reduce libvirtd log levels

This change reduces the libvirtd log levels by default
from info to warning level. It also makes both the
log_output and log_filter configurable with support
for partial overrides using the combine filter pattern.

Changes included:
- Add configurable logging parameters to role defaults
- Support partial log filter overrides without redefining all values
- Fix template variable references in virtproxyd.conf and virtnodedevd.conf
- Add comprehensive parameter documentation in argument_specs.yml
- Add molecule test helper for verifying log filter configurations
- Update all libvirt service templates to use new logging variables

Assisted-By: Claude <[email protected]>
Signed-off-by: Sean Mooney <[email protected]>

Author: SeanMooney

roles/edpm_libvirt/defaults/main.yml

@@ -72,3 +72,20 @@ edpm_libvirt_password_path: /var/lib/openstack/configs/{{ edpm_libvirt_service_n
 # certs
 edpm_libvirt_tls_certs_enabled: "{{ edpm_tls_certs_enabled | default(False) }}"
 edpm_libvirt_tls_cert_src_dir: /var/lib/openstack/certs/{{ edpm_libvirt_service_name }}/default
+# logging
+# levels 1: debug, 2: info, 3:warning, 4:error
+# by default we send warning and error log to the journal
+# and do not output debug or info logs to any location
+# this is a space separated list of output <level>:<output method>
+# https://libvirt.org/logging.html
+edpm_libvirt_log_outputs: "3:journald"
+edpm_libvirt_default_log_filters: "3:qemu 3:libvirt 4:object 4:json 4:event 3:util"
+edpm_libvirt_log_filters_defaults:
+  virtqemud: "{{ edpm_libvirt_default_log_filters }}"
+  virtlogd: "{{ edpm_libvirt_default_log_filters }}"
+  virtproxyd: "{{ edpm_libvirt_default_log_filters }}"
+  virtsecretd: "{{ edpm_libvirt_default_log_filters }}"
+  virtnodedevd: "{{ edpm_libvirt_default_log_filters }}"
+
+# Merge user overrides with defaults
+edpm_libvirt_log_filters: "{{ edpm_libvirt_log_filters_defaults | combine(edpm_libvirt_log_filters_override | default({})) }}"

roles/edpm_libvirt/meta/argument_specs.yml

@@ -64,3 +64,28 @@ argument_specs:
         type: str
         description: The vhost user socket directory group name.
         default: ''
+      edpm_libvirt_log_outputs:
+        type: str
+        description: Libvirt log output configuration (level:destination format).
+        default: "3:journald"
+      edpm_libvirt_default_log_filters:
+        type: str
+        description: Default log filter configuration for all libvirt services.
+        default: "3:qemu 3:libvirt 4:object 4:json 4:event 3:util"
+      edpm_libvirt_log_filters_defaults:
+        type: dict
+        description: Dictionary of default log filters for each libvirt service.
+        default:
+          virtqemud: "{{ edpm_libvirt_default_log_filters }}"
+          virtlogd: "{{ edpm_libvirt_default_log_filters }}"
+          virtproxyd: "{{ edpm_libvirt_default_log_filters }}"
+          virtsecretd: "{{ edpm_libvirt_default_log_filters }}"
+          virtnodedevd: "{{ edpm_libvirt_default_log_filters }}"
+      edpm_libvirt_log_filters_override:
+        type: dict
+        description: Dictionary of log filter overrides for specific libvirt services.
+        default: {}
+      edpm_libvirt_log_filters:
+        type: dict
+        description: Combined log filters (defaults merged with overrides) for each libvirt service.
+        default: "{{ edpm_libvirt_log_filters_defaults | combine(edpm_libvirt_log_filters_override | default({})) }}"

roles/edpm_libvirt/molecule/default/converge.yml

@@ -19,3 +19,5 @@
         edpm_libvirt_tls_cert_src_dir: /tmp/pki
         edpm_libvirt_tls_certs_enabled: true
         edpm_libvirt_password_path: /tmp/libvirtpw
+        edpm_libvirt_log_filters_override:
+            virtqemud: "1:qemu 2:libvirt 3:object 4:json"

roles/edpm_libvirt/molecule/default/prepare.yml

@@ -67,6 +67,17 @@
       ansible.builtin.import_role:
         name: osp.edpm.edpm_timezone
 
+    - name: remove vagrant image packages
+      become: true
+      ansible.builtin.dnf:
+        name: "{{ item }}"
+        state: absent
+      loop:
+        # NOTE(sean-k-mooney): without this network connectivity will be lost
+        # when the nft rules are applied as firewalld conflicts with the rules
+        # we set.
+        - firewalld
+
     - name: Create firewall directory
       become: true
       ansible.builtin.file:

roles/edpm_libvirt/molecule/default/test-helpers/verify_logging.yaml

@@ -0,0 +1,13 @@
+- name: Verify libvirt logging
+  vars:
+    expected: "{{item.expected | default('3:qemu 3:libvirt 4:object 4:json 4:event 3:util')}}"
+  block:
+    - name: Detect if libvirt log filters exists {{item.dest}} {{expected}}
+      become: true
+      ansible.builtin.command: grep -q 'log_filters="{{expected}}"' {{item.dest}}
+      register: libvirt_filter_exists
+    - name: Assert log filter exists in {{item.dest}}
+      ansible.builtin.assert:
+        that:
+          - libvirt_filter_exists.rc == 0
+        fail_msg: "libvirt log_filters are incorrect in {{item.dest}} {{expected}}"

roles/edpm_libvirt/molecule/default/verify.yml

@@ -7,6 +7,14 @@
   vars:
     test_helper_dir: "../../../../molecule/test-helpers"
   tasks:
+    - name: ensure libvirt socket activation drop-in directories exist
+      ansible.builtin.include_tasks: "test-helpers/verify_logging.yaml"
+      loop:
+        - {"dest": "/etc/libvirt/virtlogd.conf"}
+        - {"dest": "/etc/libvirt/virtnodedevd.conf"}
+        - {"dest": "/etc/libvirt/virtproxyd.conf"}
+        - {"dest": "/etc/libvirt/virtsecretd.conf"}
+        - {"dest": "/etc/libvirt/virtqemud.conf", "expected": "1:qemu 2:libvirt 3:object 4:json"}
     - name: ensure expected directories exist
       ansible.builtin.include_tasks: "{{test_helper_dir}}/verify_dir.yaml"
       loop:

roles/edpm_libvirt/molecule/vagrant/molecule.yml

@@ -7,8 +7,8 @@ driver:
     name: libvirt
   provision: no
   parallel: true
-  default_box: 'generic/rocky9'
-  # default_box: 'generic/centos9s'
+  # default_box: 'generic/rocky9'
+  default_box: 'generic/centos9s'
 platforms:
 - name: compute-1
   memory: 8192

roles/edpm_libvirt/templates/virtlogd.conf

@@ -1,2 +1,2 @@
-log_filters="1:logging 4:object 4:json 4:event 1:util"
-log_outputs="2:journald"
+log_filters="{{edpm_libvirt_log_filters['virtlogd']}}"
+log_outputs="{{edpm_libvirt_log_outputs}}"

roles/edpm_libvirt/templates/virtnodedevd.conf

@@ -2,5 +2,5 @@ unix_sock_ro_perms="0444"
 unix_sock_rw_perms="0770"
 auth_unix_ro="none"
 auth_unix_rw="none"
-log_filters="1:qemu 1:libvirt 4:object 4:json 4:event 1:util"
-log_outputs="2:journald"
+log_filters="{{edpm_libvirt_log_filters['virtnodedevd']}}"
+log_outputs="{{edpm_libvirt_log_outputs}}"

roles/edpm_libvirt/templates/virtproxyd.conf

@@ -3,5 +3,5 @@ unix_sock_rw_perms="0770"
 auth_unix_ro="none"
 auth_unix_rw="none"
 auth_tls="sasl"
-log_filters="1:qemu 1:libvirt 4:object 4:json 4:event 1:util"
-log_outputs="2:journald"
+log_filters="{{edpm_libvirt_log_filters['virtproxyd']}}"
+log_outputs="{{edpm_libvirt_log_outputs}}"