hashicorp / vault

A tool for secrets management, encryption as a service, and privileged access management
https://www.vaultproject.io/
Other
30.85k stars 4.17k forks source link

Logs emitted by a database plugin(v4) is not shown in Vault logs under `info` level. #12343

Closed sebinjohn closed 1 year ago

sebinjohn commented 3 years ago

Describe the bug

Logs emitted by a database plugin(v4) is not shown in Vault logs under info level.

To Reproduce

Test - 1

  1. Terminal 1: make start-vault LOG_LEVEL=info
  2. Terminal 2: make dev-flow
  3. Check for the string " plugin-mockdb: the type is MOCK" in the vault logs in Terminal 1
  4. Terminal 1: Kill the running vault

Test - 2

  1. Terminal 1: make start-vault LOG_LEVEL=debug
  2. Terminal 2: make dev-flow
  3. Check for the string " plugin-mockdb: the type is MOCK" in the vault logs in Terminal 1

Expected behavior In both test cases, the logs should show the string plugin-mockdb: the type is MOCK. But it is visible only when vault log level is set to DEBUG.

Environment:

* Vault CLI Version (retrieve with `vault version`):

% vault --version Vault v1.8.1 ('4b0264f28defc05454c31277cfa6ff63695a458d+CHANGES')


* Server Operating System/Architecture: Darwin/Amd64

Vault server configuration file(s): This is reproducible in dev server 

**Additonal Context**

The readme at https://github.com/hashicorp/go-plugin/tree/master/ says

> Built-in Logging. Any plugins that use the log standard library will have log data automatically sent to the host process. The host process will mirror this output prefixed with the path to the plugin binary. This makes debugging with plugins simple. If the host system uses hclog then the log data will be structured. If the plugin also uses hclog, logs from the plugin will be sent to the host hclog and be structured.

The issue is faced in our production environment but to reproduce the issue I'm using a mock database plugin 
This is a v4 plugin and I'm not sure if the issue will occur with v5. The issue is reproducible with dev servers.
ncabatoff commented 1 year ago

Hi @sebinjohn,

Thanks for filing this issue.

There are always going to be differences of opinion as to what the appropriate severity for a given log line ought to be, e.g. some will find it infuriating that message X isn't visible at INFO, whereas others would find their INFO logs too noisy if X were included.

Because it's so situational, we generally don't accept requests to change log levels unless there's a really compelling argument. There are alternatives to get lower severity logs without changing the system log level for everything, e.g. you can use vault monitor or sys/loggers.