You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
You can use the *syslog* link:https://tools.ietf.org/html/rfc3164[RFC3164] or link:https://tools.ietf.org/html/rfc5424[RFC5424] protocol to send a copy of your logs to an external log aggregator that is configured to accept the protocol instead of, or in addition to, the default Elasticsearch log store. You are responsible for configuring the external log aggregator, such as a syslog server, to receive the logs from {product-title}.
5
+
You can use the syslog link:https://tools.ietf.org/html/rfc3164[RFC3164] or link:https://tools.ietf.org/html/rfc5424[RFC5424] protocol to send a copy of your logs to an external log aggregator that is configured to accept the protocol instead of, or in addition to, the default Elasticsearch log store. You are responsible for configuring the external log aggregator, such as a syslog server, to receive the logs from {product-title}.
6
6
7
-
To configure log forwarding using the *syslog* protocol, you must create a `ClusterLogForwarder` custom resource (CR) with one or more outputs to the syslog servers, and pipelines that use those outputs. The syslog output can use a UDP, TCP, or TLS connection.
7
+
To configure log forwarding using the syslog protocol, you must create a `ClusterLogForwarder` custom resource (CR) with one or more outputs to the syslog servers, and pipelines that use those outputs. The syslog output can use a UDP, TCP, or TLS connection.
8
8
9
9
.Prerequisites
10
10
@@ -16,72 +16,54 @@ To configure log forwarding using the *syslog* protocol, you must create a `Clus
<1> In legacy implementations, the CR name must be `instance`. In multi log forwarder implementations, you can use any name.
68
-
<2> In legacy implementations, the CR namespace must be `openshift-logging`. In multi log forwarder implementations, you can use any namespace.
69
-
<3> The name of your service account. The service account is only required in multi log forwarder implementations if the log forwarder is not deployed in the `openshift-logging` namespace.
70
-
<4> Specify a name for the output.
71
-
<5> Specify the `syslog` type.
72
-
<6> Optional: Specify the syslog parameters, listed below.
73
-
<7> Specify the URL and port of the external syslog instance. You can use the `udp` (insecure), `tcp` (insecure) or `tls` (secure TCP) protocol. If the cluster-wide proxy using the CIDR annotation is enabled, the output must be a server name or FQDN, not an IP address.
74
-
<8> If using a `tls` prefix, you must specify the name of the secret required by the endpoint for TLS communication. The secret must contain a `ca-bundle.crt` key that points to the certificate it represents. In legacy implementations, the secret must exist in the `openshift-logging` project.
75
-
<9> Optional: Specify a name for the pipeline.
76
-
<10> Specify which log types to forward by using the pipeline: `application,``infrastructure`, or `audit`.
77
-
<11> Specify the name of the output to use when forwarding logs with this pipeline.
78
-
<12> Optional: Specify the `default` output to forward logs to the internal Elasticsearch instance.
79
-
<13> Optional: String. One or more labels to add to the logs. Quote values like "true" so they are recognized as string values, not as a boolean.
80
-
<14> Optional: Configure multiple outputs to forward logs to other external log aggregators of any supported type:
81
-
** A name to describe the pipeline.
82
-
** The `inputRefs` is the log type to forward by using the pipeline: `application,``infrastructure`, or `audit`.
83
-
** The `outputRefs` is the name of the output to use.
84
-
** Optional: String. One or more labels to add to the logs.
53
+
<1> Specify a name for the output.
54
+
<2> Optional: Specify the value for the `APP-NAME` part of the syslog message header. The value must conform with link:https://datatracker.ietf.org/doc/html/rfc5424[The Syslog Protocol]. The value can be a combination of static and dynamic values consisting of field paths followed by `||`, and then followed by another field path or a static value. The maximum length of the final values is truncated to 48 characters. You must encase a dynamic value curly brackets and the value must be followed with a static fallback value separated with `||`. Static values can only contain alphanumeric characters along with dashes, underscores, dots and forward slashes. Example value: <value1>-{.<value2>||"none"}.
55
+
<3> Optional: Specify the value for `Facility` part of the syslog-msg header.
56
+
<4> Optional: Specify the value for `MSGID` part of the syslog-msg header. The value can be a combination of static and dynamic values consisting of field paths followed by `||`, and then followed by another field path or a static value. The maximum length of the final values is truncated to 32 characters. You must encase a dynamic value curly brackets and the value must be followed with a static fallback value separated with `||`. Static values can only contain alphanumeric characters along with dashes, underscores, dots and forward slashes. Example value: <value1>-{.<value2>||"none"}.
57
+
<5> Optional: Specify the record field to use as the payload. The `payloadKey` value must be a single field path encased in single curly brackets `{}`. Example: {.<value>}.
58
+
<6> Optional: Specify the value for the `PROCID` part of the syslog message header. The value must conform with link:https://datatracker.ietf.org/doc/html/rfc5424[The Syslog Protocol]. The value can be a combination of static and dynamic values consisting of field paths followed by `||`, and then followed by another field path or a static value. The maximum length of the final values is truncated to 48 characters. You must encase a dynamic value curly brackets and the value must be followed with a static fallback value separated with `||`. Static values can only contain alphanumeric characters along with dashes, underscores, dots and forward slashes. Example value: <value1>-{.<value2>||"none"}.
59
+
<7> Optional: Set the RFC that the generated messages conform to. The value can be `RFC3164` or `RFC5424`.
60
+
<8> Optional: Set the severity level for the message. For more information, see link:https://datatracker.ietf.org/doc/html/rfc5424#section-6.2.1[The Syslog Protocol].
61
+
<9> Optional: Set the delivery mode for log forwarding. The value can be either `AtLeastOnce`, or `AtMostOnce`.
62
+
<10> Specify the absolute URL with a scheme. Valid schemes are: `tcp`, `tls`, and `udp`. For example: `tls://syslog-receiver.example.com:6514`.
63
+
<11> Specify the settings for controlling options of the transport layer security (TLS) client connections.
64
+
<12> Specify which log types to forward by using the pipeline: `application,``infrastructure`, or `audit`.
== Adding log source information to the message output
95
77
96
-
You can add `namespace_name`, `pod_name`, and `container_name` elements to the `message` field of the record by adding the `AddLogSource` field to your `ClusterLogForwarder` custom resource (CR).
78
+
You can add `namespace_name`, `pod_name`, and `container_name` elements to the `message` field of the record by adding the `enrichment` field to your `ClusterLogForwarder` custom resource (CR).
You can configure the following for the `syslog` outputs. For more information, see the syslog link:https://tools.ietf.org/html/rfc3164[RFC3164] or link:https://tools.ietf.org/html/rfc5424[RFC5424] RFC.
142
-
143
-
* facility: The link:https://tools.ietf.org/html/rfc5424#section-6.2.1[syslog facility]. The value can be a decimal integer or a case-insensitive keyword:
144
-
** `0` or `kern` for kernel messages
145
-
** `1` or `user` for user-level messages, the default.
146
-
** `2` or `mail` for the mail system
147
-
** `3` or `daemon` for system daemons
148
-
** `4` or `auth` for security/authentication messages
149
-
** `5` or `syslog` for messages generated internally by syslogd
150
-
** `6` or `lpr` for the line printer subsystem
151
-
** `7` or `news` for the network news subsystem
152
-
** `8` or `uucp` for the UUCP subsystem
153
-
** `9` or `cron` for the clock daemon
154
-
** `10` or `authpriv` for security authentication messages
155
-
** `11` or `ftp` for the FTP daemon
156
-
** `12` or `ntp` for the NTP subsystem
157
-
** `13` or `security` for the syslog audit log
158
-
** `14` or `console` for the syslog alert log
159
-
** `15` or `solaris-cron` for the scheduling daemon
160
-
** `16`–`23` or `local0` – `local7` for locally used facilities
161
-
* Optional: `payloadKey`: The record field to use as payload for the syslog message.
162
-
+
163
-
[NOTE]
164
-
====
165
-
Configuring the `payloadKey` parameter prevents other parameters from being forwarded to the syslog.
166
-
====
167
-
+
168
-
* rfc: The RFC to be used for sending logs using syslog. The default is RFC5424.
169
-
* severity: The link:https://tools.ietf.org/html/rfc5424#section-6.2.1[syslog severity] to set on outgoing syslog records. The value can be a decimal integer or a case-insensitive keyword:
170
-
** `0` or `Emergency` for messages indicating the system is unusable
171
-
** `1` or `Alert` for messages indicating action must be taken immediately
172
-
** `2` or `Critical` for messages indicating critical conditions
173
-
** `3` or `Error` for messages indicating error conditions
174
-
** `4` or `Warning` for messages indicating warning conditions
175
-
** `5` or `Notice` for messages indicating normal but significant conditions
176
-
** `6` or `Informational` for messages indicating informational messages
177
-
** `7` or `Debug` for messages indicating debug-level messages, the default
178
-
* tag: Tag specifies a record field to use as a tag on the syslog message.
179
-
* trimPrefix: Remove the specified prefix from the tag.
0 commit comments