Use journald input by default when running system integration for SLES 15-SP6 #13759
Conversation
pierrehilbert
added
enhancement
|
Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane) |
🚀 Benchmarks reportTo see the full report comment with |
andrewkroh
added
Integration:system
|
@pierrehilbert there are not testing steps in the description. Was it tested or you would like me to run the tests? |
|
@amolnater-qasource tested the fix by manually changing the configuration here: #13752 (comment) But always great to have more folks confirming this is working the correct way. |
|
💚 Build Succeeded
History
|
| @@ -1,4 +1,9 @@ | |||
| # newer versions go on top | |||
| - version: "2.0.1" | |||
There was a problem hiding this comment.
As this is not a bugfix but a behaviour change (default change based on new condition), I think we should do a minor upgrade (2.0.0 -> 2.1.0) instead of a patch upgrade (2.0.0 -> 2.0.1)
| - version: "2.0.1" | ||
| changes: | ||
| - description: Change default to use journald input for SLES 15 SP6. | ||
| type: enhancement |
There was a problem hiding this comment.
To me this looks to be a bugfix, since we don't support logfile for sles since the very beginning. Just that we had not added that to our config.
| type: enhancement | |
| type: bugfix |
|
@pierrehilbert |
| type: text | ||
| multi: false | ||
| required: false | ||
| show_user: true | ||
| default: ${host.os_version} == "12 (bookworm)" or (${host.os_platform} == "amzn" and ${host.os_version} == "2023") |
There was a problem hiding this comment.
qq: Why just SLES 15 (SP6)? I assume journald is primary logging system for other service packs as well other versions of SLES?
There was a problem hiding this comment.
Good point, could probably be replaced by startsWith(${host.os_version}, "15") == true
There was a problem hiding this comment.
https://documentation.suse.com/sles/12-SP5/html/SLES-all/cha-journalctl.html (see first line)
Also SLES 12. SLES 12 onwards, they are using journal. SLES 13, 14 doesn't exist. So I think we should handle SLES 12 and 15 with startsWith
https://www.theregister.com/2018/06/25/suse_linux_enterprise_15/
^ Reason why they skipped 13 and 14
SUSE jumped from SLES 12 to 15 as both 13 and 14 are unlucky numbers. While many are aware of the negative connotations attached to the number 13, in China, 14 is also considered unlucky. This is because the number 4 in Chinese (四, pinyin: sì; Cantonese Yale: sei) is almost homophonous to the word for 'death' (死 pinyin: sǐ; Cantonese Yale: séi). Therefore, SUSE was asked not to use these numbers by partners and customers alike.
There was a problem hiding this comment.
With the condition we want to catch the point where an existing OS release no longer included syslog by default, not just the point where journald was available.
For existing OS releases that included both syslog and journald, this integration is working without issue by reading from the syslog files. We could switch from syslog to journald there but it opens us to the chance that it breaks something unexpectedly.
Proposed commit message
Use journald input by default when running system integration for SLES 15-SP6.
Checklist
changelog.ymlfile.Author's Checklist
How to test this PR locally
Related issues
Screenshots