Logging 6.2 Release Notes

Before this update, application programming interface (API) audit logs collected from the management cluster used the cluster_id value from the management cluster. With this update, API audit logs use the cluster_id value from the guest cluster. (LOG-4445)

Before this update, issuing the oc explain obsclf.spec.filters command did not list all the supported filters in the command output. With this update, all the supported filter types are listed in the command output. (LOG-6753)

Before this update the log collector flagged a ClusterLogForwarder resource with multiple inputs to a LokiStack output as invalid due to incorrect internal processing logic. This update fixes the issue. (LOG-6758)

Before this update, issuing the oc explain command for the clusterlogforwarder.spec.outputs.syslog resource returned an incomplete result. With this update, the missing supported types for rfc and enrichment attributes are listed in the result correctly. (LOG-6869)

Before this update, empty OpenTelemetry (OTEL) tuning configuration caused validation errors. With this update, validation rules have been updated to accept empty tuning configuration. (LOG-6878)

Before this update the Red Hat OpenShift Logging Operator could not update the securitycontextconstraint resource that is required by the log collector. With this update, the required cluster role has been provided to the service account of the Red Hat OpenShift Logging Operator. As a result of which, Red Hat OpenShift Logging Operator can create or update the securitycontextconstraint resource. (LOG-6879)

Before this update, the API documentation for the URL attribute of the syslog resource incorrectly mentioned the value udps as a supported value. With this update, all references to udps have been removed. (LOG-6896)

Before this update, the Red Hat OpenShift Logging Operator was intermittently unable to update the object in logs due to update conflicts. This update resolves the issue and prevents conflicts during object updates by using the Patch() function instead of the Update() function. (LOG-6953)

Before this update, Loki ingesters that got into an unhealthy state due to networking issues stayed in that state even after the network recovered. With this update, you can configure the Loki Operator to perform service discovery more often so that unhealthy ingesters can rejoin the group. (LOG-6992)

Before this update, the Vector collector could not forward Open Virtual Network (OVN) and Auditd logs. With this update, the Vector collector can forward OVN and Auditd logs. (LOG-6997)

CVE-2022-49043

CVE-2024-2236

CVE-2024-5535

CVE-2024-56171

CVE-2025-24928

With this update, OpenTelemetry support offered by OpenShift Logging continues to improve, specifically in the area of enabling migrations from the ViaQ data model to OpenTelemetry when forwarding to LokiStack. (LOG-6146)

With this update, the structuredMetadata field has been removed from Loki Operator in the otlp configuration because structured metadata is now the default type. Additionally, the update introduces a drop field that administrators can use to drop OpenTelemetry attributes when receiving data through OpenTelemetry protocol (OTLP). (LOG-6507)

Before this update, the timestamp shown in the console logs did not match the @timestamp field in the message. With this update the timestamp is correctly shown in the console. (LOG-6222)

The introduction of ClusterLogForwarder 6.x modified the ClusterLogForwarder API to allow for a consistent templating mechanism. However, this was not applied to the syslog output spec API for the facility and severity fields. This update adds the required validation to the ClusterLogForwarder API for the facility and severity fields. (LOG-6661)

Before this update, an error in the Loki Operator generating the Loki configuration caused the amount of workers to delete to be zero when 1x.pico was set as the LokiStack size. With this update, the number of workers to delete is set to 10. (LOG-6781)

The previous data model encoded all information in JSON. The console still uses the query of the previous data model to decode both old and new entries. The logs that are stored by using the new OpenTelemetry data model for the LokiStack output display the following error in the logging console:

__error__ JSONParserErr
__error_details__ Value looks like object, but can't find closing '}' symbol

Currently, the API documentation incorrectly mentions OpenTelemetry protocol (OTLP) attributes as included instead of excluded in the descriptions of the drop field. (LOG-6839).

CVE-2020-11023

CVE-2024-12797