Edit

Archive logs

Archive logs

This article describes necessary steps to create an archive with selected logs, which can be requested in a support ticket for investigation. Make sure to run these steps as the runtime user, as defined in config.yml, in the wf_user variable.

To archive logs:

1. Log in to the INT server via SSH.

2. Change the user to default wfuser,

   su - wfuser
   

3. Go to the logs directory INSTALL_DIR/logs.

   cd /opt/workfusion/logs/
   

4. In the logs directory, run the /opt/workfusion/tools/log_archive.sh script to archive specific logs. For more details on available options, see Specification of log_archive.sh.

   /opt/workfusion/tools/log_archive.sh
   
   Usage: log_archive.sh [-c <component filter> -d <date filter> -g <group name> -h <server hostname>]
   
   Options -c, -d, -g, -h can be used multiple time
   
   Examples:
     log_archive.sh -c nginx -g int -g app # collect logs for nginx component from int and app groups
     log_archive.sh -c workfusion -c nginx -g app # collect logs for nginx, workfusion components from app group
     log_archive.sh -c nginx -g app -g int -d 2018-10-* # collect logs for nginx from int and app groups on October 2018
   

   While creating a logs archive, keep in mind that the date pattern is UTC-based. In some cases, required logs may have earlier date or date in future. We recommend to create an archive for additional dates before and after an incident to be sure that all logs are gathered correctly.

   Example: the following command with parameters collects logs for the nginx component in the INT and APP groups for date 2018-11-01 and packs them into the current directory in file wf-logs-<unix_time_epoch>.tar.gz.

   /opt/workfusion/tools/log_archive.sh -c nginx -g int -g app -d 2018-11-01 # collect logs for nginx component from int and app groups
   
   tar: Removing leading `/' from member names
   /opt/workfusion/logs/int/int-example.workfusion.com/nginx/2018-11-01/nginx.err.log
   /opt/workfusion/logs/int/int-example.workfusion.com/nginx/2018-11-01/nginx.out.log
   /opt/workfusion/logs/app/app-example.workfusion.com/nginx/2018-11-01/nginx.out.log
   /opt/workfusion/logs/app/app-example.workfusion.com/nginx/2018-11-01/nginx.err.log
   ^^ Logs were packed into archive wf-logs-1541062518.tar.gz in current directory
   

5. Validate that archive is not empty and contains all required files.

   $ ls -la wf-logs-1541062518.tar.gz
   -rw-rw-r--. 1 wfuser wfuser 71562 Nov  1 08:55 wf-logs-1541062518.tar.gz
   

Specification of log_archive.sh

This section explains advanced options of the log_archive.sh script, which is used to create an archive of aggregated logs.

The archiving script runs with the following parameters:

/opt/workfusion/tools/log_archive.sh -c nginx -g int -g app -d 2018-11-01

Here,

• -c <component>. The name of a component to aggregate logs from.

• -d <date>. The date of logs in format YYYY-mm-dd, for example, 2018-10-25. You can use regular expressions.
  Example: to view all logs for October 2018, run the script with the following parameter:

  /opt/workfusion/tools/log_archiver.sh -d 2018-10-*
  

• -g <server-group>. The server role of logs. Available server groups are the following:

  • int
  • app
  • ocr
  • bi
  • bep_master
  • bep_agent
  • rpa

• -h <hostname>. A hostname to receive logs from a specific host. You can use regular expressions.

  Example: to receive logs from multiple servers: bep-agent-20.example.com, bep-agent-21.example.com, run the script with the following parameter:

  /opt/workfusion/tools/log_archiver.sh -h bep-agent-2[0-1].example.com