[release-4.22] OCPBUGS-86291: ebpf: consolidate packet event logs into single line#711
Conversation
Previously, firewall packet events were logged as three separate syslog
messages (rule info, IP addresses, protocol details), making log parsing
and analysis more difficult. This change consolidates all packet event
information into a single log line for better observability.
Changes:
- Merge three separate eventsLogger.Info() calls into one
- Use strings.Builder and fmt.Fprintf for efficient log construction
- Use pipe separators (|) to delimit log sections visually
Example output format:
Before (3 lines):
ruleId 10 action Drop len 74 if br1
ipv4 src addr 192.xx.xx.149 dst addr 192.xx.xx.56
tcp srcPort 56354 dstPort 22
After (1 line):
ruleId 10 action Drop len 74 if br1 | ipv4 src 192.xx.xx.149 dst 192.xx.xx.56 | tcp srcPort 56354 dstPort 22
This improves log grep-ability, parsing, and integration with log
aggregation tools where single-line entries are preferred.
Signed-off-by: Ramesh Sahoo <rsahoo@redhat.com>
Update event parsing regex patterns in test/e2e/events/events.go to
match the new single-line log format with pipe delimiters.
Changes:
- Replace newline separators (\n) with pipe delimiters (\s\|\s)
- Remove 'addr' keyword from IP address fields
- Add IP version prefix matching (ipv4|ipv6)
- Use raw string literals (backticks) to avoid escaping backslashes
Old format (multi-line):
ruleId 10 action Drop len 98 if eth0
ipv4 src addr 172.20.0.1 dst addr 172.20.0.4
tcp srcPort 12345 dstPort 8080
New format (single line):
ruleId 10 action Drop len 98 if eth0 | ipv4 src 172.20.0.1 dst 172.20.0.4 | tcp srcPort 12345 dstPort 8080
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Repository: openshift/coderabbit/.coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: openshift-cherrypick-robot The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
@openshift-cherrypick-robot: Jira Issue OCPBUGS-76699 has been cloned as Jira Issue OCPBUGS-86291. Will retitle bug to link to clone. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci
Bot
changed the title
openshift-ci-robot
added
jira/valid-reference
|
@openshift-cherrypick-robot: This pull request references Jira Issue OCPBUGS-86291, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/assign @rameshsahoo11 |
|
@danwinship: GitHub didn't allow me to assign the following users: rameshsahoo11. Note that only openshift members with read permissions, repo collaborators and people who have commented on this issue/PR can be assigned. Additionally, issues/PRs can only have 10 assignees at the same time. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
@danwinship: The label(s) DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
@openshift-cherrypick-robot: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
4 participants
This is an automated cherry-pick of #706
/assign danwinship