-
Notifications
You must be signed in to change notification settings - Fork 4.4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add monitor http endpoint #2511
Changes from 1 commit
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -2,12 +2,15 @@ package agent | |
|
||
import ( | ||
"fmt" | ||
"log" | ||
"net/http" | ||
"strconv" | ||
"strings" | ||
|
||
"github.com/hashicorp/consul/consul/structs" | ||
"github.com/hashicorp/consul/logger" | ||
"github.com/hashicorp/consul/types" | ||
"github.com/hashicorp/logutils" | ||
"github.com/hashicorp/serf/coordinate" | ||
"github.com/hashicorp/serf/serf" | ||
) | ||
|
@@ -393,6 +396,61 @@ func (s *HTTPServer) AgentNodeMaintenance(resp http.ResponseWriter, req *http.Re | |
return nil, nil | ||
} | ||
|
||
func (s *HTTPServer) AgentMonitor(resp http.ResponseWriter, req *http.Request) (interface{}, error) { | ||
// Only GET supported | ||
if req.Method != "GET" { | ||
resp.WriteHeader(405) | ||
return nil, nil | ||
} | ||
|
||
// Get the provided loglevel | ||
logLevel := req.URL.Query().Get("loglevel") | ||
if logLevel == "" { | ||
logLevel = "INFO" | ||
} | ||
|
||
// Upper case the log level | ||
logLevel = strings.ToUpper(logLevel) | ||
|
||
// Create a level filter | ||
filter := logger.LevelFilter() | ||
filter.MinLevel = logutils.LogLevel(logLevel) | ||
if !logger.ValidateLevelFilter(filter.MinLevel, filter) { | ||
resp.WriteHeader(400) | ||
resp.Write([]byte(fmt.Sprintf("Unknown log level: %s", filter.MinLevel))) | ||
return nil, nil | ||
} | ||
|
||
flusher, ok := resp.(http.Flusher) | ||
if !ok { | ||
return nil, fmt.Errorf("Streaming not supported") | ||
} | ||
|
||
// Set up a log handler | ||
handler := &httpLogHandler{ | ||
filter: filter, | ||
logCh: make(chan string, 512), | ||
logger: s.logger, | ||
} | ||
s.agent.logWriter.RegisterHandler(handler) | ||
defer s.agent.logWriter.DeregisterHandler(handler) | ||
|
||
notify := resp.(http.CloseNotifier).CloseNotify() | ||
|
||
// Stream logs until the connection is closed | ||
for { | ||
select { | ||
case <-notify: | ||
return nil, nil | ||
case log := <-handler.logCh: | ||
resp.Write([]byte(log + "\n")) | ||
flusher.Flush() | ||
} | ||
} | ||
|
||
return nil, nil | ||
} | ||
|
||
// syncChanges is a helper function which wraps a blocking call to sync | ||
// services and checks to the server. If the operation fails, we only | ||
// only warn because the write did succeed and anti-entropy will sync later. | ||
|
@@ -401,3 +459,27 @@ func (s *HTTPServer) syncChanges() { | |
s.logger.Printf("[ERR] agent: failed to sync changes: %v", err) | ||
} | ||
} | ||
|
||
type httpLogHandler struct { | ||
filter *logutils.LevelFilter | ||
logCh chan string | ||
logger *log.Logger | ||
} | ||
|
||
func (h *httpLogHandler) HandleLog(log string) { | ||
// Check the log level | ||
if !h.filter.Check([]byte(log)) { | ||
return | ||
} | ||
|
||
// Do a non-blocking send | ||
select { | ||
case h.logCh <- log: | ||
default: | ||
// We can't log synchronously, since we are already being invoked | ||
// from the logWriter, and a log will need to invoke Write() which | ||
// already holds the lock. We must therefor do the log async, so | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. sp. "therefor" |
||
// as to not deadlock | ||
go h.logger.Printf("[WARN] Dropping logs to monitor http endpoint") | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I kind of worry this could make a ton of goroutines if things got into a weird state. I'd just count dropped lines in here, and then kick out a warning up in the agent handler when you are closing out if this count > 0. That way the operator can see that this is going on, but it's super cheap and ok if we are essentially dropping all of the logs. |
||
} | ||
} |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,8 +1,10 @@ | ||
package agent | ||
|
||
import ( | ||
"bytes" | ||
"errors" | ||
"fmt" | ||
"io" | ||
"net/http" | ||
"net/http/httptest" | ||
"os" | ||
|
@@ -12,6 +14,7 @@ import ( | |
"time" | ||
|
||
"github.com/hashicorp/consul/consul/structs" | ||
"github.com/hashicorp/consul/logger" | ||
"github.com/hashicorp/consul/testutil" | ||
"github.com/hashicorp/consul/types" | ||
"github.com/hashicorp/serf/serf" | ||
|
@@ -1019,3 +1022,69 @@ func TestHTTPAgentRegisterServiceCheck(t *testing.T) { | |
t.Fatalf("bad: %#v", result["memcached_check2"]) | ||
} | ||
} | ||
|
||
func TestHTTPAgent_Monitor(t *testing.T) { | ||
logWriter := logger.NewLogWriter(512) | ||
expectedLogs := bytes.Buffer{} | ||
logger := io.MultiWriter(os.Stdout, &expectedLogs, logWriter) | ||
|
||
dir, srv := makeHTTPServerWithConfigLog(t, nil, logger) | ||
srv.agent.logWriter = logWriter | ||
defer os.RemoveAll(dir) | ||
defer srv.Shutdown() | ||
defer srv.agent.Shutdown() | ||
|
||
// Begin streaming logs from the monitor endpoint | ||
req, _ := http.NewRequest("GET", "/v1/agent/monitor?loglevel=debug", nil) | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Would be good to do a little deeper test of the level filter. You could just make sure you get an error for an invalid level which proves it gets plumbed down. |
||
resp := newClosableRecorder() | ||
go func() { | ||
if _, err := srv.AgentMonitor(resp, req); err != nil { | ||
t.Fatalf("err: %s", err) | ||
} | ||
}() | ||
|
||
// Write the incoming logs to a channel for reading | ||
logCh := make(chan string, 0) | ||
go func() { | ||
for { | ||
line, err := resp.Body.ReadString('\n') | ||
if err != nil && err != io.EOF { | ||
t.Fatalf("err: %v", err) | ||
} | ||
if line != "" { | ||
logCh <- line | ||
} | ||
} | ||
}() | ||
|
||
// Verify that the first 5 logs we get match the expected stream | ||
for i := 0; i < 5; i++ { | ||
select { | ||
case log := <-logCh: | ||
expected, err := expectedLogs.ReadString('\n') | ||
if err != nil { | ||
t.Fatalf("err: %v", err) | ||
} | ||
if log != expected { | ||
t.Fatalf("bad: %q %q", expected, log) | ||
} | ||
case <-time.After(10 * time.Second): | ||
t.Fatalf("failed to get log within timeout") | ||
} | ||
} | ||
} | ||
|
||
type closableRecorder struct { | ||
*httptest.ResponseRecorder | ||
closer chan bool | ||
} | ||
|
||
func newClosableRecorder() *closableRecorder { | ||
r := httptest.NewRecorder() | ||
closer := make(chan bool) | ||
return &closableRecorder{r, closer} | ||
} | ||
|
||
func (r *closableRecorder) CloseNotify() <-chan bool { | ||
return r.closer | ||
} |
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -471,6 +471,7 @@ func (c *Command) setupAgent(config *Config, logOutput io.Writer, logWriter *log | |
c.Ui.Error(fmt.Sprintf("Error starting agent: %s", err)) | ||
return err | ||
} | ||
agent.logWriter = logWriter | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I'd plumb this into |
||
c.agent = agent | ||
|
||
// Setup the RPC listener | ||
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We are going to add an ACL here, but I feel like this is a bit of a security vuln until we do that. Just so we don't expose anything weird while that work is going on in master, lets take a token here and call the Raft endpoint:
https://github.com/hashicorp/consul/blob/master/command/agent/operator_endpoint.go#L23-L26
This'll vet that they have operator read privs if it doesn't return an error (just throw away the response), which protects this with something while we develop ACLs.