Skip to content

Exclude azuresecuritylinuxagent namespace from log collection by default #1680

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
zanejohnson-azure wants to merge 1 commit into
base: ci_prod
Choose a base branch
from
Open

Exclude azuresecuritylinuxagent namespace from log collection by default #1680

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions build/common/installer/scripts/tomlparser.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,10 +11,10 @@
@configSchemaVersion = ""
# Setting default values which will be used in case they are not set in the configmap or if configmap doesnt exist
@collectStdoutLogs = true
@stdoutExcludeNamespaces = "kube-system,gatekeeper-system"
@stdoutExcludeNamespaces = "kube-system,gatekeeper-system,azuresecuritylinuxagent"
@stdoutIncludeSystemPods = ""
@collectStderrLogs = true
@stderrExcludeNamespaces = "kube-system,gatekeeper-system"
@stderrExcludeNamespaces = "kube-system,gatekeeper-system,azuresecuritylinuxagent"
@stderrIncludeSystemPods = ""
@collectClusterEnvVariables = true
@logTailPath = "/var/log/containers/*.log"
Expand Down Expand Up @@ -187,12 +187,12 @@ def parseConfigMap
return parsedConfig
else
puts "config::configmap container-azm-ms-agentconfig for settings not mounted, using defaults"
@excludePath = "*_kube-system_*.log"
@excludePath = "*_kube-system_*.log,*_azuresecuritylinuxagent_*.log"
Copy link
Copy Markdown
Contributor

@suyadav1 suyadav1 May 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

FMI, why is gatekeeper-system ns is not part of the defaults?

return nil
end
rescue => errorStr
ConfigParseErrorLogger.logError("Exception while parsing config map for log collection/env variable settings: #{errorStr}, using defaults, please check config map for errors")
@excludePath = "*_kube-system_*.log"
@excludePath = "*_kube-system_*.log,*_azuresecuritylinuxagent_*.log"
return nil
end
end
Expand Down Expand Up @@ -575,7 +575,7 @@ def populateSettingValuesFromConfigMap(parsedConfig)
if (File.file?(@configMapMountPath))
ConfigParseErrorLogger.logError("config::unsupported/missing config schema version - '#{@configSchemaVersion}' , using defaults, please use supported schema version")
end
@excludePath = "*_kube-system_*.log"
@excludePath = "*_kube-system_*.log,*_azuresecuritylinuxagent_*.log"
end

# Write the settings to file, so that they can be set as environment variables
Expand Down
16 changes: 8 additions & 8 deletions kubernetes/container-azm-ms-agentconfig.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,10 +20,10 @@ data:
# In the absense of this configmap, default value for enabled is true
enabled = true
# exclude_namespaces setting holds good only if enabled is set to true
# kube-system,gatekeeper-system log collection are disabled by default in the absence of 'log_collection_settings.stdout' setting. If you want to enable kube-system,gatekeeper-system, remove them from the following setting.
# If you want to continue to disable kube-system,gatekeeper-system log collection keep the namespaces in the following setting and add any other namespace you want to disable log collection to the array.
# In the absense of this configmap, default value for exclude_namespaces = ["kube-system","gatekeeper-system"]
exclude_namespaces = ["kube-system","gatekeeper-system"]
# kube-system,gatekeeper-system,azuresecuritylinuxagent log collection are disabled by default in the absence of 'log_collection_settings.stdout' setting. If you want to enable kube-system,gatekeeper-system,azuresecuritylinuxagent, remove them from the following setting.
# If you want to continue to disable kube-system,gatekeeper-system,azuresecuritylinuxagent log collection keep the namespaces in the following setting and add any other namespace you want to disable log collection to the array.
# In the absense of this configmap, default value for exclude_namespaces = ["kube-system","gatekeeper-system","azuresecuritylinuxagent"]
exclude_namespaces = ["kube-system","gatekeeper-system","azuresecuritylinuxagent"]
# If you want to collect logs from only selective pods inside system namespaces add them to the following setting. Provide namepace:controllerName of the system pod. NOTE: this setting is only for pods in system namespaces
# Valid values for system namespaces are: kube-system, azure-arc, gatekeeper-system, kube-public, kube-node-lease, calico-system. The system namespace used should not be present in exclude_namespaces
# collect_system_pod_logs = ["kube-system:coredns"]
Expand All @@ -32,10 +32,10 @@ data:
# Default value for enabled is true
enabled = true
# exclude_namespaces setting holds good only if enabled is set to true
# kube-system,gatekeeper-system log collection are disabled by default in the absence of 'log_collection_settings.stderr' setting. If you want to enable kube-system,gatekeeper-system, remove them from the following setting.
# If you want to continue to disable kube-system,gatekeeper-system log collection keep the namespaces in the following setting and add any other namespace you want to disable log collection to the array.
# In the absense of this configmap, default value for exclude_namespaces = ["kube-system","gatekeeper-system"]
exclude_namespaces = ["kube-system","gatekeeper-system"]
# kube-system,gatekeeper-system,azuresecuritylinuxagent log collection are disabled by default in the absence of 'log_collection_settings.stderr' setting. If you want to enable kube-system,gatekeeper-system,azuresecuritylinuxagent, remove them from the following setting.
# If you want to continue to disable kube-system,gatekeeper-system,azuresecuritylinuxagent log collection keep the namespaces in the following setting and add any other namespace you want to disable log collection to the array.
# In the absense of this configmap, default value for exclude_namespaces = ["kube-system","gatekeeper-system","azuresecuritylinuxagent"]
Copy link
Copy Markdown
Contributor

@rashmichandrashekar rashmichandrashekar May 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks @zanejohnson-azure . shoudl we also add a test to ensure data from this namespace is excluded?

Copy link
Copy Markdown
Contributor Author

@zanejohnson-azure zanejohnson-azure May 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

tested on a cluster.

see below. when new image is deployed around 4:56 AM, we see logs from azure linux security agent is NOT collected anymore.

image

i also checked logs from other namespace, and confirm they are not affected by this change.

Copy link
Copy Markdown
Contributor Author

@zanejohnson-azure zanejohnson-azure May 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

if an cx wants to collect it, they can enable through using configmap
by changing
exclude_namespaces = ["kube-system","gatekeeper-system","azuresecuritylinuxagent"]
to
exclude_namespaces = ["kube-system","gatekeeper-system"]

exclude_namespaces = ["kube-system","gatekeeper-system","azuresecuritylinuxagent"]
# If you want to collect logs from only selective pods inside system namespaces add them to the following setting. Provide namepace:controllerName of the system pod. NOTE: this setting is only for pods in system namespaces
# Valid values for system namespaces are: kube-system, azure-arc, gatekeeper-system, kube-public, kube-node-lease, calico-system. The system namespace used should not be present in exclude_namespaces
# collect_system_pod_logs = ["kube-system:coredns"]
Copy link
Copy Markdown
Contributor

@suyadav1 suyadav1 May 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should we add azuresecuritylinuxagent ns in this list?

Expand Down
Loading