hashicorp / hashicorp/boundary

Config.hcl doesn't react to SIGHUP

Open
#3,384 2 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Go
Stars
4.1k
Forks
317
Avg merge
5h 10m
Merged PRs (30d)
1

Description

Hi there,

We have configured audit logging to a file (boundary.ndjson) in the config.hcl. We also want to use logrotation to rotate the logs written to the log file. Logrotate renames the old file (e.g. boundary.ndjson-20230705) and creates a new file with the name boundary.ndjson. After rotating the file, logrotate sends a SIGHUP signal to boundary config.hcl, so that the config.hcl is read again and writes the logs to the newly created file. The problem is, that boundary continues to write to the old file (boundary.ndjson-20230705). Our first thought was that if there are no changes in the config.hcl, boundary has no reason to read it again after receiving the HUP signal and thats why it continues writting to the old file.

To test this assumption, we changed the file name from boundary.ndjson to boundary.ndjson-1 in the config.hcl to figure out if SIGHUP works when there are changes in the config file. In fact we were able to see the read process of the config.hcl file with strace after sending the SIGHUP. It also reads the config file correctly. However, changes in the config file are not applied and it also continues writting to the old file (boundary.ndjson).

**Steps to Reproduce**
boundary version 0.13.0
Config for logging in config.hcl:
```bash
events {
observations_enabled = true
sysevents_enabled = true
audit_enabled = true
sink {
name = "audit-sink"
description = "Audits sent to a file"
event_types = ["*"]
format = "cloudevents-json"
audit_config {
audit_filter_overrides {
sensitive = ""
secret = ""
}
}
file {
path = "/var/log/boundary"
file_name = "boundary.ndjson"
}
}
}
```
Logrotate config:
```bash
/root/container_logs/boundary.ndjson {
weekly
rotate 52
compress
delaycompress
dateext
postrotate
pidboundary=$(pidof boundary server)
docker exec boundary kill -HUP $pidboundary
endscript
}
```

**Expected behavior**
The config.hcl should after receiving a SIGHUP signal from logrotate reread the config file and and change the writing to the new logfile.

Contributor guide

Open the contributing guide

Research direction

Start by tracing how Boundary handles SIGHUP and reloads config.hcl, then follow the audit file sink lifecycle after the reload. Use the supplied logrotate setup and strace observation to verify whether the new file path is applied; done means logging switches from the rotated file to the newly created boundary.ndjson.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
backend, observability-sre
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.