|
| 1 | +// Module included in the following assemblies: |
| 2 | +// |
| 3 | +// * logging/cluster-logging-external.adoc |
| 4 | + |
| 5 | +[id="cluster-logging-collector-syslog_{context}"] |
| 6 | += Sending logs using the Fluentd syslog plug-in (RFC 3164) |
| 7 | + |
| 8 | +You can use the Fluentd *syslog* plug-in to send a copy of your logs to an external syslog server, |
| 9 | +not the default Elasticsearch. Note the following about the syslog plug-in: |
| 10 | + |
| 11 | +* uses syslog protocol (RFC 3164), not RFC 5424 |
| 12 | +* does not support TLS and thus, is not secure |
| 13 | +* does not provide Kubernetes metadata, systemd data, or other metadata |
| 14 | + |
| 15 | +[NOTE] |
| 16 | +==== |
| 17 | +The Fluentd syslog plug-in method is deprecated and will be removed in a future release. |
| 18 | +==== |
| 19 | + |
| 20 | +There are two versions of the Fluentd syslog plug-in: |
| 21 | + |
| 22 | +* *out_syslog*: The non-buffered implementation, which communicates through UDP, does not buffer data and writes out results immediately. |
| 23 | +* *out_syslog_buffered*: The buffered implementation, which communicates through TCP, link:https://docs.fluentd.org/buffer[buffers data into chunks]. |
| 24 | + |
| 25 | +To configure the Fluentd syslog plug-in, create a configuration file, called `sysconfig.conf`, with the information needed to forward the logs. Then use that file to create a ConfigMap called `syslog` in the `openshift-logging` namespace, which {product-title} uses when forwarding the logs. On the receiver, configure the *in_syslog* plug-in to receive the logs from {product-title}. For more information on using the *in_forward* plug-in, see the link:https://docs.fluentd.org/input/syslog[Fluentd documentation]. |
| 26 | + |
| 27 | +[IMPORTANT] |
| 28 | +==== |
| 29 | +Changes introduced by the new log forward feature modified the support for Fluentd syslog plug-in starting with the {product-title} 4.3 release. In {product-title} 4.3, you create a ConfigMap, as described below, to configure the Fluentd syslog plug-in. |
| 30 | +==== |
| 31 | + |
| 32 | +You can use multiple syslog servers by specifying separate `<store>` stanzas in the configuration file. |
| 33 | + |
| 34 | +.Sample `sysconfig.conf` |
| 35 | +---- |
| 36 | +<store> |
| 37 | +@type syslog_buffered <1> |
| 38 | +remote_syslog rsyslogserver.openshift-logging.svc.cluster.local <2> |
| 39 | +port 514 <3> |
| 40 | +hostname fluentd-4nzfz <4> |
| 41 | +remove_tag_prefix tag <5> |
| 42 | +tag_key ident,systemd.u.SYSLOG_IDENTIFIER <6> |
| 43 | +facility local0 <7> |
| 44 | +severity info <8> |
| 45 | +use_record true <9> |
| 46 | +payload_key message <10> |
| 47 | +</store> |
| 48 | +---- |
| 49 | + |
| 50 | +<1> The Fluentd syslog plug-in. |
| 51 | +<2> The fully qualified domain name (FQDN) or IP address of the syslog server. |
| 52 | +<3> The port number to connect on. Defaults to `514`. |
| 53 | +<4> The name of the syslog server. |
| 54 | +<5> Removes the prefix from the tag. Defaults to `''` (empty). |
| 55 | +<6> The field to set the syslog key. |
| 56 | +<7> The syslog log facility or source. |
| 57 | +<8> The syslog log severity. |
| 58 | +<9> Determines whether to use the severity and facility from the record if available. |
| 59 | +<10> The key to set the payload of the syslog message. Defaults to `message`. |
| 60 | + |
| 61 | + |
| 62 | +// Above definitions from https://github.com/docebo/fluent-plugin-remote-syslog |
| 63 | + |
| 64 | + |
| 65 | +.Sample `syslog` ConfigMap based on the sample `sysconfig.conf` |
| 66 | + |
| 67 | +[source,yaml] |
| 68 | +---- |
| 69 | +kind: ConfigMap |
| 70 | +apiVersion: v1 |
| 71 | +metadata: |
| 72 | + name: syslog |
| 73 | + namespace: openshift-logging |
| 74 | +data: |
| 75 | + sysconfig.conf: | |
| 76 | + <store> |
| 77 | + @type syslog_buffered |
| 78 | + remote_syslog syslogserver.openshift-logging.svc.cluster.local |
| 79 | + port 514 |
| 80 | + hostname fluentd-4nzfz |
| 81 | + remove_tag_prefix tag |
| 82 | + tag_key ident,systemd.u.SYSLOG_IDENTIFIER |
| 83 | + facility local0 |
| 84 | + severity info |
| 85 | + use_record true |
| 86 | + payload_key message |
| 87 | + </store> |
| 88 | +---- |
| 89 | + |
| 90 | +.Procedure |
| 91 | + |
| 92 | +To configure the Fluentd syslog plug-in: |
| 93 | + |
| 94 | +. Create a configuration file named `sysconfig.conf` that contains the following |
| 95 | +parameters within the `<store>` stanza: |
| 96 | + |
| 97 | +.. Specify the Fluentd syslog plug-in type: |
| 98 | ++ |
| 99 | +---- |
| 100 | +@type syslog_buffered <1> |
| 101 | +---- |
| 102 | ++ |
| 103 | +<1> Specify the plug-in to use, either: `syslog` or `syslog_buffered`. |
| 104 | + |
| 105 | +.. Configure the name, host, and port for your external syslog server: |
| 106 | ++ |
| 107 | +---- |
| 108 | +remote_syslog <remote> <1> |
| 109 | +port <number> <2> |
| 110 | +hostname <name> <3> |
| 111 | +---- |
| 112 | ++ |
| 113 | +<1> Specify the FQDN or IP address of the syslog server. |
| 114 | +<2> Specify the port of the syslog server. |
| 115 | +<3> Specify a name for this syslog server. |
| 116 | ++ |
| 117 | +For example: |
| 118 | ++ |
| 119 | +---- |
| 120 | +remote_syslog syslogserver.openshift-logging.svc.cluster.local |
| 121 | +port 514 |
| 122 | +hostname fluentd-server |
| 123 | +---- |
| 124 | ++ |
| 125 | +If you specify two or more receivers, the Fluentd syslog plug-in uses these servers in a round-robin order. |
| 126 | + |
| 127 | +.. Configure the other syslog variables as needed: |
| 128 | ++ |
| 129 | +---- |
| 130 | +remove_tag_prefix <1> |
| 131 | +tag_key <key> <2> |
| 132 | +facility <value> <3> |
| 133 | +severity <value> <4> |
| 134 | +use_record <value> <5> |
| 135 | +payload_key message <6> |
| 136 | +---- |
| 137 | ++ |
| 138 | +<1> Add this parameter to remove the `tag` field from the syslog prefix. |
| 139 | +<2> Specify the field to set the syslog key. |
| 140 | +<3> Specify the syslog log facility or source. For values, see link:https://tools.ietf.org/html/rfc3164#section-4.1.1[RTF 3164]. |
| 141 | +<4> Specify the syslog log severity. For values, see link:link:https://tools.ietf.org/html/rfc3164#section-4.1.1[RTF 3164]. |
| 142 | +<5> Specify `true` to use the severity and facility from the record if available. If `true`, the `container_name`, `namespace_name`, and `pod_name` are included in the output content. |
| 143 | +<6> Specify the key to set the payload of the syslog message. Defaults to `message`. |
| 144 | ++ |
| 145 | +For example: |
| 146 | ++ |
| 147 | +---- |
| 148 | +facility local0 |
| 149 | +severity info |
| 150 | +---- |
| 151 | ++ |
| 152 | +The configuration file appears similar to the following: |
| 153 | ++ |
| 154 | +---- |
| 155 | +<store> |
| 156 | +@type syslog_buffered |
| 157 | +remote_syslog syslogserver.openshift-logging.svc.cluster.local |
| 158 | +port 514 |
| 159 | +hostname fluentd-4nzfz |
| 160 | +tag_key ident,systemd.u.SYSLOG_IDENTIFIER |
| 161 | +facility local0 |
| 162 | +severity info |
| 163 | +use_record false |
| 164 | +</store> |
| 165 | +---- |
| 166 | + |
| 167 | +. Create a ConfigMap named `syslog` in the `openshift-logging` namespace from the configuration file: |
| 168 | ++ |
| 169 | +---- |
| 170 | +$ oc create configmap syslog --from-file=sysconfig.conf -n openshift-logging |
| 171 | +---- |
| 172 | ++ |
| 173 | +The Cluster Logging Operator redeploys the Fluentd Pods. If the Pods do not redeploy, you can delete the Fluentd |
| 174 | +Pods to force them to redeploy. |
| 175 | ++ |
| 176 | +---- |
| 177 | +$ oc delete pod --selector logging-infra=fluentd |
| 178 | +---- |
| 179 | + |
0 commit comments