logging: do not log into the root logger

Deprecate `ipa_log_manager.root_logger` and replace all calls to it with
module-level logger calls.

Reviewed-By: Martin Basti <mbasti@redhat.com>

daemons/dnssec/ipa-dnskeysync-replica

@@ -18,7 +18,7 @@ import ipalib
 from ipalib.constants import SOFTHSM_DNSSEC_TOKEN_LABEL
 from ipalib.install.kinit import kinit_keytab
 from ipapython.dn import DN
-from ipapython.ipa_log_manager import root_logger, standard_logging_setup
+from ipapython.ipa_log_manager import standard_logging_setup
 from ipapython import ipaldap
 from ipaplatform.paths import paths
 from ipaserver.dnssec.abshsm import (sync_pkcs11_metadata,
@@ -136,28 +136,27 @@ def ldap2replica_zone_keys_sync(ldapkeydb, localhsm):
 standard_logging_setup(verbose=True, debug=True)
 ipalib.api.bootstrap(context='dns', confdir=paths.ETC_IPA, in_server=True)
 ipalib.api.finalize()
-log = root_logger
 
 # Kerberos initialization
 PRINCIPAL = str('%s/%s' % (DAEMONNAME, ipalib.api.env.host))
-log.debug('Kerberos principal: %s', PRINCIPAL)
+logger.debug('Kerberos principal: %s', PRINCIPAL)
 ccache_filename = os.path.join(WORKDIR, 'ipa-dnskeysync-replica.ccache')
 
 try:
     kinit_keytab(PRINCIPAL, paths.IPA_DNSKEYSYNCD_KEYTAB, ccache_filename,
                  attempts=5)
 except GSSError as e:
-    log.critical('Kerberos authentication failed: %s', e)
+    logger.critical('Kerberos authentication failed: %s', e)
     sys.exit(1)
 
 os.environ['KRB5CCNAME'] = ccache_filename
-log.debug('Got TGT')
+logger.debug('Got TGT')
 
 # LDAP initialization
 ldap = ipaldap.LDAPClient(ipalib.api.env.ldap_uri)
-log.debug('Connecting to LDAP')
+logger.debug('Connecting to LDAP')
 ldap.gssapi_bind()
-log.debug('Connected')
+logger.debug('Connected')
 
 
 ### DNSSEC master: key synchronization

daemons/dnssec/ipa-dnskeysyncd

@@ -14,17 +14,20 @@ import time
 from ipalib import api
 from ipalib.install.kinit import kinit_keytab
 from ipapython.dn import DN
-from ipapython.ipa_log_manager import root_logger, standard_logging_setup
+from ipapython.ipa_log_manager import standard_logging_setup
 from ipapython import ipaldap
 from ipaplatform.paths import paths
 from ipaserver.dnssec.keysyncer import KeySyncer
 
+logger = logging.getLogger(os.path.basename(__file__))
+
+
 # IPA framework initialization
 standard_logging_setup(verbose=True)
 api.bootstrap(context='dns', confdir=paths.ETC_IPA, in_server=True)
 api.finalize()
-log = root_logger
 if api.env.debug:
+    root_logger = logging.getLogger()
     root_logger.setLevel(logging.DEBUG)
 
 # Global state
@@ -42,7 +45,7 @@ def commenceShutdown(signum, stack):
     global watcher_running
     global ldap_connection  # pylint: disable=global-variable-not-assigned
 
-    log.info('Signal %s received: Shutting down!', signum)
+    logger.info('Signal %s received: Shutting down!', signum)
 
     # We are no longer running
     watcher_running = False
@@ -64,12 +67,12 @@ signal.signal(signal.SIGINT, commenceShutdown)
 
 # Kerberos initialization
 PRINCIPAL = str('%s/%s' % (DAEMONNAME, api.env.host))
-log.debug('Kerberos principal: %s', PRINCIPAL)
+logger.debug('Kerberos principal: %s', PRINCIPAL)
 ccache_filename = os.path.join(WORKDIR, 'ipa-dnskeysyncd.ccache')
 try:
     kinit_keytab(PRINCIPAL, KEYTAB_FB, ccache_filename, attempts=5)
 except Exception as ex:
-    log.critical("Kerberos authentication failed: %s", ex)
+    logger.critical("Kerberos authentication failed: %s", ex)
     # signal failure and let init system to restart the daemon
     sys.exit(1)
 os.environ['KRB5CCNAME'] = ccache_filename
@@ -80,7 +83,7 @@ ldap_url = ldapurl.LDAPUrl(api.env.ldap_uri)
 ldap_url.dn = str(basedn)
 ldap_url.scope = ldapurl.LDAP_SCOPE_SUBTREE
 ldap_url.filterstr = '(|(objectClass=idnsZone)(objectClass=idnsSecKey)(objectClass=ipk11PublicKey))'
-log.debug('LDAP URL: %s', ldap_url.unparse())
+logger.debug('LDAP URL: %s', ldap_url.unparse())
 
 # Real work
 while watcher_running:
@@ -89,18 +92,18 @@ while watcher_running:
 
     # Now we login to the LDAP server
     try:
-        log.info('LDAP bind...')
+        logger.info('LDAP bind...')
         ldap_connection.sasl_interactive_bind_s("", ipaldap.SASL_GSSAPI)
     except ldap.INVALID_CREDENTIALS as e:
-        log.exception('Login to LDAP server failed: %s', e)
+        logger.exception('Login to LDAP server failed: %s', e)
         sys.exit(1)
     except ldap.SERVER_DOWN as e:
-        log.exception('LDAP server is down, going to retry: %s', e)
+        logger.exception('LDAP server is down, going to retry: %s', e)
         time.sleep(5)
         continue
 
     # Commence the syncing
-    log.info('Commencing sync process')
+    logger.info('Commencing sync process')
     ldap_search = ldap_connection.syncrepl_search(
         ldap_url.dn,
         ldap_url.scope,
@@ -113,5 +116,5 @@ while watcher_running:
         while ldap_connection.syncrepl_poll(all=1, msgid=ldap_search):
             pass
     except (ldap.SERVER_DOWN, ldap.CONNECT_ERROR) as e:
-        log.exception('syncrepl_poll: LDAP error (%s)', e)
+        logger.exception('syncrepl_poll: LDAP error (%s)', e)
         sys.exit(1)

daemons/dnssec/ipa-ods-exporter

@@ -35,7 +35,6 @@ import ipalib
 from ipalib.constants import SOFTHSM_DNSSEC_TOKEN_LABEL
 from ipalib.install.kinit import kinit_keytab
 from ipapython.dn import DN
-from ipapython.ipa_log_manager import root_logger
 from ipapython import ipaldap
 from ipaplatform.paths import paths
 from ipaserver.dnssec.abshsm import sync_pkcs11_metadata, wrappingmech_name2id
@@ -617,8 +616,9 @@ def cleanup_ldap_zone(ldap, dns_dn, zone_name):
         logger.debug('%s: deleting key metadata "%s"', zone_name, ldap_key.dn)
         ldap.delete_entry(ldap_key)
 
-log = root_logger
+
 # this service is usually socket-activated
+root_logger = logging.getLogger()
 root_logger.addHandler(systemd.journal.JournalHandler())
 root_logger.setLevel(level=logging.DEBUG)
 
@@ -636,25 +636,25 @@ ipalib.api.finalize()
 
 # Kerberos initialization
 PRINCIPAL = str('%s/%s' % (DAEMONNAME, ipalib.api.env.host))
-log.debug('Kerberos principal: %s', PRINCIPAL)
+logger.debug('Kerberos principal: %s', PRINCIPAL)
 ccache_name = paths.IPA_ODS_EXPORTER_CCACHE
 
 try:
     kinit_keytab(PRINCIPAL, paths.IPA_ODS_EXPORTER_KEYTAB, ccache_name,
                  attempts=5)
 except GSSError as e:
-    log.critical('Kerberos authentication failed: %s', e)
+    logger.critical('Kerberos authentication failed: %s', e)
     sys.exit(1)
 
 os.environ['KRB5CCNAME'] = ccache_name
-log.debug('Got TGT')
+logger.debug('Got TGT')
 
 # LDAP initialization
 dns_dn = DN(ipalib.api.env.container_dns, ipalib.api.env.basedn)
 ldap = ipaldap.LDAPClient(ipalib.api.env.ldap_uri)
-log.debug('Connecting to LDAP')
+logger.debug('Connecting to LDAP')
 ldap.gssapi_bind()
-log.debug('Connected')
+logger.debug('Connected')
 
 
 ### DNSSEC master: key material upload & synchronization (but not deletion)
@@ -676,8 +676,8 @@ master2ldap_zone_keys_sync(ldapkeydb, localhsm)
 try:
     cmd, conn = receive_systemd_command()
     if len(sys.argv) != 1:
-        log.critical('No additional parameters are accepted when '
-                     'socket activation is used.')
+        logger.critical('No additional parameters are accepted when '
+                        'socket activation is used.')
         sys.exit(1)
 # Handle cases where somebody ran the program without systemd.
 except KeyError as e:
@@ -693,10 +693,10 @@ exitcode, msg, zone_name, cmd = parse_command(cmd)
 if exitcode is not None:
     if conn:
         send_systemd_reply(conn, msg)
-    log.info(msg)
+    logger.info("%s", msg)
     sys.exit(exitcode)
 else:
-    log.debug(msg)
+    logger.debug("%s", msg)
 
 # Open DB directly and read key timestamps etc.
 db = None
@@ -734,7 +734,7 @@ try:
 
 except Exception as ex:
     msg = "ipa-ods-exporter exception: %s" % traceback.format_exc(ex)
-    log.exception(ex)
+    logger.exception("%s", ex)
     raise ex
 
 finally:
@@ -745,4 +745,4 @@ finally:
         if conn:
             send_systemd_reply(conn, msg)
 
-log.debug('Done')
+logger.debug('Done')