<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: I have a chef automate logger script in python. in Splunk Dev</title>
    <link>https://community.splunk.com/t5/Splunk-Dev/I-have-a-chef-automate-logger-script-in-python/m-p/712393#M11830</link>
    <description>&lt;P&gt;Hi&amp;nbsp;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/269274"&gt;@jcorcorans&lt;/a&gt;&amp;nbsp;I haven't discovered any great way to parse the chef-client.log&lt;BR /&gt;&lt;BR /&gt;A few things that can help&lt;BR /&gt;&lt;BR /&gt;1) look for the log_level when it isn't INFO/WARN&lt;BR /&gt;&lt;BR /&gt;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;[2025-02-24T19:06:07+00:00] FATAL: Please provide the contents of the stacktrace.out file if you file a bug report&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;2) for log rotate, I see we have directives in /etc/logrotate.d/chef-cilent&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;"/var/log/chef/client.log" {
  weekly
  rotate 12
  compress
  postrotate
    systemctl reload chef-client.service &amp;gt;/dev/null || :
  endscript
}&lt;/LI-CODE&gt;&lt;P&gt;&lt;BR /&gt;3) and if you have a number of servers and you are running chef a lot and want to know when to truly spend time debugging since we find a chef operation can fail due to timeout or load, you check over a time period and see if in the end things are running okay.&amp;nbsp;&lt;BR /&gt;&lt;BR /&gt;So we have something like this: if after 3 times chef run is still not good then investigate&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;idx=your_index sourcetype=chef:client  ("FATAL: Chef::Exceptions::ChildConvergeError:" OR "FATAL: Chef::Exceptions::ValidationFailed" OR "Chef run process exited unsuccessfully" OR "INFO: Chef Run complete" OR "INFO: Report handlers complete")
| eval chef_status=if(searchmatch("ERROR") OR searchmatch("FATAL"), "failed", "succeeded") 
| stats count(eval(chef_status="failed")) AS num_failed, count(eval(chef_status="succeeded")) AS num_succeeded,latest(chef_status) as latest_chef_status by host
| search num_failed &amp;gt; 3  AND latest_chef_status!="succeede&lt;/LI-CODE&gt;&lt;P&gt;&lt;BR /&gt;To monitor the logs, a simple monitoring stanza in your inputs&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;[monitor:///var/log/chef/client.log]
sourcetype=yourchefsourcetype
index=your_index&lt;/LI-CODE&gt;&lt;P&gt;&lt;BR /&gt;&lt;BR /&gt;&lt;BR /&gt;&lt;/P&gt;</description>
    <pubDate>Mon, 24 Feb 2025 19:28:35 GMT</pubDate>
    <dc:creator>burwell</dc:creator>
    <dc:date>2025-02-24T19:28:35Z</dc:date>
    <item>
      <title>I have a chef automate logger script in python.</title>
      <link>https://community.splunk.com/t5/Splunk-Dev/I-have-a-chef-automate-logger-script-in-python/m-p/712390#M11829</link>
      <description>&lt;P&gt;I have a chef automate logger script in python. Its using python libraries, The log rotation is not working , are there&lt;/P&gt;&lt;P&gt;what logging modules or classes should I be looking.&lt;/P&gt;&lt;P&gt;data is coming in however the log is not rotating .&amp;nbsp; the logic is in the&amp;nbsp; Chef script.&lt;/P&gt;&lt;P&gt;any ideas ?&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Mon, 24 Feb 2025 19:12:10 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Dev/I-have-a-chef-automate-logger-script-in-python/m-p/712390#M11829</guid>
      <dc:creator>jcorcorans</dc:creator>
      <dc:date>2025-02-24T19:12:10Z</dc:date>
    </item>
    <item>
      <title>Re: I have a chef automate logger script in python.</title>
      <link>https://community.splunk.com/t5/Splunk-Dev/I-have-a-chef-automate-logger-script-in-python/m-p/712393#M11830</link>
      <description>&lt;P&gt;Hi&amp;nbsp;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/269274"&gt;@jcorcorans&lt;/a&gt;&amp;nbsp;I haven't discovered any great way to parse the chef-client.log&lt;BR /&gt;&lt;BR /&gt;A few things that can help&lt;BR /&gt;&lt;BR /&gt;1) look for the log_level when it isn't INFO/WARN&lt;BR /&gt;&lt;BR /&gt;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;[2025-02-24T19:06:07+00:00] FATAL: Please provide the contents of the stacktrace.out file if you file a bug report&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;2) for log rotate, I see we have directives in /etc/logrotate.d/chef-cilent&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;"/var/log/chef/client.log" {
  weekly
  rotate 12
  compress
  postrotate
    systemctl reload chef-client.service &amp;gt;/dev/null || :
  endscript
}&lt;/LI-CODE&gt;&lt;P&gt;&lt;BR /&gt;3) and if you have a number of servers and you are running chef a lot and want to know when to truly spend time debugging since we find a chef operation can fail due to timeout or load, you check over a time period and see if in the end things are running okay.&amp;nbsp;&lt;BR /&gt;&lt;BR /&gt;So we have something like this: if after 3 times chef run is still not good then investigate&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;idx=your_index sourcetype=chef:client  ("FATAL: Chef::Exceptions::ChildConvergeError:" OR "FATAL: Chef::Exceptions::ValidationFailed" OR "Chef run process exited unsuccessfully" OR "INFO: Chef Run complete" OR "INFO: Report handlers complete")
| eval chef_status=if(searchmatch("ERROR") OR searchmatch("FATAL"), "failed", "succeeded") 
| stats count(eval(chef_status="failed")) AS num_failed, count(eval(chef_status="succeeded")) AS num_succeeded,latest(chef_status) as latest_chef_status by host
| search num_failed &amp;gt; 3  AND latest_chef_status!="succeede&lt;/LI-CODE&gt;&lt;P&gt;&lt;BR /&gt;To monitor the logs, a simple monitoring stanza in your inputs&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;[monitor:///var/log/chef/client.log]
sourcetype=yourchefsourcetype
index=your_index&lt;/LI-CODE&gt;&lt;P&gt;&lt;BR /&gt;&lt;BR /&gt;&lt;BR /&gt;&lt;/P&gt;</description>
      <pubDate>Mon, 24 Feb 2025 19:28:35 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Dev/I-have-a-chef-automate-logger-script-in-python/m-p/712393#M11830</guid>
      <dc:creator>burwell</dc:creator>
      <dc:date>2025-02-24T19:28:35Z</dc:date>
    </item>
  </channel>
</rss>

