set default log level when not set in policy (#5452) (#5474)

* set default log level when not set in policy

* added changelog

* fix lint

* update log message

* fix tests

* move default logic to SetLogLevel

* Update changelog/fragments/1725620525-fix-default-log-level-policy-change.yaml

Co-authored-by: Paolo Chilà <[email protected]>

* updated changelog

---------

Co-authored-by: Paolo Chilà <[email protected]>
(cherry picked from commit 3b911c7)

Co-authored-by: Julia Bardi <[email protected]>

Author: mergify[bot]

changelog/fragments/1725620525-fix-default-log-level-policy-change.yaml

@@ -0,0 +1,32 @@
+# Kind can be one of:
+# - breaking-change: a change to previously-documented behavior
+# - deprecation: functionality that is being removed in a later release
+# - bug-fix: fixes a problem in a previous version
+# - enhancement: extends functionality but does not break or fix existing behavior
+# - feature: new functionality
+# - known-issue: problems that we are aware of in a given version
+# - security: impacts on the security of a product or a user’s deployment.
+# - upgrade: important information for someone upgrading from a prior version
+# - other: does not fit into any of the other categories
+kind: bug-fix
+
+# Change summary; a 80ish characters long description of the change.
+summary: Set default log level on policy change, when policy does not have a log level
+
+# Long description; in case the summary is not enough to describe the change
+# this field accommodate a description without length limits.
+# NOTE: This field will be rendered only for breaking-change and known-issue kinds at the moment.
+#description:
+
+# Affected component; usually one of "elastic-agent", "fleet-server", "filebeat", "metricbeat", "auditbeat", "all", etc.
+component: elastic-agent
+
+# PR URL; optional; the PR number that added the changeset.
+# If not present is automatically filled by the tooling finding the PR where this changelog fragment has been added.
+# NOTE: the tooling supports backports, so it's able to fill the original PR number instead of the backport PR number.
+# Please provide it if you are adding a fragment for a different PR.
+pr: https://github.com/elastic/elastic-agent/pull/5452
+
+# Issue URL; optional; the GitHub issue related to this changeset (either closes or is part of).
+# If not present is automatically filled by the tooling with the issue linked to the PR number.
+issue: https://github.com/elastic/elastic-agent/issues/5451

internal/pkg/agent/application/actions/handlers/handler_action_policy_change.go

@@ -342,11 +342,11 @@ func (h *PolicyChangeHandler) handlePolicyChange(ctx context.Context, c *config.
 }
 
 // hasEventLoggingOutputChanged returns true if the output of the event logger has changed
-func (p *PolicyChangeHandler) hasEventLoggingOutputChanged(new *configuration.Configuration) bool {
+func (h *PolicyChangeHandler) hasEventLoggingOutputChanged(new *configuration.Configuration) bool {
 	switch {
-	case p.config.Settings.EventLoggingConfig.ToFiles != new.Settings.EventLoggingConfig.ToFiles:
+	case h.config.Settings.EventLoggingConfig.ToFiles != new.Settings.EventLoggingConfig.ToFiles:
 		return true
-	case p.config.Settings.EventLoggingConfig.ToStderr != new.Settings.EventLoggingConfig.ToStderr:
+	case h.config.Settings.EventLoggingConfig.ToStderr != new.Settings.EventLoggingConfig.ToStderr:
 		return true
 	default:
 		return false

internal/pkg/agent/application/actions/handlers/handler_action_settings.go

@@ -103,10 +103,19 @@ func (h *Settings) SetLogLevel(ctx context.Context, lvl *logp.Level) error {
 	h.fallbackLogLevel = lvl
 	rawLogLevel := h.agentInfo.RawLogLevel()
 	h.log.Debugf("received fallback loglevel %s, raw loglevel %s", lvl, rawLogLevel)
-	if rawLogLevel == "" && lvl != nil {
-		h.log.Debugf("setting log level %s", lvl)
-		// set the runtime log level only if we don't have one set for the specific agent
-		return h.logLevelSetter.SetLogLevel(ctx, lvl)
+	if rawLogLevel == "" {
+		// There's no log level set for this specific agent
+		if lvl != nil {
+			// log level set on the policy
+			h.log.Debugf("setting log level %s", lvl)
+			// set the runtime log level only if we don't have one set for the specific agent
+			return h.logLevelSetter.SetLogLevel(ctx, lvl)
+		} else {
+			// Both the policy log level and the agent-specific log level are not set: set the default agent level
+			h.log.Debugf("setting log level to default")
+			defaultLogLevel := logger.DefaultLogLevel
+			return h.logLevelSetter.SetLogLevel(ctx, &defaultLogLevel)
+		}
 	}
 	return nil
 }

internal/pkg/agent/application/actions/handlers/handler_action_settings_test.go

@@ -25,6 +25,7 @@ func TestSettings_SetLogLevel(t *testing.T) {
 
 	// test log level we use in testcases
 	testWarnLevel := logp.WarnLevel
+	defaultLogLevel := logger.DefaultLogLevel
 
 	type fields struct {
 		fallbackLogLevel *logp.Level
@@ -61,8 +62,7 @@ func TestSettings_SetLogLevel(t *testing.T) {
 			},
 			setupMocks: func(t *testing.T, setter *mockhandlers.LogLevelSetter, agent *mockinfo.Agent) {
 				agent.EXPECT().RawLogLevel().Return("").Once()
-				// we should never call the SetLogLevel with nil, for simplicity remove the expectation altogether
-				// setter.EXPECT().SetLogLevel(mock.Anything, nil).Return(nil).Times(0)
+				setter.EXPECT().SetLogLevel(mock.Anything, &defaultLogLevel).Return(nil).Once()
 			},
 			wantErr:              assert.NoError,
 			wantFallbackLogLevel: nil,