Add rsyslog plugin regex for select operation failure (#12659)

Added events for select op, alpm parity error, moved dhcp events from host to container

dockers/docker-dhcp-relay/Dockerfile.j2

@@ -34,5 +34,13 @@ COPY ["dhcp-relay.programs.j2", "dhcpv4-relay.agents.j2", "dhcpv6-relay.agents.j
 COPY ["files/supervisor-proc-exit-listener", "/usr/bin"]
 COPY ["critical_processes", "/etc/supervisor"]
 COPY ["cli", "/cli/"]
+# Copy regex json and rsyslog_plugin.conf file into rsyslog.d
+COPY ["*.json", "/etc/rsyslog.d/"]
+COPY ["files/rsyslog_plugin.conf.j2", "/etc/rsyslog.d/"]
+
+# Create dhcp_relay_regex.conf
+RUN j2 -f json /etc/rsyslog.d/rsyslog_plugin.conf.j2 /etc/rsyslog.d/events_info.json  > /etc/rsyslog.d/dhcp_relay_events.conf
+RUN rm -f /etc/rsyslog.d/rsyslog_plugin.conf.j2
+RUN rm -f /etc/rsyslog.d/events_info.json
 
 ENTRYPOINT ["/usr/bin/docker_init.sh"]

dockers/docker-dhcp-relay/events_info.json

@@ -0,0 +1,9 @@
+{
+    "yang_module": "sonic-events-dhcp-relay",
+    "proclist": [
+        {
+            "name": "dhcp_relay",
+            "parse_json": "dhcp_relay_regex.json"
+        }
+    ]
+}

dockers/docker-orchagent/Dockerfile.j2

@@ -76,8 +76,17 @@ COPY ["files/supervisor-proc-exit-listener", "/usr/bin"]
 # Copy all Jinja2 template files into the templates folder
 COPY ["*.j2", "/usr/share/sonic/templates/"]
 
+# Copy all regex json files and rsyslog_plugin.conf to rsyslog.d
+COPY ["*.json", "/etc/rsyslog.d/"]
+COPY ["files/rsyslog_plugin.conf.j2", "/etc/rsyslog.d/"]
+
 RUN sonic-cfggen -a "{\"ENABLE_ASAN\":\"{{ENABLE_ASAN}}\"}" -t /usr/share/sonic/templates/docker-init.j2 > /usr/bin/docker-init.sh
 RUN rm -f /usr/share/sonic/templates/docker-init.j2
 RUN chmod 755 /usr/bin/docker-init.sh
 
+# Create swss rsyslog_plugin conf file
+RUN j2 -f json /etc/rsyslog.d/rsyslog_plugin.conf.j2 /etc/rsyslog.d/events_info.json  > /etc/rsyslog.d/swss_events.conf
+RUN rm -f /etc/rsyslog.d/rsyslog_plugin.conf.j2
+RUN rm -f /etc/rsyslog.d/events_info.json
+
 ENTRYPOINT ["/usr/bin/docker-init.sh"]

dockers/docker-orchagent/events_info.json

@@ -0,0 +1,9 @@
+{
+    "yang_module": "sonic-events-swss",
+    "proclist": [
+        {
+            "name": "swss",
+            "parse_json": "swss_regex.json"
+        }
+    ]
+}

dockers/docker-orchagent/swss_regex.json

@@ -0,0 +1,7 @@
+[
+    {
+        "tag": "select-operation-failure",
+        "regex": "SELECT operation result: ([a-zA-Z]*) on ([a-zA-Z]*)",
+        "params": [ "operation_result", "command" ]
+    }
+]

files/build_templates/events_info.json

@@ -13,10 +13,6 @@
             "name": "systemd",
             "parse_json": "systemd_regex.json"
         },
-        {
-            "name": "dhcp_relay",
-            "parse_json": "dhcp_relay_regex.json"
-        },
         {
             "name": "syncd",
             "parse_json": "syncd_regex.json"

files/build_templates/sonic_debian_extension.j2

@@ -324,7 +324,6 @@ j2 -f json $BUILD_TEMPLATES/rsyslog_plugin.conf.j2 $BUILD_TEMPLATES/events_info.
 sudo cp $BUILD_TEMPLATES/monit_regex.json $FILESYSTEM_ROOT_ETC/rsyslog.d/
 sudo cp $BUILD_TEMPLATES/sshd_regex.json $FILESYSTEM_ROOT_ETC/rsyslog.d/
 sudo cp $BUILD_TEMPLATES/systemd_regex.json $FILESYSTEM_ROOT_ETC/rsyslog.d/
-sudo cp $BUILD_TEMPLATES/dhcp_relay_regex.json $FILESYSTEM_ROOT_ETC/rsyslog.d/
 sudo cp $BUILD_TEMPLATES/syncd_regex.json $FILESYSTEM_ROOT_ETC/rsyslog.d/
 sudo cp $BUILD_TEMPLATES/kernel_regex.json $FILESYSTEM_ROOT_ETC/rsyslog.d/
 sudo cp $BUILD_TEMPLATES/dockerd_regex.json $FILESYSTEM_ROOT_ETC/rsyslog.d/

files/build_templates/syncd_regex.json

@@ -3,5 +3,10 @@
         "tag": "syncd-failure",
         "regex": "(MMU ERR Type|L3 route add failed with error|Assertion failed|Received switch event|SER Parity Check Error)",
         "params": [ "fail_type:ret=(arg==\"Received switch event\")and\"switch_event\"or((arg==\"Assertion Failed\")and\"assert\"or((arg==\"SER Parity Check Error\")and\"parity_check\"or((arg==\"MMU ERR Type\")and\"mmu_err\"or((arg==\"route add failed\")and\"route_add_failed\"or\"\"))))" ]
+    },
+    {
+        "tag": "alpm-parity-error",
+        "regex": "ALPM (delete|insert) operation.L3_DEFIP_ALPM_(IPV4|IPV6).*encountered parity error",
+        "params": [ "operation", "ip_family:ret=(arg==\"IPV4\")and\"IPv4\"or((arg==\"IPV6\")and\"IPv6\"or\"\")" ]
     }
 ]

rules/docker-dhcp-relay.mk

@@ -6,10 +6,10 @@ DOCKER_DHCP_RELAY_DBG = $(DOCKER_DHCP_RELAY_STEM)-$(DBG_IMAGE_MARK).gz
 
 $(DOCKER_DHCP_RELAY)_PATH = $(DOCKERS_PATH)/$(DOCKER_DHCP_RELAY_STEM)
 
-$(DOCKER_DHCP_RELAY)_DEPENDS += $(ISC_DHCP_RELAY) $(SONIC_DHCPMON) $(SONIC_DHCPRELAY) $(LIBSWSSCOMMON) 
+$(DOCKER_DHCP_RELAY)_DEPENDS += $(ISC_DHCP_RELAY) $(SONIC_DHCPMON) $(SONIC_DHCPRELAY) $(LIBSWSSCOMMON) $(SONIC_RSYSLOG_PLUGIN) 
 
 $(DOCKER_DHCP_RELAY)_DBG_DEPENDS = $($(DOCKER_CONFIG_ENGINE_BULLSEYE)_DBG_DEPENDS)
-$(DOCKER_DHCP_RELAY)_DBG_DEPENDS += $(ISC_DHCP_RELAY_DBG) $(SONIC_DHCPRELAY_DBG) $(SONIC_DHCPMON_DBG)
+$(DOCKER_DHCP_RELAY)_DBG_DEPENDS += $(ISC_DHCP_RELAY_DBG) $(SONIC_DHCPRELAY_DBG) $(SONIC_DHCPMON_DBG) $(SONIC_RSYSLOG_PLUGIN)
 
 $(DOCKER_DHCP_RELAY)_DBG_IMAGE_PACKAGES = $($(DOCKER_CONFIG_ENGINE_BULLSEYE)_DBG_IMAGE_PACKAGES)
 

rules/docker-orchagent.mk

@@ -4,7 +4,7 @@ DOCKER_ORCHAGENT_STEM = docker-orchagent
 DOCKER_ORCHAGENT = $(DOCKER_ORCHAGENT_STEM).gz
 DOCKER_ORCHAGENT_DBG = $(DOCKER_ORCHAGENT_STEM)-$(DBG_IMAGE_MARK).gz
 
-$(DOCKER_ORCHAGENT)_DEPENDS += $(SWSS)
+$(DOCKER_ORCHAGENT)_DEPENDS += $(SWSS) $(SONIC_RSYSLOG_PLUGIN)
 
 ifeq ($(ENABLE_ASAN), y)
 $(DOCKER_ORCHAGENT)_DEPENDS += $(SWSS_DBG)
@@ -13,7 +13,8 @@ endif
 $(DOCKER_ORCHAGENT)_DBG_DEPENDS = $($(DOCKER_SWSS_LAYER_BULLSEYE)_DBG_DEPENDS)
 $(DOCKER_ORCHAGENT)_DBG_DEPENDS +=   $(SWSS_DBG) \
                                 $(LIBSWSSCOMMON_DBG) \
-                                $(LIBSAIREDIS_DBG)
+                                $(LIBSAIREDIS_DBG) \
+				$(SONIC_RSYSLOG_PLUGIN)
 $(DOCKER_ORCHAGENT)_PYTHON_WHEELS += $(SCAPY)
 
 $(DOCKER_ORCHAGENT)_DBG_IMAGE_PACKAGES = $($(DOCKER_SWSS_LAYER_BULLSEYE)_DBG_IMAGE_PACKAGES)