar"}}) - tailer = NewTailer(source, nil) - err = tailer.setup() - assert.Nil(t, err) - - assert.False(t, tailer.shouldDrop( - &sdjournal.JournalEntry{ - Fields: map[string]string{ - sdjournal.SD_JOURNAL_FIELD_SYSTEMD_UNIT: "foo", - }, - })) - - assert.True(t, tailer.shouldDrop( - &sdjournal.JournalEntry{ - Fields: map[string]string{ - sdjournal.SD_JOURNAL_FIELD_SYSTEMD_USER_UNIT: "bar", - sdjournal.SD_JOURNAL_FIELD_SYSTEMD_UNIT: "user@1000.service", - }, - })) - - // expect all but the specified User-level service units to be dropped - source = config.NewLogSource("", &config.LogsConfig{IncludeUserUnits: []string{"foo", "bar"}}) - tailer = NewTailer(source, nil) - err = tailer.setup() - assert.Nil(t, err) - - assert.True(t, tailer.shouldDrop( - &sdjournal.JournalEntry{ - Fields: map[string]string{ - sdjournal.SD_JOURNAL_FIELD_SYSTEMD_UNIT: "foo", - }, - })) - - assert.False(t, tailer.shouldDrop( - &sdjournal.JournalEntry{ - Fields: map[string]string{ - sdjournal.SD_JOURNAL_FIELD_SYSTEMD_USER_UNIT: "bar", - sdjournal.SD_JOURNAL_FIELD_SYSTEMD_UNIT: "user@1000.service", - }, - })) - // expect only the specified service units to be dropped source = config.NewLogSource("", &config.LogsConfig{ExcludeSystemUnits: []string{"foo", "bar"}, ExcludeUserUnits: []string{"baz", "qux"}}) tailer = NewTailer(source, nil) From 6d8ffc646ec551691318c20b75d35741739b18ff Mon Sep 17 00:00:00 2001 From: Ian Bucad Date: Tue, 5 Apr 2022 22:38:18 +1000 Subject: [PATCH 7/7] Fix if both include filters used --- pkg/logs/internal/tailers/journald/tailer.go | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/pkg/logs/internal/tailers/journald/tailer.go b/pkg/logs/internal/tailers/journald/tailer.go index 89fee997e371d..390a8f0470b5f 100644 --- a/pkg/logs/internal/tailers/journald/tailer.go +++ b/pkg/logs/internal/tailers/journald/tailer.go @@ -103,6 +103,14 @@ func (t *Tailer) setup() error { } } + if len(config.IncludeSystemUnits) > 0 && len(config.IncludeUserUnits) > 0 { + // add Logical OR if both System and User include filters are used. + err := t.journal.AddDisjunction() + if err != nil { + return fmt.Errorf("could not logical OR in the match list: %s", err) + } + } + for _, unit := range config.IncludeUserUnits { // add filters to collect only the logs of the user-level units defined in the configuration. match := sdjournal.SD_JOURNAL_FIELD_SYSTEMD_USER_UNIT + "=" + unit