ticket 2022 - modify codebase to utilize IPALogManager, obsoletes logging

change default_logger_level to debug in configure_standard_logging

add new ipa_log_manager module, move log_mgr there, also export
root_logger from log_mgr.

change all log_manager imports to ipa_log_manager and change
log_manager.root_logger to root_logger.

add missing import for parse_log_level()

15 files changed, 99 insertions, 143 deletions

diff --git a/install/migration/migration.py b/install/migration/migration.py
index 8edd67869..449d35c66 100644
--- a/install/migration/migration.py
+++ b/install/migration/migration.py
@@ -25,7 +25,7 @@ import errno
 import glob
 import ldap
 import wsgiref
-import logging
+from ipapython.ipa_log_manager import *
 from ipapython.ipautil import get_ipa_basedn
 
 BASE_DN = ''
@@ -68,7 +68,7 @@ def get_base_dn():
         conn.simple_bind_s('', '')
         BASE_DN = get_ipa_basedn(conn)
     except ldap.LDAPError, e:
-        logging.error('migration context search failed: %s' % e)
+        root_logger.error('migration context search failed: %s' % e)
         return ''
     finally:
         conn.unbind_s()
@@ -78,7 +78,7 @@ def get_base_dn():
 def bind(username, password):
     base_dn = get_base_dn()
     if not base_dn:
-        logging.error('migration unable to get base dn')
+        root_logger.error('migration unable to get base dn')
         raise IOError(errno.EIO, 'Cannot get Base DN')
     bind_dn = 'uid=%s,cn=users,cn=accounts,%s' % (username, base_dn)
     try:
@@ -86,10 +86,10 @@ def bind(username, password):
         conn.simple_bind_s(bind_dn, password)
     except (ldap.INVALID_CREDENTIALS, ldap.UNWILLING_TO_PERFORM,
             ldap.NO_SUCH_OBJECT), e:
-        logging.error('migration invalid credentials for %s: %s' % (bind_dn, convert_exception(e)))
+        root_logger.error('migration invalid credentials for %s: %s' % (bind_dn, convert_exception(e)))
         raise IOError(errno.EPERM, 'Invalid LDAP credentials for user %s' % username)
     except ldap.LDAPError, e:
-        logging.error('migration bind failed: %s' % convert_exception(e))
+        root_logger.error('migration bind failed: %s' % convert_exception(e))
         raise IOError(errno.EIO, 'Bind error')
     finally:
         conn.unbind_s()
diff --git a/install/tools/ipa-adtrust-install b/install/tools/ipa-adtrust-install
index cc99b5551..9a6e61c2c 100755
--- a/install/tools/ipa-adtrust-install
+++ b/install/tools/ipa-adtrust-install
@@ -33,6 +33,7 @@ from ipalib import api, errors, util
 from ipapython.config import IPAOptionParser
 import krbV
 import ldap
+from ipapython.ipa_log_manager import *
 
 def parse_options():
     parser = IPAOptionParser(version=version.VERSION)
@@ -82,11 +83,11 @@ def main():
     if os.getegid() != 0:
         sys.exit("Must be root to setup AD trusts on server")
 
-    standard_logging_setup("/var/log/ipaserver-install.log", options.debug, filemode='a')
+    standard_logging_setup("/var/log/ipaserver-install.log", debug=options.debug, filemode='a')
     print "\nThe log file for this installation can be found in /var/log/ipaserver-install.log"
 
-    logging.debug('%s was invoked with options: %s' % (sys.argv[0], safe_options))
-    logging.debug("missing options might be asked for interactively later\n")
+    root_logger.debug('%s was invoked with options: %s' % (sys.argv[0], safe_options))
+    root_logger.debug("missing options might be asked for interactively later\n")
 
     installutils.check_server_configuration()
 
@@ -149,7 +150,7 @@ def main():
                 sys.exit("Aborting installation.")
 
     ip_address = str(ip)
-    logging.debug("will use ip_address: %s\n", ip_address)
+    root_logger.debug("will use ip_address: %s\n", ip_address)
 
     if not options.unattended:
         print ""
@@ -245,5 +246,5 @@ except Exception, e:
     message = str(e)
     for str in traceback.format_tb(sys.exc_info()[2]):
         message = message + "\n" + str
-    logging.debug(message)
+    root_logger.debug(message)
     sys.exit(1)
diff --git a/install/tools/ipa-ca-install b/install/tools/ipa-ca-install
index 445b06214..57f867e70 100755
--- a/install/tools/ipa-ca-install
+++ b/install/tools/ipa-ca-install
@@ -21,7 +21,7 @@
 import sys
 import socket
 
-import os, traceback, logging, shutil
+import os, traceback, shutil
 
 from ipapython import ipautil
 from ipapython import services as ipaservices
@@ -37,6 +37,7 @@ from ipapython import version
 from ipalib import api, util
 from ipapython.config import IPAOptionParser
 from ipapython import sysrestore
+from ipapython.ipa_log_manager import *
 
 CACERT="/etc/ipa/ca.crt"
 REPLICA_INFO_TOP_DIR=None
@@ -71,8 +72,8 @@ def get_dirman_password():
 
 def main():
     safe_options, options, filename = parse_options()
-    installutils.standard_logging_setup("/var/log/ipareplica-ca-install.log", options.debug)
-    logging.debug('%s was invoked with argument "%s" and options: %s' % (sys.argv[0], filename, safe_options))
+    standard_logging_setup("/var/log/ipareplica-ca-install.log", debug=options.debug)
+    root_logger.debug('%s was invoked with argument "%s" and options: %s' % (sys.argv[0], filename, safe_options))
 
     if not ipautil.file_exists(filename):
         sys.exit("Replica file %s does not exist" % filename)
@@ -120,7 +121,7 @@ def main():
     try:
         host = get_host_name(options.no_host_dns)
     except BadHostError, e:
-        logging.error(str(e))
+        root_logger.error(str(e))
         sys.exit(1)
     if config.host_name != host:
         try:
@@ -170,7 +171,7 @@ except Exception, e:
     message = str(e)
     for str in traceback.format_tb(sys.exc_info()[2]):
         message = message + "\n" + str
-    logging.debug(message)
+    root_logger.debug(message)
 except KeyboardInterrupt:
     print "Installation cancelled."
 finally:
diff --git a/install/tools/ipa-compat-manage b/install/tools/ipa-compat-manage
index 898a797cf..13a93cbed 100755
--- a/install/tools/ipa-compat-manage
+++ b/install/tools/ipa-compat-manage
@@ -27,7 +27,7 @@ try:
     from ipaserver.install.ldapupdate import LDAPUpdate, BadSyntax
     from ipaserver.plugins.ldap2 import ldap2
     from ipalib import api, errors
-    import logging
+    from ipapython.ipa_log_manager import *
 except ImportError:
     print >> sys.stderr, """\
 There was a problem importing one of the required Python modules. The
@@ -79,20 +79,16 @@ def get_entry(dn, conn):
 
 def main():
     retval = 0
-    loglevel = logging.ERROR
     files = ['/usr/share/ipa/schema_compat.uldif']
 
     options, args = parse_options()
-    if options.debug:
-        loglevel = logging.DEBUG
 
     if len(args) != 1:
         sys.exit("You must specify one action, either enable or disable")
     elif args[0] != "enable" and args[0] != "disable" and args[0] != "status":
         sys.exit("Unrecognized action [" + args[0] + "]")
 
-    logging.basicConfig(level=loglevel,
-                        format='%(levelname)s %(message)s')
+    standard_logging_setup(None, debug=options.debug)
 
     dirman_password = ""
     if options.password:
diff --git a/install/tools/ipa-csreplica-manage b/install/tools/ipa-csreplica-manage
index 3b08abd4b..0178f18b3 100755
--- a/install/tools/ipa-csreplica-manage
+++ b/install/tools/ipa-csreplica-manage
@@ -23,7 +23,7 @@ import sys
 import os
 
 import ldap, krbV
-import logging
+from ipapython.ipa_log_manager import *
 
 from ipapython import ipautil
 from ipaserver.install import replication, installutils
@@ -116,7 +116,7 @@ class CSReplicationManager(replication.ReplicationManager):
         try:
             self.conn.modify_s(dn, mod)
         except Exception, e:
-            logging.debug("Failed to remove referral value: %s" % convert_error(e))
+            root_logger.debug("Failed to remove referral value: %s" % convert_error(e))
 
 def parse_options():
     from optparse import OptionParser
@@ -154,13 +154,6 @@ def parse_options():
         cmdstr = " | ".join(commands.keys())
         parser.error("must provide a command [%s]" % cmdstr)
 
-    # set log level
-    if options.verbose:
-        # if verbose, output events at INFO level if not already
-        mylogger = logging.getLogger()
-        if mylogger.getEffectiveLevel() > logging.INFO:
-            mylogger.setLevel(logging.INFO)
-        # else user has already configured logging externally lower
     return options, args
 
 def list_replicas(realm, host, replica, dirman_passwd, verbose):
@@ -357,10 +350,10 @@ def re_initialize(realm, options):
     filter = "(&(nsDS5ReplicaHost=%s)(|(objectclass=nsDSWindowsReplicationAgreement)(objectclass=nsds5ReplicationAgreement)))" % thishost
     entry = repl.conn.search_s("cn=config", ldap.SCOPE_SUBTREE, filter)
     if len(entry) == 0:
-        logging.error("Unable to find %s -> %s replication agreement" % (options.fromhost, thishost))
+        root_logger.error("Unable to find %s -> %s replication agreement" % (options.fromhost, thishost))
         sys.exit(1)
     if len(entry) > 1:
-        logging.error("Found multiple agreements for %s. Only initializing the first one returned: %s" % (thishost, entry[0].dn))
+        root_logger.error("Found multiple agreements for %s. Only initializing the first one returned: %s" % (thishost, entry[0].dn))
 
     repl.initialize_replication(entry[0].dn, repl.conn)
     repl.wait_for_repl_init(repl.conn, entry[0].dn)
@@ -378,8 +371,9 @@ def main():
 
     # Just initialize the environment. This is so the installer can have
     # access to the plugin environment
-    api_env = {}
-    api_env['in_server'] = True
+    api_env = {'in_server' : True,
+               'verbose'   : options.verbose,
+              }
 
     if os.getegid() != 0:
         api_env['log'] = None # turn off logging for non-root
diff --git a/install/tools/ipa-dns-install b/install/tools/ipa-dns-install
index 7841c21dc..5c02c20c0 100755
--- a/install/tools/ipa-dns-install
+++ b/install/tools/ipa-dns-install
@@ -32,6 +32,7 @@ from ipapython.config import IPAOptionParser
 from ipalib.constants import DNS_ZONE_REFRESH
 import krbV
 import ldap
+from ipapython.ipa_log_manager import *
 
 def parse_options():
     parser = IPAOptionParser(version=version.VERSION)
@@ -88,11 +89,11 @@ def main():
     if os.getegid() != 0:
         sys.exit("Must be root to setup server")
 
-    standard_logging_setup("/var/log/ipaserver-install.log", options.debug, filemode='a')
+    standard_logging_setup("/var/log/ipaserver-install.log", debug=options.debug, filemode='a')
     print "\nThe log file for this installation can be found in /var/log/ipaserver-install.log"
 
-    logging.debug('%s was invoked with options: %s' % (sys.argv[0], safe_options))
-    logging.debug("missing options might be asked for interactively later\n")
+    root_logger.debug('%s was invoked with options: %s' % (sys.argv[0], safe_options))
+    root_logger.debug("missing options might be asked for interactively later\n")
 
     installutils.check_server_configuration()
 
@@ -157,7 +158,7 @@ def main():
         else:
             ip = read_ip_address(api.env.host, fstore)
     ip_address = str(ip)
-    logging.debug("will use ip_address: %s\n", ip_address)
+    root_logger.debug("will use ip_address: %s\n", ip_address)
 
     if options.reverse_zone and not bindinstance.verify_reverse_zone(options.reverse_zone, ip):
         sys.exit(1)
@@ -168,7 +169,7 @@ def main():
         dns_forwarders = options.forwarders
     else:
         dns_forwarders = read_dns_forwarders()
-    logging.debug("will use dns_forwarders: %s\n", str(dns_forwarders))
+    root_logger.debug("will use dns_forwarders: %s\n", str(dns_forwarders))
 
     if bind.dm_password:
         api.Backend.ldap2.connect(bind_dn="cn=Directory Manager", bind_pw=bind.dm_password)
@@ -236,5 +237,5 @@ except Exception, e:
     message = str(e)
     for str in traceback.format_tb(sys.exc_info()[2]):
         message = message + "\n" + str
-    logging.debug(message)
+    root_logger.debug(message)
     sys.exit(1)
diff --git a/install/tools/ipa-ldap-updater b/install/tools/ipa-ldap-updater
index 6ecb8c155..472495471 100755
--- a/install/tools/ipa-ldap-updater
+++ b/install/tools/ipa-ldap-updater
@@ -32,8 +32,8 @@ try:
     from ipaserver.install.ldapupdate import LDAPUpdate, BadSyntax, UPDATES_DIR
     from ipaserver.install.upgradeinstance import IPAUpgrade
     from ipapython import sysrestore
-    import logging
     import krbV
+    from ipapython.ipa_log_manager import *
 except ImportError:
     print >> sys.stderr, """\
 There was a problem importing one of the required Python modules. The
@@ -76,13 +76,10 @@ def get_dirman_password():
     return password
 
 def main():
-    loglevel = logging.INFO
     badsyntax = False
     upgradefailed = False
 
     safe_options, options, args = parse_options()
-    if options.debug:
-        loglevel = logging.DEBUG
 
     if os.getegid() == 0:
         installutils.check_server_configuration()
@@ -103,19 +100,11 @@ def main():
     if len(args) > 0:
         files = args
 
-    # Clear all existing log handler
-    loggers = logging.getLogger()
-    if loggers.handlers:
-        for handler in loggers.handlers:
-            loggers.removeHandler(handler)
     if options.upgrade:
         if os.getegid() != 0:
             sys.exit('Upgrade can only be done as root')
-        logging.basicConfig(level=loglevel,
-                            format='%(asctime)s %(levelname)s %(message)s',
-                            filename='/var/log/ipaupgrade.log',
-                            filemode='a')
-        logging.debug('%s was invoked with arguments %s and options: %s' % (sys.argv[0], args, safe_options))
+        standard_logging_setup('/var/log/ipaupgrade.log', verbose=True, debug=options.debug, filemode='a')
+        root_logger.debug('%s was invoked with arguments %s and options: %s' % (sys.argv[0], args, safe_options))
         realm = krbV.default_context().default_realm
         upgrade = IPAUpgrade(realm, files, live_run=not options.test)
         upgrade.create_instance()
@@ -123,8 +112,7 @@ def main():
         badsyntax = upgrade.badsyntax
         upgradefailed = upgrade.upgradefailed
     else:
-        logging.basicConfig(level=loglevel,
-                            format='%(levelname)s %(message)s')
+        standard_logging_setup(None, verbose=True, debug=options.debug)
         ld = LDAPUpdate(dm_password=dirman_password, sub_dict={}, live_run=not options.test, ldapi=options.ldapi)
         if len(files) < 1:
             files = ld.get_all_files(UPDATES_DIR)
diff --git a/install/tools/ipa-managed-entries b/install/tools/ipa-managed-entries
index 92f02ef59..24ba0e760 100755
--- a/install/tools/ipa-managed-entries
+++ b/install/tools/ipa-managed-entries
@@ -29,7 +29,8 @@ try:
     from ipaserver.plugins.ldap2 import ldap2
     from ipalib import api, errors
     from ipalib.dn import *
-    import logging
+    from ipapython.ipa_log_manager import *
+
 except ImportError:
     print >> sys.stderr, """\
 There was a problem importing one of the required Python modules. The
@@ -75,11 +76,8 @@ def get_dirman_password():
 
 def main():
     retval = 0
-    loglevel = logging.ERROR
     def_dn = None
     options, args = parse_options()
-    if options.debug:
-        loglevel = logging.DEBUG
 
     if options.list_managed_entries:
         pass
@@ -87,8 +85,7 @@ def main():
         sys.exit("You must specify an action, either status, enable or disable")
     elif args[0] != "enable" and args[0] != "disable" and args[0] != "status":
         sys.exit("Unrecognized action [" + args[0] + "]")
-    logging.basicConfig(level=loglevel,
-                        format='%(levelname)s %(message)s')
+    standard_logging_setup(None, debug=options.debug)
 
     host = installutils.get_fqdn()
     api.bootstrap(context='cli', debug=options.debug)
diff --git a/install/tools/ipa-nis-manage b/install/tools/ipa-nis-manage
index 886f23ab8..5c5bbca8e 100755
--- a/install/tools/ipa-nis-manage
+++ b/install/tools/ipa-nis-manage
@@ -29,7 +29,7 @@ try:
     from ipaserver.install.ldapupdate import LDAPUpdate, BadSyntax
     from ipaserver.plugins.ldap2 import ldap2
     from ipalib import api, errors
-    import logging
+    from ipapython.ipa_log_manager import *
 except ImportError:
     print >> sys.stderr, """\
 There was a problem importing one of the required Python modules. The
@@ -81,7 +81,6 @@ def get_entry(dn, conn):
 
 def main():
     retval = 0
-    loglevel = logging.ERROR
     files = ['/usr/share/ipa/nis.uldif']
     servicemsg = ""
 
@@ -91,17 +90,13 @@ def main():
     installutils.check_server_configuration()
 
     options, args = parse_options()
-    if options.debug:
-        loglevel = logging.DEBUG
 
     if len(args) != 1:
         sys.exit("You must specify one action, either enable or disable")
     elif args[0] != "enable" and args[0] != "disable":
         sys.exit("Unrecognized action [" + args[0] + "]")
 
-    logging.basicConfig(level=loglevel,
-                        format='%(levelname)s %(message)s')
-
+    standard_logging_setup(None, debug=options.debug)
     dirman_password = ""
     if options.password:
         try:
diff --git a/install/tools/ipa-replica-conncheck b/install/tools/ipa-replica-conncheck
index db074fbae..8f8163619 100755
--- a/install/tools/ipa-replica-conncheck
+++ b/install/tools/ipa-replica-conncheck
@@ -25,7 +25,7 @@ from ipapython.ipautil import CalledProcessError
 from ipaserver.install import installutils
 import ipaclient.ipachangeconf
 from optparse import OptionGroup
-import logging
+from ipapython.ipa_log_manager import *
 import sys
 import os
 import signal
@@ -138,25 +138,12 @@ def parse_options():
     return safe_options, options
 
 def logging_setup(options):
+    log_file = None
+
     if os.getegid() == 0:
         log_file = "/var/log/ipareplica-conncheck.log"
-        old_umask = os.umask(077)
-        logging.basicConfig(level=logging.DEBUG,
-                        format='%(asctime)s %(levelname)s %(message)s',
-                        filename=log_file,
-                        filemode='w')
-        os.umask(old_umask)
-
-    console = logging.StreamHandler()
-    # If the debug option is set, also log debug messages to the console
-    if options.debug:
-        console.setLevel(logging.DEBUG)
-    else:
-        # Otherwise, log critical and error messages
-        console.setLevel(logging.ERROR)
-    formatter = logging.Formatter('%(name)-12s: %(levelname)-8s %(message)s')
-    console.setFormatter(formatter)
-    logging.getLogger('').addHandler(console)
+
+    standard_logging_setup(log_file, debug=options.debug)
 
 def clean_responders(responders):
     if not responders:
@@ -217,8 +204,8 @@ def configure_krb5_conf(realm, kdc, filename):
     appopts = [{'name':'pam', 'type':'subsection', 'value':pamopts}]
     opts.append({'name':'appdefaults', 'type':'section', 'value':appopts})
 
-    logging.debug("Writing temporary Kerberos configuration to %s:\n%s"
-            % (filename, krbconf.dump(opts)))
+    root_logger.debug("Writing temporary Kerberos configuration to %s:\n%s"
+                              % (filename, krbconf.dump(opts)))
 
     krbconf.newConf(filename, opts)
 
@@ -265,8 +252,8 @@ def main():
     safe_options, options = parse_options()
 
     logging_setup(options)
-    logging.debug('%s was invoked with options: %s' % (sys.argv[0], safe_options))
-    logging.debug("missing options might be asked for interactively later\n")
+    root_logger.debug('%s was invoked with options: %s' % (sys.argv[0], safe_options))
+    root_logger.debug("missing options might be asked for interactively later\n")
 
     signal.signal(signal.SIGTERM, sigterm_handler)
     signal.signal(signal.SIGINT, sigterm_handler)
@@ -291,7 +278,7 @@ def main():
         global RESPONDERS
         print_info("Start listening on required ports for remote master check")
         for port in required_ports:
-            logging.debug("Start listening on port %d (%s)" % (port.port, port.description))
+            root_logger.debug("Start listening on port %d (%s)" % (port.port, port.description))
             responder = PortResponder(port.port, port.stream)
             responder.start()
             RESPONDERS.append(responder)
diff --git a/install/tools/ipa-replica-install b/install/tools/ipa-replica-install
index 18a6c4a14..fd772e571 100755
--- a/install/tools/ipa-replica-install
+++ b/install/tools/ipa-replica-install
@@ -21,7 +21,7 @@
 import sys
 import socket
 
-import os, pwd, traceback, logging, shutil
+import os, pwd, traceback, shutil
 import grp
 from optparse import OptionGroup
 
@@ -40,6 +40,7 @@ from ipalib import api, errors, util
 from ipapython.config import IPAOptionParser
 from ipapython import sysrestore
 from ipapython import services as ipaservices
+from ipapython.ipa_log_manager import *
 
 CACERT="/etc/ipa/ca.crt"
 REPLICA_INFO_TOP_DIR=None
@@ -265,8 +266,8 @@ def check_bind():
 
 def main():
     safe_options, options, filename = parse_options()
-    installutils.standard_logging_setup("/var/log/ipareplica-install.log", options.debug)
-    logging.debug('%s was invoked with argument "%s" and options: %s' % (sys.argv[0], filename, safe_options))
+    standard_logging_setup("/var/log/ipareplica-install.log", debug=options.debug)
+    root_logger.debug('%s was invoked with argument "%s" and options: %s' % (sys.argv[0], filename, safe_options))
 
     if not ipautil.file_exists(filename):
         sys.exit("Replica file %s does not exist" % filename)
@@ -310,7 +311,7 @@ def main():
     try:
         host = get_host_name(options.no_host_dns)
     except BadHostError, e:
-        logging.error(str(e))
+        root_logger.error(str(e))
         sys.exit(1)
     if config.host_name != host:
         try:
@@ -355,16 +356,16 @@ def main():
     # Create DS group if it doesn't exist yet
     try:
         grp.getgrnam(dsinstance.DS_GROUP)
-        logging.debug("ds group %s exists" % dsinstance.DS_GROUP)
+        root_logger.debug("ds group %s exists" % dsinstance.DS_GROUP)
         group_exists = True
     except KeyError:
         group_exists = False
         args = ["/usr/sbin/groupadd", "-r", dsinstance.DS_GROUP]
         try:
             ipautil.run(args)
-            logging.debug("done adding DS group")
+            root_logger.debug("done adding DS group")
         except ipautil.CalledProcessError, e:
-            logging.critical("failed to add DS group: %s" % e)
+            root_logger.critical("failed to add DS group: %s" % e)
     sstore.backup_state("install", "group_exists", group_exists)
 
     #Automatically disable pkinit w/ dogtag until that is supported
@@ -475,9 +476,9 @@ except Exception, e:
     message = str(e)
     for str in traceback.format_tb(sys.exc_info()[2]):
         message = message + "\n" + str
-    logging.debug(message)
+    root_logger.debug(message)
 except KeyboardInterrupt:
-    print "Installation cancelled." 
+    print "Installation cancelled."
 finally:
     # always try to remove decrypted replica file
     try:
@@ -487,7 +488,7 @@ finally:
         pass
 
 print ""
-print "Your system may be partly configured." 
+print "Your system may be partly configured."
 print "Run /usr/sbin/ipa-server-install --uninstall to clean up."
 
 # the only way to get here is on error or ^C
diff --git a/install/tools/ipa-replica-manage b/install/tools/ipa-replica-manage
index e4ff7166e..8506fcba7 100755
--- a/install/tools/ipa-replica-manage
+++ b/install/tools/ipa-replica-manage
@@ -21,7 +21,7 @@ import sys
 import os
 
 import ldap, re, krbV
-import traceback, logging
+import traceback
 
 from ipapython import ipautil
 from ipaserver.install import replication, dsinstance, installutils
@@ -29,6 +29,7 @@ from ipaserver.install import bindinstance
 from ipaserver import ipaldap
 from ipapython import version
 from ipalib import api, errors, util
+from ipapython.ipa_log_manager import *
 
 CACERT = "/etc/ipa/ca.crt"
 
@@ -93,13 +94,6 @@ def parse_options():
         cmdstr = " | ".join(commands.keys())
         parser.error("must provide a command [%s]" % cmdstr)
 
-    # set log level
-    if options.verbose:
-        # if verbose, output events at INFO level if not already
-        mylogger = logging.getLogger()
-        if mylogger.getEffectiveLevel() > logging.INFO:
-            mylogger.setLevel(logging.INFO)
-        # else user has already configured logging externally lower
     return options, args
 
 def test_connection(realm, host):
@@ -346,7 +340,7 @@ def add_link(realm, replica1, replica2, dirman_passwd, options):
 
     if options.winsync:
         if not options.binddn or not options.bindpw or not options.cacert or not options.passsync:
-            logging.error("The arguments --binddn, --bindpw, --passsync and --cacert are required to create a winsync agreement")
+            root_logger.error("The arguments --binddn, --bindpw, --passsync and --cacert are required to create a winsync agreement")
             sys.exit(1)
 
     if options.cacert:
@@ -396,10 +390,10 @@ def re_initialize(realm, options):
     filter = "(&(nsDS5ReplicaHost=%s)(|(objectclass=nsDSWindowsReplicationAgreement)(objectclass=nsds5ReplicationAgreement)))" % thishost
     entry = repl.conn.search_s("cn=config", ldap.SCOPE_SUBTREE, filter)
     if len(entry) == 0:
-        logging.error("Unable to find %s -> %s replication agreement" % (options.fromhost, thishost))
+        root_logger.error("Unable to find %s -> %s replication agreement" % (options.fromhost, thishost))
         sys.exit(1)
     if len(entry) > 1:
-        logging.error("Found multiple agreements for %s. Only initializing the first one returned: %s" % (thishost, entry[0].dn))
+        root_logger.error("Found multiple agreements for %s. Only initializing the first one returned: %s" % (thishost, entry[0].dn))
 
     repl.initialize_replication(entry[0].dn, repl.conn)
     repl.wait_for_repl_init(repl.conn, entry[0].dn)
@@ -422,8 +416,9 @@ def main():
 
     # Just initialize the environment. This is so the installer can have
     # access to the plugin environment
-    api_env = {}
-    api_env['in_server'] = True
+    api_env = {'in_server' : True,
+               'verbose'   : options.verbose,
+              }
 
     if os.getegid() != 0:
         api_env['log'] = None # turn off logging for non-root
diff --git a/install/tools/ipa-replica-prepare b/install/tools/ipa-replica-prepare
index 031c7b984..269fe5f46 100755
--- a/install/tools/ipa-replica-prepare
+++ b/install/tools/ipa-replica-prepare
@@ -20,7 +20,8 @@
 
 import sys
 
-import logging, tempfile, shutil, os, pwd
+import tempfile, shutil, os, pwd
+from ipapython.ipa_log_manager import *
 import traceback
 from ConfigParser import SafeConfigParser
 import krbV
@@ -51,7 +52,7 @@ def parse_options():
                       help="PIN for the Apache Server PKCS#12 file")
     parser.add_option("--pkinit_pin", dest="pkinit_pin",
                       help="PIN for the KDC pkinit PKCS#12 file")
-    parser.add_option("-p", "--password", dest="password", 
+    parser.add_option("-p", "--password", dest="password",
                       help="Directory Manager (existing master) password")
     parser.add_option("--ip-address", dest="ip_address",
                       type="ip", help="Add A and PTR records of the future replica")
@@ -100,7 +101,7 @@ def get_subject_base(host_name, dm_password, suffix):
         conn = ldap2(shared_instance=False, base_dn=suffix)
         conn.connect(bind_dn='cn=directory manager', bind_pw=dm_password)
     except errors.ExecutionError, e:
-        logging.critical("Could not connect to the Directory Server on %s" % host_name)
+        root_logger.critical("Could not connect to the Directory Server on %s" % host_name)
         raise e
     (dn, entry_attrs) = conn.get_ipa_config()
     conn.disconnect()
@@ -109,7 +110,7 @@ def get_subject_base(host_name, dm_password, suffix):
 def check_ipa_configuration(realm_name):
     config_dir = dsinstance.config_dirname(dsinstance.realm_to_serverid(realm_name))
     if not ipautil.dir_exists(config_dir):
-        logging.error("could not find directory instance: %s" % config_dir)
+        root_logger.error("could not find directory instance: %s" % config_dir)
         sys.exit(1)
 
 def export_certdb(realm_name, ds_dir, dir, passwd_fname, fname, hostname, subject_base=None, is_kdc=False):
@@ -472,6 +473,6 @@ except Exception, e:
     message = str(e)
     for str in traceback.format_tb(sys.exc_info()[2]):
         message = message + "\n" + str
-    logging.debug(message)
+    root_logger.debug(message)
     print message
     sys.exit(1)
diff --git a/install/tools/ipa-server-install b/install/tools/ipa-server-install
index 961c86c13..26bb8b4b4 100755
--- a/install/tools/ipa-server-install
+++ b/install/tools/ipa-server-install
@@ -29,7 +29,6 @@
 import sys
 import os
 import errno
-import logging
 import grp
 import subprocess
 import signal
@@ -63,6 +62,7 @@ from ipalib.dn import DN
 from ipalib.x509 import load_certificate_from_file, load_certificate_chain_from_file
 from ipalib.constants import DNS_ZONE_REFRESH
 from ipapython import services as ipaservices
+from ipapython.ipa_log_manager import *
 
 pw_name = None
 uninstalling = False
@@ -440,7 +440,7 @@ def uninstall():
     try:
         (stdout, stderr, rc) = run(["/usr/sbin/ipa-client-install", "--on-master", "--unattended", "--uninstall"], raiseonerr=False)
         if rc not in [0,2]:
-            logging.debug("ipa-client-install returned %d" % rc)
+            root_logger.debug("ipa-client-install returned %d" % rc)
             raise RuntimeError(stdout)
     except Exception, e:
         rv = 1
@@ -472,10 +472,10 @@ def uninstall():
             try:
                 ipautil.run(["/usr/sbin/groupdel", dsinstance.DS_GROUP])
             except ipautil.CalledProcessError, e:
-                logging.critical("failed to delete group %s" % e)
+                root_logger.critical("failed to delete group %s" % e)
                 rv = 1
         except KeyError:
-            logging.info("Group %s already removed", dsinstance.DS_GROUP)
+            root_logger.info("Group %s already removed", dsinstance.DS_GROUP)
 
     ipaservices.knownservices.ipa.disable()
 
@@ -488,16 +488,16 @@ def uninstall():
             print >>sys.stderr, "Failed to set this machine hostname back to %s (%s)." % (old_hostname, str(e))
 
     if fstore.has_files():
-        logging.error('Some files have not been restored, see /var/lib/ipa/sysrestore/sysrestore.index')
+        root_logger.error('Some files have not been restored, see /var/lib/ipa/sysrestore/sysrestore.index')
     has_state = False
     for module in IPA_MODULES: # from installutils
         if sstore.has_state(module):
-            logging.error('Some installation state for %s has not been restored, see /var/lib/ipa/sysrestore/sysrestore.state' % module)
+            root_logger.error('Some installation state for %s has not been restored, see /var/lib/ipa/sysrestore/sysrestore.state' % module)
             has_state = True
             rv = 1
 
     if has_state:
-        logging.warn('Some installation state has not been restored.\nThis will cause re-installation to fail.\nIt should be safe to remove /var/lib/ipa/sysrestore.state but it may\nmean your system hasn\'t be restored to its pre-installation state.')
+        root_logger.warning('Some installation state has not been restored.\nThis will cause re-installation to fail.\nIt should be safe to remove /var/lib/ipa/sysrestore.state but it may\nmean your system hasn\'t be restored to its pre-installation state.')
 
     return rv
 
@@ -510,7 +510,7 @@ def set_subject_in_config(realm_name, dm_password, suffix, subject_base):
             conn = ldap2(shared_instance=False, ldap_uri=ldapuri, base_dn=suffix)
             conn.connect(bind_dn='cn=directory manager', bind_pw=dm_password)
         except errors.ExecutionError, e:
-            logging.critical("Could not connect to the Directory Server on %s" % realm_name)
+            root_logger.critical("Could not connect to the Directory Server on %s" % realm_name)
             raise e
         (dn, entry_attrs) = conn.get_ipa_config()
         if 'ipacertificatesubjectbase' not in entry_attrs:
@@ -534,9 +534,9 @@ def main():
 
     if options.uninstall:
         uninstalling = True
-        standard_logging_setup("/var/log/ipaserver-uninstall.log", options.debug)
+        standard_logging_setup("/var/log/ipaserver-uninstall.log", debug=options.debug)
     else:
-        standard_logging_setup("/var/log/ipaserver-install.log", options.debug)
+        standard_logging_setup("/var/log/ipaserver-install.log", debug=options.debug)
         print "\nThe log file for this installation can be found in /var/log/ipaserver-install.log"
         if not options.external_ca and not options.external_cert_file and is_ipa_configured():
             sys.exit("IPA server is already configured on this system.\n"
@@ -547,8 +547,8 @@ def main():
             sys.exit("IPA client is already configured on this system.\n"
                      + "Please uninstall it first before configuring the IPA server.")
 
-    logging.debug('%s was invoked with options: %s' % (sys.argv[0], safe_options))
-    logging.debug("missing options might be asked for interactively later\n")
+    root_logger.debug('%s was invoked with options: %s' % (sys.argv[0], safe_options))
+    root_logger.debug("missing options might be asked for interactively later\n")
 
     global fstore
     fstore = sysrestore.FileStore('/var/lib/ipa/sysrestore')
@@ -706,7 +706,7 @@ def main():
         sys.exit(str(e) + "\n")
 
     host_name = host_name.lower()
-    logging.debug("will use host_name: %s\n" % host_name)
+    root_logger.debug("will use host_name: %s\n" % host_name)
 
     system_hostname = get_fqdn()
     if host_name != system_hostname:
@@ -719,7 +719,7 @@ def main():
 
     if not options.domain_name:
         domain_name = read_domain_name(host_name[host_name.find(".")+1:], options.unattended)
-        logging.debug("read domain_name: %s\n" % domain_name)
+        root_logger.debug("read domain_name: %s\n" % domain_name)
     else:
         domain_name = options.domain_name
 
@@ -751,7 +751,7 @@ def main():
 
     if ip is None:
         ip = read_ip_address(host_name, fstore)
-        logging.debug("read ip_address: %s\n" % str(ip))
+        root_logger.debug("read ip_address: %s\n" % str(ip))
 
     ip_address = str(ip)
 
@@ -785,7 +785,7 @@ def main():
 
     if not options.realm_name:
         realm_name = read_realm_name(domain_name, options.unattended)
-        logging.debug("read realm_name: %s\n" % realm_name)
+        root_logger.debug("read realm_name: %s\n" % realm_name)
     else:
         realm_name = options.realm_name.upper()
 
@@ -831,7 +831,7 @@ def main():
             print "Using reverse zone %s" % reverse_zone
     else:
         dns_forwarders = ()
-    logging.debug("will use dns_forwarders: %s\n" % str(dns_forwarders))
+    root_logger.debug("will use dns_forwarders: %s\n" % str(dns_forwarders))
 
     # Create the management framework config file and finalize api
     target_fname = '/etc/ipa/default.conf'
@@ -862,7 +862,7 @@ def main():
         print ""
 
     if host_name != system_hostname:
-        logging.debug("Chosen hostname (%s) differs from system hostname (%s) - change it" \
+        root_logger.debug("Chosen hostname (%s) differs from system hostname (%s) - change it" \
                       % (host_name, system_hostname))
         # configure /etc/sysconfig/network to contain the custom hostname
         ipaservices.backup_and_replace_hostname(fstore, sstore, host_name)
@@ -870,16 +870,16 @@ def main():
     # Create DS group if it doesn't exist yet
     try:
         grp.getgrnam(dsinstance.DS_GROUP)
-        logging.debug("ds group %s exists" % dsinstance.DS_GROUP)
+        root_logger.debug("ds group %s exists" % dsinstance.DS_GROUP)
         group_exists = True
     except KeyError:
         group_exists = False
         args = ["/usr/sbin/groupadd", "-r", dsinstance.DS_GROUP]
         try:
             ipautil.run(args)
-            logging.debug("done adding DS group")
+            root_logger.debug("done adding DS group")
         except ipautil.CalledProcessError, e:
-            logging.critical("failed to add DS group: %s" % e)
+            root_logger.critical("failed to add DS group: %s" % e)
     sstore.backup_state("install", "group_exists", group_exists)
 
     # Configure ntpd
@@ -1131,7 +1131,7 @@ try:
         message = str(e)
         for str in traceback.format_tb(sys.exc_info()[2]):
             message = message + "\n" + str
-        logging.debug(message)
+        root_logger.debug(message)
         sys.exit(1)
 finally:
     if pw_name and ipautil.file_exists(pw_name):
diff --git a/install/tools/ipactl b/install/tools/ipactl
index 808849ff9..74ee38304 100755
--- a/install/tools/ipactl
+++ b/install/tools/ipactl
@@ -29,7 +29,6 @@ try:
     from ipapython import config
     from ipalib import api, errors
     from ipalib.dn import DN
-    import logging
     import ldap
     import ldap.sasl
     import ldapurl