Skip to content

Conversation

Apokleos
Copy link
Contributor

@Apokleos Apokleos commented Jul 31, 2025

Route kata-shim logs directly to systemd-journald under 'kata' identifier

This refactoring enables kata-shim logs to be properly attributed to 'kata' in systemd-journald, instead of inheriting the 'containerd' identifier.

Previously, kata-shim logs were challenging to filter and debug as they appeared under the containerd.service unit.

This commit resolves this by:

  1. Introducing a LogDestination enum to explicitly define logging targets (File or Journal).
  2. Modifying logger creation to set SYSLOG_IDENTIFIER=kata when logging to Journald.
  3. Ensuring type safety and correct ownership handling for different logging backends.

This significantly enhances the observability and debuggability of Kata Containers, making it easier to monitor and troubleshoot Kata-specific events.

Fixes: #11590

Signed-off-by: Hyounggyu Choi Hyounggyu.Choi@ibm.com
Signed-off-by: Alex Lyn alex.lyn@antgroup.com

@Apokleos
Copy link
Contributor Author

This PR mainly based on Choi's patch, Let's move it forward together.

@Apokleos
Copy link
Contributor Author

Hey Steve @stevenhorsman , I am working on labeling kata log based on the patchset shared by Choi @BbolroC PTAL. It's mainly to address the related issues in the PR

Copy link
Member

@stevenhorsman stevenhorsman left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The code seems reasonable. Let me pull it into the test PR and undo that log redirects to try and test it in practice

// Use the .new() method to build a child logger which inherits all existing
// key-value pairs from its parent and supplements them with additional ones.
// This is the idiomatic way.
base_logger.new(o!("SYSLOG_IDENTIFIER" => "kata"))
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

optional thought: Should we extract kata as the syslog identifier to be a constant at the top of the file for more visibility (not that I'm expecting we would need to update it in future though)?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah,sound reasonable. I will update it later

@stevenhorsman
Copy link
Member

In https://github.com/kata-containers/kata-containers/actions/runs/16644091629/job/47104336991 I ran this code and the result was:

  ok 1 Test that creating a container from an encrypted image, with no decryption key fails

and this test has:

assert_logs_contain "${node}" kata "${node_start_time}" 'Failed to decrypt the image layer, please ensure that the decryption key is placed and correct'

which suggests the logging to the kata syslog id is working 😄

Copy link
Member

@stevenhorsman stevenhorsman left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM and the testing seemed to work ok

@Apokleos
Copy link
Contributor Author

In https://github.com/kata-containers/kata-containers/actions/runs/16644091629/job/47104336991 I ran this code and the result was:

  ok 1 Test that creating a container from an encrypted image, with no decryption key fails

and this test has:

assert_logs_contain "${node}" kata "${node_start_time}" 'Failed to decrypt the image layer, please ensure that the decryption key is placed and correct'

which suggests the logging to the kata syslog id is working 😄

Thx Steve @stevenhorsman for this report😄.

@BbolroC
Copy link
Member

BbolroC commented Aug 1, 2025

Hehe, thanks @Apokleos for taking care of this. I wanted to approve this, but I am a co-author, so let's invite another reviewer here. @gkurz Could you review this PR?

@BbolroC BbolroC requested a review from gkurz August 1, 2025 07:32
Copy link
Contributor

@burgerdev burgerdev left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm, thanks!

@@ -14,7 +14,7 @@ pub(crate) fn set_logger(path: &str, sid: &str, is_debug: bool) -> Result<slog_a
//it's better to open the log pipe file with read & write option,
//otherwise, once the containerd reboot and closed the read endpoint,
//kata shim would write the log pipe with broken pipe error.
let fifo = std::fs::OpenOptions::new()
let _fifo = std::fs::OpenOptions::new()
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why do we keep this around?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

will update the code without it.

@Apokleos Apokleos requested a review from lifupan August 7, 2025 02:24
@Apokleos Apokleos marked this pull request as ready for review August 7, 2025 03:09
Route kata-shim logs directly to systemd-journald under 'kata' identifier.

This refactoring enables `kata-shim` logs to be properly attributed to
'kata' in systemd-journald, instead of inheriting the 'containerd'
identifier.

Previously, `kata-shim` logs were challenging to filter and debug as
they
appeared under the `containerd.service` unit.

This commit resolves this by:
1.  Introducing a `LogDestination` enum to explicitly define logging
targets (File or Journal).
2.  Modifying logger creation to set `SYSLOG_IDENTIFIER=kata` when
logging
to Journald.
3.  Ensuring type safety and correct ownership handling for different
logging backends.

This significantly enhances the observability and debuggability of Kata
Containers, making it easier to monitor and troubleshoot Kata-specific
events.

Fixes: kata-containers#11590

Signed-off-by: Hyounggyu Choi <Hyounggyu.Choi@ibm.com>
Signed-off-by: Alex Lyn <alex.lyn@antgroup.com>
Copy link
Member

@BbolroC BbolroC left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thanks @Apokleos !

@BbolroC BbolroC merged commit 407252a into kata-containers:main Aug 11, 2025
506 of 539 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

runtime-rs: system log not labeled with kata
4 participants