From f63710c0ee8a455b321020f57a4c583fbd990256 Mon Sep 17 00:00:00 2001 From: Erdem Meydanli Date: Tue, 12 Mar 2024 16:36:16 +0000 Subject: [PATCH] vsock_proxy: set log level to warn Initially, logging was disabled by default for the vsock service. This change enables warning and error logs, allowing easier troubleshooting of connectivity issues. Signed-off-by: Erdem Meydanli --- vsock_proxy/README.md | 7 +++++++ vsock_proxy/service/nitro-enclaves-vsock-proxy.service | 4 ++-- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/vsock_proxy/README.md b/vsock_proxy/README.md index 23cd0a19..a5b633c2 100644 --- a/vsock_proxy/README.md +++ b/vsock_proxy/README.md @@ -100,3 +100,10 @@ systemctl enable nitro-enclaves-vsock-proxy.service The service files can be found in `service` directory. The proxy is ran using the default configuration from `/etc/nitro_enclaves/vsock-proxy.yaml`, on local port 8000 and the AWS KMS endpoint corresponding to the region of the instance. + +You can use the following command to check the vsock proxy logs to diagnose connectivity issues. +``` +journalctl -eu nitro-enclaves-vsock-proxy.service +``` +To enable more detailed logging output, set the `RUST_LOG` environment variable to the `trace` log level in +the service file (e.g.`/usr/lib/systemd/system/nitro-enclaves-vsock-proxy.service`). diff --git a/vsock_proxy/service/nitro-enclaves-vsock-proxy.service b/vsock_proxy/service/nitro-enclaves-vsock-proxy.service index 96a5c6e4..8b7bcd4a 100644 --- a/vsock_proxy/service/nitro-enclaves-vsock-proxy.service +++ b/vsock_proxy/service/nitro-enclaves-vsock-proxy.service @@ -8,11 +8,11 @@ Type=simple StandardOutput=journal StandardError=journal SyslogIdentifier=vsock-proxy +# Use RUST_LOG=trace for more verbose logging ExecStart=/bin/bash -ce "TOKEN=$(curl --silent -X PUT \"http://169.254.169.254/latest/api/token\" -H \"X-aws-ec2-metadata-token-ttl-seconds: 21600\") ; \ REGION=$(curl --silent -H \"X-aws-ec2-metadata-token: $TOKEN\" http://169.254.169.254/latest/dynamic/instance-identity/document | jq -r .region) ; \ [ -z \"$REGION\" ] && REGION=$(curl --silent http://169.254.169.254/latest/dynamic/instance-identity/document | jq -r .region) ; \ - exec /usr/bin/vsock-proxy 8000 kms.$${REGION}.amazonaws.com 443 \ - --config /etc/nitro_enclaves/vsock-proxy.yaml" + RUST_LOG=warn exec /usr/bin/vsock-proxy 8000 kms.$${REGION}.amazonaws.com 443 --config /etc/nitro_enclaves/vsock-proxy.yaml" Restart=always TimeoutSec=0