Uninstalling rsyslog to use syslog-ng uninstalls google-compute-engine and breaks a lot of stuff

[fdr]

As-is, removing rsyslog on CentOS 8 uninstalls critical google cloud functionality because of this dependency:

guest-configs/packaging/google-compute-engine.spec

Line 32 in 9eb32c9

Requires: rsyslog

I stumbled upon this because after uninstalling rsyslog, my startup scripts would not work, neither would browser SSH nor key management. Upon running reqoquery and inspecting google-compute-engine, I realized I shouldn't use GCP without this package.

The Debian version has been changed to rely on a virtual package to solve this, but there's no similar remedy for CentOS et al yet: GoogleCloudPlatform/compute-image-packages#548, GoogleCloudPlatform/compute-image-packages@f3fd94c. The virtual package name provided by both rsyslog and syslog-ng on CentOS 8 is syslog:

$ comm -12 <(repoquery --provides rsyslog | sort) <(repoquery --provides syslog-ng | sort)
syslog

The only unique thing rsyslog gets is kernel logs, and perhaps a duplicate copy of all daemon facility logs (when systemd is present):

guest-configs/src/etc/rsyslog.d/90-google.conf

Line 6 in 9eb32c9

daemon,kern.* /dev/console

Forwarding the "daemon" facility was made redundant for systemd OSes in GoogleCloudPlatform/compute-image-packages@aaea64d

Though there are various forms of solution, I don't think kernel logs in the console are worth breaking ssh key management, startup-scripts, etc should one uninstall rsyslog, if it came down to that. If you want, I can furnish and test a syslog-ng configuration fragment to send kernel output to the console, so things can Just Work for the two major syslog implementations.

A duplicate issue from last year:
GoogleCloudPlatform/compute-image-packages#897

[zmarano]

/assign @hopkiw

[hopkiw]

Thanks for the detailed issue, @fdr
We are currently testing a change to our logging setup on GCE-provided OS images, and that will affect the policy for these package dependencies. Once finalized, we should be able to remove this dependency. I'll update this bug.

[fdr]

No problem. My current solution is to leave rsyslog installed and forgo kernel output for now: it's good enough to proceed. Thanks for getting back to me.

[fdr]

@hopkiw did this get any better? I see at least one commit that looks like it could indicate things are better, though it doesn't address the rpm spec file uninstalling the google agents altogether if I run yum remove rsyslog