tmt: archive audit and journal logs after test execution

[lsm5]

What type of PR is this?

/kind other

What this PR does / why we need it:

captures audit logs

How to verify it

audit logs visible somewhere in testing-farm job run.

Which issue(s) this PR fixes:

None

Special notes for your reviewer:

None

Does this PR introduce a user-facing change?

None

[lsm5]

@nalind PTAL. In the failed testing-farm job, see data -> audit-logs -> audit.log . At least on my browser, it wants to download the log by default, which is annoying but at least it's there now.

cc @containers/buildah-maintainers

Related: #6800 (comment)

[Luap99]

audit logs are part of the journald output normally I think? On cirrus we just upload the full journal output because that may contain much more useful information there, not just audit.

[Luap99]

buildah/.cirrus.yml

Line 184 in 520f469

journal_script: '$GOSRC/$SCRIPT_BASE/logcollector.sh journal'

buildah/contrib/cirrus/logcollector.sh

Line 18 in 520f469

journal) showrun journalctl -b ;;

[lsm5]

audit logs are part of the journald output normally I think? On cirrus we just upload the full journal output because that may contain much more useful information there, not just audit.

sgtm, I can update PR to include that too.

[Luap99]

you likely want the -b here so we only see the logs of the current boot, in case there are older journal files around already on the system, or does tmt reboot the VM before collecting the logs?

Also just use &> "$TMT_PLAN_DATA/logs/journal.log" to redirect both stdout/err which is simpler to use than defining to redirects after each other.

[lsm5]

you likely want the -b here so we only see the logs of the current boot, in case there are older journal files around already on the system, or does tmt reboot the VM before collecting the logs?

AFAIK, it doesn't reboot unless you issue a tmt-reboot, so we should be fine with -b.

Also just use &> "$TMT_PLAN_DATA/logs/journal.log" to redirect both stdout/err which is simpler to use than defining to redirects after each other.

Yes, thanks. Updating..

[lsm5]

@containers/buildah-maintainers good for another look. Both audit and journal logs captured in data -> logs.

[Luap99]

LGTM

[nalind]

LGTM