Problem to solve
We are running Gitlab EE 17.8 docker image and we have been unable to get the log level under control. In particular the gitlab-workhorse logs, won’t stop filling our SIEM server.
Also, ironically, many log lines from remote-syslog. A few sample lines:
2025-03-11_04:29:54.34643 gitlab remote-syslog: from /opt/gitlab/embedded/bin/remote_syslog:25:in `<main>'
2025-03-11_04:29:54.34600 gitlab remote-syslog: from /opt/gitlab/embedded/lib/ruby/gems/3.2.0/gems/remote_syslog-1.6.15/lib/remote_syslog/cli.rb:27:in `new'
2025-03-11_04:29:54.34633 gitlab remote-syslog: from /opt/gitlab/embedded/bin/remote_syslog:25:in `load'
2025-03-11_04:29:54.34623 gitlab remote-syslog: from /opt/gitlab/embedded/lib/ruby/gems/3.2.0/gems/remote_syslog-1.6.15/bin/remote_syslog:6:in `<top (required)>'
2025-03-11_04:29:54.34609 gitlab remote-syslog: from /opt/gitlab/embedded/lib/ruby/gems/3.2.0/gems/remote_syslog-1.6.15/lib/remote_syslog/cli.rb:27:in `process!'
Do I need to add something to the docker-compose file, or am I just using the wrong syntax.
Configuration
The following settings are in the gitlab.rb file:
logging['udp_log_shipping_host'] = '192.168.4.4'
logging['udp_log_shipping_hostname'] = 'gitlab'
logging['udp_log_shipping_port'] = 514
Various lines to try to control log level:
gitlab_rails['env'] = { "GITLAB_LOG_LEVEL" => "WARN", }
registry['log_level'] = "warn"
gitlab_workhorse['log_level'] = "warn"
gitlab_shell['log_level'] = 'WARN'
patroni['log_level'] = 'WARN'
Versions
Please add an x whether options apply, and add the version information.
- Self-managed
-
GitLab.com
SaaS - Dedicated
Versions
GitLab Enterprise Edition v17.8.1-ee
I’ve seen the question asked in various places, but have yet to find an answer that works.