From 98ace33b0fb01225bb2a6181837e6b4e2b07feb1 Mon Sep 17 00:00:00 2001
From: Zain Budhwani <99770260+zbud-msft@users.noreply.github.com>
Date: Sun, 13 Nov 2022 21:41:33 -0800
Subject: [PATCH] Add rsyslog plugin regex for select operation failure
 (#12659)

Added events for select op, alpm parity error, moved dhcp events from host to container
---
 dockers/docker-dhcp-relay/Dockerfile.j2                  | 8 ++++++++
 .../docker-dhcp-relay}/dhcp_relay_regex.json             | 0
 dockers/docker-dhcp-relay/events_info.json               | 9 +++++++++
 dockers/docker-orchagent/Dockerfile.j2                   | 9 +++++++++
 dockers/docker-orchagent/events_info.json                | 9 +++++++++
 dockers/docker-orchagent/swss_regex.json                 | 7 +++++++
 files/build_templates/events_info.json                   | 4 ----
 files/build_templates/sonic_debian_extension.j2          | 1 -
 files/build_templates/syncd_regex.json                   | 5 +++++
 rules/docker-dhcp-relay.mk                               | 4 ++--
 rules/docker-orchagent.mk                                | 5 +++--
 11 files changed, 52 insertions(+), 9 deletions(-)
 rename {files/build_templates => dockers/docker-dhcp-relay}/dhcp_relay_regex.json (100%)
 create mode 100644 dockers/docker-dhcp-relay/events_info.json
 create mode 100644 dockers/docker-orchagent/events_info.json
 create mode 100644 dockers/docker-orchagent/swss_regex.json

diff --git a/dockers/docker-dhcp-relay/Dockerfile.j2 b/dockers/docker-dhcp-relay/Dockerfile.j2
index 9a5eb23c38..1cddd11b61 100644
--- a/dockers/docker-dhcp-relay/Dockerfile.j2
+++ b/dockers/docker-dhcp-relay/Dockerfile.j2
@@ -34,5 +34,13 @@ COPY ["dhcp-relay.programs.j2", "dhcpv4-relay.agents.j2", "dhcpv6-relay.agents.j
 COPY ["files/supervisor-proc-exit-listener", "/usr/bin"]
 COPY ["critical_processes", "/etc/supervisor"]
 COPY ["cli", "/cli/"]
+# Copy regex json and rsyslog_plugin.conf file into rsyslog.d
+COPY ["*.json", "/etc/rsyslog.d/"]
+COPY ["files/rsyslog_plugin.conf.j2", "/etc/rsyslog.d/"]
+
+# Create dhcp_relay_regex.conf
+RUN j2 -f json /etc/rsyslog.d/rsyslog_plugin.conf.j2 /etc/rsyslog.d/events_info.json  > /etc/rsyslog.d/dhcp_relay_events.conf
+RUN rm -f /etc/rsyslog.d/rsyslog_plugin.conf.j2
+RUN rm -f /etc/rsyslog.d/events_info.json
 
 ENTRYPOINT ["/usr/bin/docker_init.sh"]
diff --git a/files/build_templates/dhcp_relay_regex.json b/dockers/docker-dhcp-relay/dhcp_relay_regex.json
similarity index 100%
rename from files/build_templates/dhcp_relay_regex.json
rename to dockers/docker-dhcp-relay/dhcp_relay_regex.json
diff --git a/dockers/docker-dhcp-relay/events_info.json b/dockers/docker-dhcp-relay/events_info.json
new file mode 100644
index 0000000000..89d75c77e8
--- /dev/null
+++ b/dockers/docker-dhcp-relay/events_info.json
@@ -0,0 +1,9 @@
+{
+    "yang_module": "sonic-events-dhcp-relay",
+    "proclist": [
+        {
+            "name": "dhcp_relay",
+            "parse_json": "dhcp_relay_regex.json"
+        }
+    ]
+}
diff --git a/dockers/docker-orchagent/Dockerfile.j2 b/dockers/docker-orchagent/Dockerfile.j2
index a7a314cdc8..22adec2b59 100755
--- a/dockers/docker-orchagent/Dockerfile.j2
+++ b/dockers/docker-orchagent/Dockerfile.j2
@@ -76,8 +76,17 @@ COPY ["files/supervisor-proc-exit-listener", "/usr/bin"]
 # Copy all Jinja2 template files into the templates folder
 COPY ["*.j2", "/usr/share/sonic/templates/"]
 
+# Copy all regex json files and rsyslog_plugin.conf to rsyslog.d
+COPY ["*.json", "/etc/rsyslog.d/"]
+COPY ["files/rsyslog_plugin.conf.j2", "/etc/rsyslog.d/"]
+
 RUN sonic-cfggen -a "{\"ENABLE_ASAN\":\"{{ENABLE_ASAN}}\"}" -t /usr/share/sonic/templates/docker-init.j2 > /usr/bin/docker-init.sh
 RUN rm -f /usr/share/sonic/templates/docker-init.j2
 RUN chmod 755 /usr/bin/docker-init.sh
 
+# Create swss rsyslog_plugin conf file
+RUN j2 -f json /etc/rsyslog.d/rsyslog_plugin.conf.j2 /etc/rsyslog.d/events_info.json  > /etc/rsyslog.d/swss_events.conf
+RUN rm -f /etc/rsyslog.d/rsyslog_plugin.conf.j2
+RUN rm -f /etc/rsyslog.d/events_info.json
+
 ENTRYPOINT ["/usr/bin/docker-init.sh"]
diff --git a/dockers/docker-orchagent/events_info.json b/dockers/docker-orchagent/events_info.json
new file mode 100644
index 0000000000..cfcf680fa2
--- /dev/null
+++ b/dockers/docker-orchagent/events_info.json
@@ -0,0 +1,9 @@
+{
+    "yang_module": "sonic-events-swss",
+    "proclist": [
+        {
+            "name": "swss",
+            "parse_json": "swss_regex.json"
+        }
+    ]
+}
diff --git a/dockers/docker-orchagent/swss_regex.json b/dockers/docker-orchagent/swss_regex.json
new file mode 100644
index 0000000000..eb294c7d8d
--- /dev/null
+++ b/dockers/docker-orchagent/swss_regex.json
@@ -0,0 +1,7 @@
+[
+    {
+        "tag": "select-operation-failure",
+        "regex": "SELECT operation result: ([a-zA-Z]*) on ([a-zA-Z]*)",
+        "params": [ "operation_result", "command" ]
+    }
+]
diff --git a/files/build_templates/events_info.json b/files/build_templates/events_info.json
index b83afc3caf..3b7f0cfb12 100644
--- a/files/build_templates/events_info.json
+++ b/files/build_templates/events_info.json
@@ -13,10 +13,6 @@
             "name": "systemd",
             "parse_json": "systemd_regex.json"
         },
-        {
-            "name": "dhcp_relay",
-            "parse_json": "dhcp_relay_regex.json"
-        },
         {
             "name": "syncd",
             "parse_json": "syncd_regex.json"
diff --git a/files/build_templates/sonic_debian_extension.j2 b/files/build_templates/sonic_debian_extension.j2
index c5e76d3c47..e77141d3c5 100644
--- a/files/build_templates/sonic_debian_extension.j2
+++ b/files/build_templates/sonic_debian_extension.j2
@@ -324,7 +324,6 @@ j2 -f json $BUILD_TEMPLATES/rsyslog_plugin.conf.j2 $BUILD_TEMPLATES/events_info.
 sudo cp $BUILD_TEMPLATES/monit_regex.json $FILESYSTEM_ROOT_ETC/rsyslog.d/
 sudo cp $BUILD_TEMPLATES/sshd_regex.json $FILESYSTEM_ROOT_ETC/rsyslog.d/
 sudo cp $BUILD_TEMPLATES/systemd_regex.json $FILESYSTEM_ROOT_ETC/rsyslog.d/
-sudo cp $BUILD_TEMPLATES/dhcp_relay_regex.json $FILESYSTEM_ROOT_ETC/rsyslog.d/
 sudo cp $BUILD_TEMPLATES/syncd_regex.json $FILESYSTEM_ROOT_ETC/rsyslog.d/
 sudo cp $BUILD_TEMPLATES/kernel_regex.json $FILESYSTEM_ROOT_ETC/rsyslog.d/
 sudo cp $BUILD_TEMPLATES/dockerd_regex.json $FILESYSTEM_ROOT_ETC/rsyslog.d/
diff --git a/files/build_templates/syncd_regex.json b/files/build_templates/syncd_regex.json
index cc78c30f53..ef849306fc 100644
--- a/files/build_templates/syncd_regex.json
+++ b/files/build_templates/syncd_regex.json
@@ -3,5 +3,10 @@
         "tag": "syncd-failure",
         "regex": "(MMU ERR Type|L3 route add failed with error|Assertion failed|Received switch event|SER Parity Check Error)",
         "params": [ "fail_type:ret=(arg==\"Received switch event\")and\"switch_event\"or((arg==\"Assertion Failed\")and\"assert\"or((arg==\"SER Parity Check Error\")and\"parity_check\"or((arg==\"MMU ERR Type\")and\"mmu_err\"or((arg==\"route add failed\")and\"route_add_failed\"or\"\"))))" ]
+    },
+    {
+        "tag": "alpm-parity-error",
+        "regex": "ALPM (delete|insert) operation.L3_DEFIP_ALPM_(IPV4|IPV6).*encountered parity error",
+        "params": [ "operation", "ip_family:ret=(arg==\"IPV4\")and\"IPv4\"or((arg==\"IPV6\")and\"IPv6\"or\"\")" ]
     }
 ]
diff --git a/rules/docker-dhcp-relay.mk b/rules/docker-dhcp-relay.mk
index c2db8d7ba5..c26995ad14 100644
--- a/rules/docker-dhcp-relay.mk
+++ b/rules/docker-dhcp-relay.mk
@@ -6,10 +6,10 @@ DOCKER_DHCP_RELAY_DBG = $(DOCKER_DHCP_RELAY_STEM)-$(DBG_IMAGE_MARK).gz
 
 $(DOCKER_DHCP_RELAY)_PATH = $(DOCKERS_PATH)/$(DOCKER_DHCP_RELAY_STEM)
 
-$(DOCKER_DHCP_RELAY)_DEPENDS += $(ISC_DHCP_RELAY) $(SONIC_DHCPMON) $(SONIC_DHCPRELAY) $(LIBSWSSCOMMON) 
+$(DOCKER_DHCP_RELAY)_DEPENDS += $(ISC_DHCP_RELAY) $(SONIC_DHCPMON) $(SONIC_DHCPRELAY) $(LIBSWSSCOMMON) $(SONIC_RSYSLOG_PLUGIN) 
 
 $(DOCKER_DHCP_RELAY)_DBG_DEPENDS = $($(DOCKER_CONFIG_ENGINE_BULLSEYE)_DBG_DEPENDS)
-$(DOCKER_DHCP_RELAY)_DBG_DEPENDS += $(ISC_DHCP_RELAY_DBG) $(SONIC_DHCPRELAY_DBG) $(SONIC_DHCPMON_DBG)
+$(DOCKER_DHCP_RELAY)_DBG_DEPENDS += $(ISC_DHCP_RELAY_DBG) $(SONIC_DHCPRELAY_DBG) $(SONIC_DHCPMON_DBG) $(SONIC_RSYSLOG_PLUGIN)
 
 $(DOCKER_DHCP_RELAY)_DBG_IMAGE_PACKAGES = $($(DOCKER_CONFIG_ENGINE_BULLSEYE)_DBG_IMAGE_PACKAGES)
 
diff --git a/rules/docker-orchagent.mk b/rules/docker-orchagent.mk
index fed461290f..eae484ccc5 100644
--- a/rules/docker-orchagent.mk
+++ b/rules/docker-orchagent.mk
@@ -4,7 +4,7 @@ DOCKER_ORCHAGENT_STEM = docker-orchagent
 DOCKER_ORCHAGENT = $(DOCKER_ORCHAGENT_STEM).gz
 DOCKER_ORCHAGENT_DBG = $(DOCKER_ORCHAGENT_STEM)-$(DBG_IMAGE_MARK).gz
 
-$(DOCKER_ORCHAGENT)_DEPENDS += $(SWSS)
+$(DOCKER_ORCHAGENT)_DEPENDS += $(SWSS) $(SONIC_RSYSLOG_PLUGIN)
 
 ifeq ($(ENABLE_ASAN), y)
 $(DOCKER_ORCHAGENT)_DEPENDS += $(SWSS_DBG)
@@ -13,7 +13,8 @@ endif
 $(DOCKER_ORCHAGENT)_DBG_DEPENDS = $($(DOCKER_SWSS_LAYER_BULLSEYE)_DBG_DEPENDS)
 $(DOCKER_ORCHAGENT)_DBG_DEPENDS +=   $(SWSS_DBG) \
                                 $(LIBSWSSCOMMON_DBG) \
-                                $(LIBSAIREDIS_DBG)
+                                $(LIBSAIREDIS_DBG) \
+				$(SONIC_RSYSLOG_PLUGIN)
 $(DOCKER_ORCHAGENT)_PYTHON_WHEELS += $(SCAPY)
 
 $(DOCKER_ORCHAGENT)_DBG_IMAGE_PACKAGES = $($(DOCKER_SWSS_LAYER_BULLSEYE)_DBG_IMAGE_PACKAGES)