Add legacy vcap filtering [Finishes #159961631]

Author: anEXPer

jobs/syslog_forwarder/spec

@@ -4,6 +4,7 @@ name: syslog_forwarder
 templates:
   pre-start.erb: bin/pre-start
   syslog-release.conf.erb: config/syslog-release.conf
+  syslog-release-vcap-filter.conf.erb: config/syslog-release-vcap-filter.conf
   syslog-release-custom-rules.conf.erb: config/syslog-release-custom-rules.conf
   syslog-release-forwarding-rules.conf.erb: config/syslog-release-forwarding-rules.conf
   syslog-release-forwarding-setup.conf.erb: config/syslog-release-forwarding-setup.conf
@@ -72,6 +73,18 @@ properties:
       example-custom-rules.md
       at the top level of the release repo.
     default: ""
+  syslog.filter_legacy_vcap_messages:
+    description: >
+      Drop messages with an app name that starts with "vcap."
+      This is intended to prevent near-identical duplicates
+      when using forward_files with legacy Cloud Foundry jobs,
+      which generally use tee to send logs to syslog directly
+      in addition to writing them to the filesystem.
+      This should probably be set to true
+      in any deployment of Cloud Foundry Application Runtime.
+      This may be on by default in the future,
+      though this would be a breaking/major version change.
+    default: false
 
   syslog.tls_enabled:
     description: Set this to true to enable TLS.

jobs/syslog_forwarder/templates/pre-start.erb

@@ -29,6 +29,9 @@ chmod 0644 /etc/rsyslog.d/30-syslog-release-custom-rules.conf
 # We remove the custom rule if it is not valid in the context of the rsyslog config.
 rsyslogd -N1 || (echo 'Custom rule configuration invalid' && rm /etc/rsyslog.d/30-syslog-release-custom-rules.conf)
 
+cp $(dirname $0)/../config/syslog-release-vcap-filter.conf /etc/rsyslog.d/32-syslog-release-vcap-filter.conf
+chmod 0644 /etc/rsyslog.d/32-syslog-release-vcap-filter.conf
+
 cp $(dirname $0)/../config/syslog-release-forwarding-rules.conf /etc/rsyslog.d/35-syslog-release-forwarding-rules.conf
 chmod 0644 /etc/rsyslog.d/35-syslog-release-forwarding-rules.conf
 

jobs/syslog_forwarder/templates/syslog-release-vcap-filter.conf.erb

@@ -0,0 +1,3 @@
+<% unless p('syslog.migration.disabled') || !p('syslog.filter_legacy_vcap_messages') %>
+if ($programname startswith "vcap.") then stop
+<% end %>

tests/acceptance_test.go

@@ -202,6 +202,31 @@ var _ = Describe("Forwarding loglines to a TCP syslog drain", func() {
 	})
 })
 
+var _ = Describe("Optional features to reduce CF log volume", func() {
+	AfterEach(func() {
+		Cleanup()
+	})
+
+	Context("when vcap filtering is enabled to eliminate duplication", func() {
+		BeforeEach(func() {
+			Cleanup()
+			Deploy("manifests/vcap-filtering.yml")
+		})
+		It("filters logs from the vcap side of the tee while forwarding other logs", func() {
+			By("continuing to forward logs from the filesystem")
+			fileMessage := "Old-style CF tee-based message, file side"
+			Eventually(WriteToTestFile(fileMessage)).Should(gbytes.Say(fileMessage))
+
+			By("not forwarding logs written as vcap. user")
+			loggerMessage := "Old-style CF tee-based message, logger side"
+			SendLogMessage(loggerMessage)
+			Consistently(func() string {
+				return ForwardedLogs()
+			}).ShouldNot(ContainSubstring(loggerMessage))
+		})
+	})
+})
+
 var _ = Describe("When syslog is configured to run in unprivileged mode", func() {
 	BeforeEach(func() {
 		Cleanup()

tests/manifests/vcap-filtering.yml

@@ -0,0 +1,40 @@
+---
+name: ((deployment))
+releases:
+  - name: syslog
+    version: latest
+stemcells:
+  - alias: default
+    os: ((stemcell-os))
+    version: latest
+instance_groups:
+  - name: forwarder
+    instances: 1
+    vm_type: default
+    stemcell: default
+    networks:
+      - name: default
+    azs:
+      - z1
+    jobs:
+      - name: syslog_forwarder
+        release: syslog
+    properties:
+      syslog:
+        filter_legacy_vcap_messages: true
+  - name: storer
+    instances: 1
+    vm_type: default
+    stemcell: default
+    networks:
+      - name: default
+    azs:
+      - z1
+    jobs:
+      - name: syslog_storer
+        release: syslog
+update:
+  canaries: 1
+  max_in_flight: 1
+  canary_watch_time: 1000-60000
+  update_watch_time: 1000-60000