Re: A question about phosphor-sel-logger

["Bills, Jason M" <jason.m.bills@linux.intel.com>]

On 5/2/2019 8:39 PM, Will Liang (梁永鉉) wrote:
> Hi Jason,
> 
> I am very thankful that you reply me quickly and it's great to hear that you are working on this issue.
> If you can share your rsyslog configuration with me that will be a good news for me, I can trace it first.
I will share my rsyslog configuration file below.  It requires the 
imjournal module to be installed which can be done by adding 
'PACKAGECONFIG_append = " imjournal"' to an rsyslog_%.bbappend file.

> 
> According to the above URL, is it something I missed, I did not find the "add sel" to sys log function?

If the imjournal rsyslog module works well enough, then the "add sel" 
function won't need to change.  SEL entries will still be added to the 
journal and the imjournal module will read the journal to find new SEL 
entries for rsyslog to save to the SEL log file.

> I wander to know how you add sel to sys log. Or you want to share it after internal testing.
> 
I'm willing to share whatever you are interested in, but it may change 
if internal testing finds issues.  I'm planning to push the entire 
solution once we complete initial internal testing.

For clearing the log to work, you need to add "Reload" support to the 
rsyslog service file.  I do this by adding this line to an override 
.conf file:
ExecReload=/bin/kill -HUP $MAINPID

Here is my rsyslog.conf file which configures the entries the imjournal 
module is looking for and how to format them in the syslog files:
# if you experience problems, check
# http://www.rsyslog.com/troubleshoot for assistance

# rsyslog v3: load input modules
# If you do not load inputs, nothing happens!
# You may need to set the module load path if modules are not found.
#
# Ported from debian's sysklogd.conf

# Journal-style logging
# Limit to no more than 2000 entries in one minute and enable the
# journal workaround to avoid duplicate entries
module(load="imjournal" StateFile="/var/log/state"
                         RateLimit.Interval="60"
                         RateLimit.Burst="2000"
                         WorkAroundJournalBug="on")

# Template for IPMI SEL messages
# "<timestamp> <ID>,<Type>,<EventData>,[<Generator ID>,<Path>,<Direction>]"
template(name="IPMISELTemplate" type="list") {
     property(name="timereported" dateFormat="rfc3339")
     constant(value=" ")
     property(name="$!IPMI_SEL_RECORD_ID")
     constant(value=",")
     property(name="$!IPMI_SEL_RECORD_TYPE")
     constant(value=",")
     property(name="$!IPMI_SEL_DATA")
     constant(value=",")
     property(name="$!IPMI_SEL_GENERATOR_ID")
     constant(value=",")
     property(name="$!IPMI_SEL_SENSOR_PATH")
     constant(value=",")
     property(name="$!IPMI_SEL_EVENT_DIR")
     constant(value="\n")
}

# Template for Redfish messages
# "<timestamp> <MessageId>,<MessageArgs>"
template(name="RedfishTemplate" type="list") {
     property(name="timereported" dateFormat="rfc3339")
     constant(value=" ")
     property(name="$!REDFISH_MESSAGE_ID")
     constant(value=",")
     property(name="$!REDFISH_MESSAGE_ARGS")
     constant(value="\n")
}

# If the journal entry has the IPMI SEL MESSAGE_ID, save as IPMI SEL
if ($!MESSAGE_ID == "b370836ccf2f4850ac5bee185b77893a") then {
    action(type="omfile" file="/var/log/ipmi_sel" 
template="IPMISELTemplate")
}

# If the journal entry has a Redfish MessageId, save as a Redfish event
if ($!REDFISH_MESSAGE_ID != "") then {
    action(type="omfile" file="/var/log/redfish" template="RedfishTemplate")
}

#
# Include all config files in /etc/rsyslog.d/
#
$IncludeConfig /etc/rsyslog.d/*.conf