Issue description: Setting vpn ipsec log level 0, I am still able to see DPD informational logs (belongs to level 1 logs level). After troubleshooting, I have found the following.
Noticed the charon-logging.conf and charon-systemd.conf affects logs in the system journal logs only. However, as this bug describes describes https://vyos.dev/T8538, the "set vpn log level 0/1/2" only modifies the charon-systemd.conf, and by default, the value of charon-logging.conf is 1, which leads journald to collect logs at level 1 (includes DPD logs) and not level 0 (only up/down and audit events) as was configured on charon-systemd.conf, by the "set vpn log level 0" command.
Since strongswan logs are based on the rsyslog configuration, it's ok to leave charon-logging.conf at level 1 by default and configure the syslog local facilities levels to any level (warning, errors, etc.) on VyOS. Therefore, if we want to check logal vpn logs at the configured level, we have to configure the "system syslog local facility all level warning/error" as the same level configured on "set vpn ipsec log level 0/1/2".
But if we want to configure the journal logs at any level -1 to 4, then it's necessary to create a VyOS command to modify charon-logging.conf file.
Despite this, there is a correlation between the charon-logging.conf and charon-systemd.conf for logs in the system journal. This is what I have found in 1.5.0 LTS version:
vyos@vyos# sudo cat /etc/strongswan.d/charon-systemd.conf
charon-systemd {
# Section to configure native systemd journal logger, very similar to the
# syslog logger as described in LOGGER CONFIGURATION in strongswan.conf(5).
journal {
# Loglevel for a specific subsystem.
# <subsystem> = <default>
# Default loglevel.
default = 0 --> log level
}
}- If the charon-logging.conf logs level is higher than charon-systemd.conf, we will see in the system journal logs, the level configured in charon-logging.conf. i.e.
level log in logging.conf = 1
level log in systemd.conf = 0
//Result
Journal logs level = 1 (from logging.conf)
- The other way around, if charon-systemd.conf is higher than charon-logging.conf logs, then we will see in the system journal logs, the level in charon-systemd
level log in logging.conf = 0
level log in systemd.conf = 2
//Result
Journal logs level = 2 (from systemd.conf)
Few suggested modifications:
- Leave charon-logging.conf at -1 by default and let charon-systemd handle populating the logs in the system journal (Workaround implemented)
OR
- Create a VyOS command to be able to modify the /etc/strongswan.d/charon-logging.conf
Reference previous bug report: https://vyos.dev/T8538